{"id":14692,"date":"2017-04-19T09:00:42","date_gmt":"2017-04-19T13:00:42","guid":{"rendered":"https:\/\/www.kaspersky.co.za\/blog\/?p=14692"},"modified":"2020-04-17T19:45:51","modified_gmt":"2020-04-17T17:45:51","slug":"drone-gone-in-11-ms","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.za\/blog\/drone-gone-in-11-ms\/14692\/","title":{"rendered":"Drone gone in 11 milliseconds"},"content":{"rendered":"

Drones are everywhere nowadays. Amazon delivers packages<\/a> by drone. Filmmakers and media workers launch cameras into the air to take attractive wide shots. Some enthusiasts who don\u2019t mind paying $500 or more for a smart toy use drones to explore the sky or take video of friends\u2019 weddings.<\/p>\n

It\u2019s easy to picture yourself outside with your new $500 drone, launching it into the air and \u2026 watching helplessly as the craft flies out of sight, ignoring the controller in your hands.<\/p>\n

This is no firmware bug or controller failure: Your drone has been hijacked. At the Security Analyst Summit<\/a>, security expert Jonathan Andersson proved that a skilled malefactor can make a device that can hijack drones in mere seconds.<\/p>\n

Andersson used a software-defined radio<\/a> (SDR), a drone\u2019s control unit, a microcomputer, and some other electronic equipment to make such a device. He called it Icarus. With the help of the SDR, Andersson tuned to the frequency a drone uses to communicate with its controller, and then he experimented until he found how exactly the signals were transmitted between the devices.<\/p>\n

It took a while for Andersson to learn how data transfer works between a drone and its control unit, especially because they hop channels every 11 milliseconds. Nevertheless, if you can do it once, the path to hijacking a drone becomes clear; developers of the smart toys all use similar protocols.<\/p>\n

Developers follow the popular security through obscurity<\/a><\/em> method, counting on the complexity of protocols and neglecting strong encryption. Icarus can hack their primitive encryption and send a series of commands to hijack a craft during the 11 milliseconds a device waits before hopping channels.<\/p>\n

As a result, the drone\u2019s legitimate controller becomes useless and control goes to the malicious one \u2014 literally on the fly. The next video shows how it works in the real world.<\/p>\n