Conference - Aaron Luo - Drones Hijacking: Multidimensional attack vectors and countermea

### The Rapid Proliferation of Commercial Drone Systems Unmanned Aerial Vehicles (UAVs) and consumer drones have transitioned from hobbyist toys to critical tools in aerial photography, infrastructure inspection, agriculture, and law enforcement. In this presentation at the DEF CON 24 IoT Village, security researcher Aaron Luo exposes the expanding attack surfaces of popular commercial drones (such as the DJI Phantom platform). Despite manufacturers implementing safety mechanisms like GPS-based geofencing and fail-safe return-to-home algorithms, Luo demonstrates that vulnerabilities across mobile companion applications, radio frequency (RF) command links, and civilian satellite navigation enable multidimensional drone hijacking attacks.

### Vulnerabilities in Flight Control Mobile Applications At 10:37, Luo details security flaws identified in the Android flight control software and software development kits (SDKs) used to pilot commercial drones: - **Insecure IPC and Local Sockets:** At 15:36, the researcher uses IDA Pro to reverse-engineer proprietary native libraries within the flight control application. Analysis revealed that the companion app binds internal TCP/UDP sockets on local interfaces without enforcing client authentication or authorization checks. - **Arbitrary Command Injection:** Local malicious apps running on the pilot's smartphone can connect to these internal sockets, injecting forged control commands, extracting real-time flight telemetry, or establishing a persistent background web service (demonstrated at 03:43) to redirect flight plans.

### Reverse-Engineering 2.4 GHz RF Control Links At 19:51, the presentation explores the physical and link-layer security of the radio communications link operating in the 2.4 GHz Industrial, Scientific, and Medical (ISM) band: - **Frequency Hopping and Modulation:** Communication between the ground remote controller and the drone utilizes proprietary frequency-hopping spread spectrum (FHSS) modulation. - **Unauthenticated Frame Injection:** While basic telemetry frames utilize checksums, the RF protocol lacks cryptographic message authentication codes (MACs) or session keys. By sniffing the hop sequence using software-defined radios, an attacker can transmit forged control packets at higher power, effectively overriding legitimate pilot stick inputs without physical access to the controller.

### GPS Spoofing with Software-Defined Radios Drones rely extensively on the Global Positioning System (GPS) for position holding, waypoint navigation, and autonomous "Return to Home" (RTH) failsafes. At 23:25, Luo highlights that civilian GPS L1 signals operate completely unencrypted: - **Generating Synthetic Baseband Data:** At 26:44, the speaker explains how to construct synthetic GPS In-phase and Quadrature (I/Q) baseband files using open-source tools and transmit them via affordable Software-Defined Radios (SDRs) like HackRF or bladeRF. - **Manipulating Coordinates and Time:** By broadcasting spoofed satellite ephemeris and pseudo-range signals with slightly higher power than authentic orbital satellites, the attacker tricks the drone's GPS receiver into calculating false geospatial coordinates and altitude.

### Comprehensive Hijacking Demonstrations and Countermeasures At 31:10, Luo presents a live demonstration showing complete remote commandeering of a drone in flight without contacting the operator's physical remote controller: - **Geofence and No-Fly Zone Manipulation:** Spoofing false coordinates allows attackers to trick drones into believing they have entered prohibited airspace (such as airport runways or government facilities), triggering immediate forced landings or motor shutdowns. - **Defensive Mitigations:** At 41:31, Luo outlines essential countermeasures for UAV manufacturers: implementing end-to-end cryptographic authentication (AES-CCM/GCM) on all RF control frames, securing internal Android application IPC mechanisms, and integrating multi-sensor anomaly detection (cross-referencing GPS data against visual inertial odometry, barometric altimeters, and magnetic compasses) to reject abrupt or unnatural GPS coordinates.

(AI summary — Gemini 3.8 Flash)