Be careful, don't let your drone fly for no reason.

Let's analyze the various attack methods for drones.

1. The hottest attack method a day ago - GPS spoofing

a. No-fly zone location fraud

Because of policies or the need to protect personal and property safety, governments around the world have set up no-fly zones in major cities and airports. After the fall of the DJI drone White House, most drones can't take off in the no-fly zone, even if they reach the no-fly zone. Taking advantage of this will lead to an important attack method - no-fly zone location fraud. The drone flies in the air and receives signals from GPS satellites. How can it be considered to be in the no-fly zone? The answer is of course to launch a stronger GPS signal than the satellite to deceive.

However, the transmission of GPS signals is also divided into two types. One is to record the GPS signal in the no-fly zone and then replay it near the drone. Because the drone receives GPS signals has such characteristics: Whose signal is strong to listen to who. Because the GPS satellite is too far away, the signal attenuation is so much that the signal strength will be inferior to the nearby forged GPS signal. Therefore, it is feasible to replay the GPS signal in the no-fly zone, but the premise is that it is necessary to go to the no-fly zone to record the GPS signal. The other is to make a GPS signal and get any GPS signal you want. This does not need to run too far, but it requires a very good analytical research skills to make this happen. This approach has better universality, GPS spoofing has become more arbitrary, 360 UnicornTeam's topic on this year's Defcon is about GPS signal generation and deception.

b. Return point deception

It is well known that when the drone is activated, it can be set as the return point if it can locate the current position. If the drone itself does not have a limit on the no-fly zone, the attack on the return point is also an effective way. Because when the remote control and the drone are lost, the unmanned person automatically flies toward the return point and eventually returns to the return point. When we use the fake GPS signal to deceive it, it is already at the return point, so the drone will land down. Even if you don't know the location of the return point, you can still deceive its current position and change the direction of return. For example, when performing a flight show at a drone exhibition , launching a high-powered GPS signal from the North Pole, you will see the “spectacular” scene of “a group of drones flying south”.

c. Track fraud

At present, some drones support waypoint flights, that is, they select points on the map first, and no one wants to fly along the selected point. Such functions are also based on GPS positioning. When the drone is deceived by a forged GPS location while flying towards the next selected location, it is clear that the drone will betray the trajectory of the flight toward the location of the deceived location and the next selected point. Fly until you reach the selected point. When the drone's own location is deceived, GPS-based functions will be confused. If the location of the spoof is too far, then the selected point will be difficult to reach.

The principle of Iran’s old UAVs was basically the same.

2. Another method of GPS spoofing - hardware implantation

The drone needs to utilize the GPS function, and the GPS module must exist. The drone uses the GPS module to determine its position. Is it possible to break the GPS inside the drone? The answer is yes, because the manufacturer's design does not encrypt any data between them. There is communication between the GPS module and the master MCU of the drone. If the communication between them is hijacked, the position information of the drone can be effectively changed to achieve the effect of fraud. After parsing the GPS module and the MCU direct data communication format, the data can be changed every time the GPS module sends the data to the drone. Well, it is similar to a translator who is "intentionally speculative", for example, the GPS module receives The positioning data is in Tianjin, but after the "translation" of the hijacking module, finally told that the flight control is now in Chongqing, and then, the drone is rushing to the northeast direction~~

3. Control signal interference and hijacking

The commonly used drone control signals are generally 2.4G, and a band of wifi Bluetooth, 5.8G for graphics transmission. 2.4G now many UAs directly use wifi, easy to interact with mobile phones, um, basically OpenWRT, and WIFI mostly without password or weak password, a directional antenna can be connected to the drone or In the remote control.

Or, the UAV uses only the RF module, and does not want to do the troublesome things like RF signal parsing and replay. It is lazy and can use the signal jammer to suppress the control signal, but the drone can not accept the control. Signals generally do three things: A, landing in place B, returning to the return point C, continuing the trajectory cruise is in line with the previous GPS spoofing.