Drone Security (Part 2)

It is difficult to calculate the global drone population, but estimates put it at more than two million devices. Their relatively low purchase price and the limited expertise needed to operate them work in their favour. However, the safety and security of their use remain a major concern.

Drones offer significant benefits, from capturing excellent aerial footage to delivering urgent medical supplies. They can also create privacy problems. A drone flying over a property and taking photographs can be annoying or intrusive, but drone security concerns extend much further.

Drones can be hacked or used to hack other electronic devices. An attacker does not even need to own a drone, as they can take over someone else’s and use it for their own purposes. Cybersecurity concerns will become increasingly urgent as more drones take to the skies and cybercriminals become more skilled at identifying weaknesses in their security.

Drone Hacking

Once a hacker has located a target drone, they may be able to control it or download video and other images that it is transmitting to its base station. From a technical perspective, hacking a drone is not particularly difficult for a cybercriminal, and many operators leave their devices completely exposed to these attacks.

GPS spoofing, for example, is one of the most common hacking techniques. The attacker supplies the drone with false positioning coordinates, causing it to believe it is following its original flight path while it is actually heading somewhere else.

A hacker could deliberately crash a captured drone for amusement, or use it to strike a car, a person or even another drone. They could also instruct it to land nearby and steal it along with its payload and equipment, such as its camera, batteries and storage.

Trained attackers can target drones from up to a mile away. The radio signal used for control between the operator and the device is often unencrypted, making it easier to decode using a packet analyser, or sniffer. Intercepting it is therefore not technically complex for an experienced hacker. The signal could also simply be jammed, preventing the drone from navigating on its own.

Vulnerabilities in the communication link can also allow a hacker to intercept data transmitted from the drone to a base station. For example, a video feed could be captured without the drone operator noticing. This is particularly likely when transmitted data is unencrypted, as can occur in systems with high bandwidth requirements.

Protecting Drones

Fortunately, drone operators are paying increasing attention to security. There are several ways to make a drone more secure against cyberattacks, including:

• Update the drone’s firmware regularly: Major drone manufacturers release patches when new security threats emerge, so frequent updates help keep the drone ahead of attackers.
• Use a strong password for the connection to the base station: An appropriate combination of letters, numbers and special characters will help protect the connection and deter hackers, often encouraging them to look for an easier target.
• Keep the control device, such as a smartphone, tablet or laptop, free of malware.
• Use a virtual private network (VPN) to prevent cyberattackers from accessing communications when connected to the internet.
• Limit the number of devices that can connect to the base station to one. This will prevent a hacker from intercepting the signal to control other devices.
• Make sure the drone’s Return to Home (RTH) mode is enabled. Once the starting point has been set, the drone will return if the signal is lost or jammed, or if its battery runs low. This can help recover the drone in a hijacking situation. However, because RTH relies on geolocation, it is not immune to GPS spoofing.

Data Theft Using Drones

Traditionally, computer systems have been protected around their perimeter, both physically and at the network level. However, data has become more mobile, with Wi-Fi coverage and cloud services allowing access from anywhere. The Internet of Things, together with radio-frequency identification (RFID), also enables data to flow between smaller devices, such as security cameras, pallet tags and merchandise tags in retail stores.

Technologies such as Wi-Fi, Bluetooth and RFID typically operate over a limited area, so physical access restrictions can often prevent hacking. Drones, however, give attackers greater mobility.

A small computer, such as a Raspberry Pi, could be carried by a drone and dropped onto the roof of an office building to carry out cyberattacks exploiting vulnerabilities in Wi-Fi, RFID or Bluetooth systems.

From the drone itself or from a position within reach of the target area, an attacker could imitate a Wi-Fi network to steal data from connected devices or intercept Bluetooth peripherals such as mice and keyboards. By recording movements or keystrokes, the small computer could steal users’ passwords.

Protection Against Drones

In various parts of the world, regulations prohibit shooting down drones, physically obstructing their movement or interfering with signals between the controller and the device. Depending on the setting, defensive measures should therefore focus on protecting the site and securing the data held there.

Geofencing is one way to address the drone threat. Using GPS- or RFID-based software, geofences create a virtual boundary around a specific location. This triggers a response whenever an unauthorised drone enters the area, while controls connected to drones prevent them from flying into or taking off within geofenced zones.

An increasing number of drone manufacturers equip their devices with geofencing for sensitive sites such as airports, prisons and power plants. However, some hackers have found ways to remove the software that prevents drones from flying in geofenced restricted areas.

Other methods can detect the presence of a drone in a given area, although most can fail to identify it correctly in one way or another:

• Radar can detect drones, but it is not particularly reliable because it may confuse birds with these devices.
• Acoustic sensors may offer a better way to detect unwanted drones, as they can be programmed to recognise the sound signatures of particular drone types.
• Radio-frequency scanners can detect drones by monitoring the electromagnetic spectrum and recognising their transmissions. However, drones that rely on GPS and do not use radio signals for navigation cannot be detected this way.
• Thermal imaging is another method. It detects the heat emitted by drones, allowing them to be tracked by their thermal signature, although it has a high rate of false positives.

Detecting and stopping drones is difficult. It is therefore advisable to strengthen basic network security, particularly wireless access, rather than focus on detecting malicious drones.

Simple, established measures can help secure an environment against drone-related threats. These include changing a Wi-Fi router’s default username and password, protecting Industrial Internet of Things (IIoT) devices by confining them to a guest network, and using a VPN when working over Wi-Fi to help protect internet communications from hacking.

The Future of Drones

The greatest opportunity for drones is expected to lie in commercial applications rather than the entertainment market. Drones could make deliveries, support surveying and mapping services, monitor crops and conduct safety inspections of buildings where sending a human inspector could be dangerous.

Given these possibilities, drone numbers are likely to grow, bringing greater security threats. Companies in the sector will need to work quickly to ensure or at least improve drone security before commercial use becomes widespread.

It is therefore important for drone manufacturers and commercial users to address security issues seriously and with commitment. Individuals and businesses must also strengthen the security of their internet connections and home networks to reduce potential threats from drone hacking.