Abstract:—Consumer drones enable high-class aerial video photography, promise to reform the logistics industry, and are already used for humanitarian rescue operations and during armed conflicts. Contrasting their widespread adoption and high popularity, the low entry barrier for air mobility—a traditionally heavily regulated sector—poses many risks to safety, security, and privacy. Malicious parties could, for example, (mis-)use drones for surveillance, transportation of illegal goods, or cause economic damage by intruding the closed airspace above air-ports. To prevent harm, drone manufacturers employ several countermeasures to enforce safe and secure use of drones, e.g., they impose software limits regarding speed and altitude, or use geofencing to implement no-fly zones around airports or prisons. Complementing traditional countermeasures, drones from the market leader DJI implement a tracking protocol called DroneID, which is designed to transmit the position of both the drone and its operator to authorized entities such as law enforcement or operators of critical infrastructures. In this paper, we analyze security and privacy claims for drones, focusing on the leading manufacturer DJI with a market share of 94%. We first systemize the drone attack surface and investigate an attacker capable of eavesdropping on the drone’s over-the-air data traffic. Based on reverse engineering of DJI firmware, we design and implement a decoder for DJI’s proprietary tracking protocol DroneID, using only cheap COTS hardware. We show that the transmitted data is not encrypted, but accessible to anyone, compromising the drone operator’s privacy. Second, we conduct a comprehensive analysis of drone security: Using a combination of reverse engineering, a novel fuzzing approach tailored to DJI’s communication protocol, and hardware analysis, we uncover several critical flaws in drone firmware that allow attackers to gain elevated privileges on two different DJI drones and their remote control. Such root access paves the way to disable

Security in Drones

SoK - Security and Privacy in the Age of Drones: Threats, Challenges, Solution Mechanisms, and Scientific Gaps

Drone Application in Smart Cities: The General Overview of Security Vulnerabilities and Countermeasures for Data Communication

Security analysis of drones systems: Attacks, limitations, and recommendations

A Survey on Security and Privacy Issues of UAVs

Cybersecurity Threat Analysis And Attack Simulations For Unmanned Aerial Vehicle Networks

Drone Technology and it’s Application

Drone Security and the Mysterious Case of DJI's DroneID

Analysis on security-related concerns of unmanned aerial vehicle: attacks, limitations, and recommendations

The Internet of Drones: Requirements, Taxonomy, Recent Advances, and Challenges of Research Trends

A Security Review in the UAVNet Era: Threats, Countermeasures, and Gap Analysis

Privacy Mechanisms for Drones

Fast, Reliable, and Secure Drone Communication: A Comprehensive Survey

Flying Eyes and Hidden Controllers: A Qualitative Study of People's Privacy Perceptions of Civilian Drones in The US.

Internet of Drones (IoD): Threats, Vulnerability, and Security Perspectives

Comprehensive Review of UAV Detection, Security, and Communication Advancements to Prevent Threats

An Intelligent Framework for Cyber-Physical Satellite System and IoT-Aided Aerial Vehicle Security Threat Detection

Enhancing Security and Privacy in Small Drone Networks Using 6G-IOT Driven Cyber Physical System

Drone Transportation System: Systematic Review of Security Dynamics for Smart Mobility

Defending Airports from UAS: A Survey on Cyber-Attacks and Counter-Drone Sensing Technologies