On Wednesday’s RSA security conference in San Francisco, security researcher Nils Rodday revealed a number of rather alarming flaws in the city’s advanced, police-grade unmanned aerial vehicles (UAVs) that make it possible for him “to take full control over the quadcopter with just a laptop and a cheap radio chip connected via USB.” Due to the absence of any sort of encryption technology between the drone and its controller (called a “telemetry box,”), taking over one of these UAVs isn’t a particularly complicated process. In fact, if you’re able to reverse engineer the flight software, you’re able to completely hijack the quadcopter, sending your own controls while blocking all signals from the legitimate operator.
“You can inject packets and alter waypoints, change data on the flight computer, set a different coming home position,” Rodday says. “Everything the original operator can do, you can do as well.”
So what’s leading to this massive security flaw? Rodday has narrowed it down to two primary culprits — the weak “WEP” or “wired-equivalent privacy” encryption used to connect the telemetry module and a user’s tablet, and even worse, the incredibly insecure encryption (or lack thereof) that connects the telemetry model to the UAV itself.
Rodday, who now works at IBM, has since informed drone manufacturers to the breaches he’s uncovered, and tells Wired that the company plans to address the issue when it updates its line of drones. But that means that the UAVs already on the market are fair game for hacking, and from quite a distance at that.
This is by no means the first time that the security of such drones has been called into question. A few years ago in 2013, Samy Kamkar, a hacker in his own right, showed how his homemade Raspberry Pi equipped drone could be used to hack into other drones mid-flight. The vast majority of the problems he discovered, he said, were contingent on insecure Wi-Fi connections. “It’s all the same story: really poor authentication or no authentication,” Kamkar told Wired.
So before drones can be used by police, they need to be secured. Because nothing could be worse than a gun-equipped UAV that has been taken over by malicious hackers.
