- [Narrator] Think you're special,
one of the kind, we agree.
The way you pursue your digital ambitions is unique to you.
And so is your appetite for digital risk.
Whether you're hyper connected your ecosystem,
empowering a distributed workforce,
rapidly leveraging Cloud, IoT, AI or other new technologies.
RSA is here to help you manage digital risk your way
at every stage of your journey.
So, go ahead, be you.
(whooshing)
- Hello, and welcome to Drone Penetration Testing
and Vulnerability Analysis Framework.
If you're joining us live,
our speakers are in the Slido chat discussion area,
answering your questions right now.
For audio or video issues,
click the Technical Support button below.
I'd now like to turn it over
to Dr. Vivek Balachandran for the presentation.
- Thank you Berta.
Hi, my name is Vivek Balachandran.
I'm assistant professor
in Singapore Institute of Technology.
Today, we will look into our recent work on
drug penetration testing
and vulnerability analysis framework.
At the launch of RIE 2020 plan in Singapore,
announcements were made regarding the future
in four technology domains.
The service and digital economy domain.
One of the three focus areas is urban mobility.
Urban mobility aims
to fuse traditional transport engineering
with autonomous technologies, real time analytics,
modeling and simulation to transform how we plan routes
and dynamically manage real time-traffic events.
Although autonomous unmanned technologies have the potential
to radically transform our economy
and improve our livelihood,
the inherent vulnerabilities both known and unknown,
impose significant challenges to their deployment.
The two main challenges to drone deployment include
integrating drones safely into the airspace, as well as
secure and reliable unmanned flight management technology
to support flights and operations beyond line of sight.
In April 2015
(glitches muffles speaker)
had approved the unmanned aircraft,
which aims to regulate the use of drones
with a clear set of rules.
Drones, however, have a communications and control network
based on WiFi, or radio frequency.
Many also use, utilize existing IP-based operating systems.
They are therefore affected by vulnerabilities
that could give attackers full drone access
to the database platform.
Read and delete files or crash the database.
At the operations level
integrating an unmanned digitally-controlled drones
safely into the airspace
will require a clear awareness and understanding
of the existing and potential vulnerabilities
in it's control system,
as well as its communication channels.
Counter drone signal jammers are popular,
but risky to deploy due to the interference
with aircraft communications or law enforcement channels.
Drone manufacturers and retailers
may be unaware or unaware of
or even unwilling to divulge product risks or dangers.
Hence, comprehensive vulnerability maps
independently computed for specific drones
would help considerably
to enable selective and secure.
In February 2017, Swann to vulnerabilities
found in surveillance drones manufactured the drone.
Which is a hardcoded password and an authentication bypass.
Similarly, the announcement key
comes weeks after it was revealed that the U.S. Army...
Sorry, okay,
DJI, a Chinese drone manufacturer
launched a bug bounty program
offering researchers as much as $30,000
for spotting cyber vulnerabilities in it drones.
Interestingly, this announcement came
weeks after it was revealed
that the U.S. Army barred the use of DJI drones
over cyber security concerns.
The same goes with DJI Phantom.
DJI Phantom Three Professional drone.
The DJI apps stores a database
of no-fly zones.
On iOS device, this is .flysafeplaces.db.
The drone, however, may be attacked by GPS spoofing
and made to land in a no-fly zone.
Also, you can use WiFi attacks
against Parrot AR, using Aireplay.
So, Aireplay-NG is a popular attack tool
dictionary-based attack tool for WiFi to passwords
in the normal computer world.
You can deploy the same thing for the Parrot AR drones,
mostly because it uses a WiFi-based communication method
between the drone and the controller.
Thus, deauthenticating the user.
So, one of the reasons why our solution is needed is that
there is no centralized framework
for drone penetration testing.
There are independent works that exist in the literature.
But, mostly these are academic pursuits.
And in forum discussions
where there are independent cybersecurity enthusiasts
who find attacks,
vulnerabilities and exploits against specific drones.
A few companies are coming up with some framework these days
but still it is a new area which is unexplored.
So, our goal
is to have an open source platform for drone attacks.
Why open source?
Because open source is the best method
to have all the different attacks from all over the world,
by all the cyber security enthusiasts
to put in their works in one centralized platform.
Which is easy to launch new attacks
for different types of drones
for a cyber security specialist,
and for a security specialist
who is not specialized in drone security.
And for specialist cyber security professionals,
it should be easy to add new attack modules.
And you should have both a local and a server database.
A local database because once you download
Drone Attack tool,
you need not need to depend on the internet connectivity,
or the server connectivity for the attack to be launched.
A server database
for everyone to contribute their own attacks.
So, we've name this framework as DRAT,
or drone attack tool,
and it is developed in Kali Linux
as a penetration testing tool,
and a vulnerability analysis tool for drones.
It has a local database, as I said earlier,
with a search function and report creation feature.
A search function is simply because
if you want to find, if a specific drone,
and a specific attack for this drone exist,
you can search it among all the different attacks
in the database.
The two modes for this particular framework,
a user mode and admin mode.
The user mode helps you launch existing attacks
from the database and create a report automatically for you.
Admin mode is mostly for the professionals
to add new attacks.
So, when you have a new attack for a specific drone,
you create the script for that
and then call the script from within this framework.
So, there is a method to add the script onto the framework,
in the admin mode.
So, this is how it looks in general,
you can see that there are different types of connectivity
between a drone and the controller.
It will be mostly WiFi-based,
other's will be RF-based connectivity as well.
There are different protocols used,
like acoustic modeling etcetera.
But basically, there is a controller and a drone,
and there's a connectivity protocol between them.
And we launched different types of attacks
using the same mode of communication
used between the controller and the drone.
So, in this left side of the slide,
you can see our drone, DRAT in action.
A specific action against Hubsan Drones is launched.
When the attack is launched,
you can see the script is running the background.
On this terminal, you can disable that aspect
if you don't want to see what's happening behind.
And at the end of it, it will pop up asking you a question,
"Do you want a report based on the attack?"
And it will give you the report.
And at the same time, disable the **drop
if the drone is susceptible to that vulnerability.
So, the control flow diagram of DRAT look like this.
That has two different modes,
a user mode and an admin mode.
As we discussed earlier, the user can select
which mode he wants the platform to work.
And once they are selected, you'll go to that mode.
In the user mode, there are three different routes
that the user can take.
Number one, which is about the user attacks.
It's mostly an informative speech
where it helps you understand what this drone is about,
who developed this drone,
What is the licensing of this drone,
attack framework and how to use this.
How to install the readme file etcetera
can be found in the User Mode.
And then the other two modes are basically attacks.
So, you can select the drone attacks.
You can go into the available drones
that is available on the database.
So, right now we have like four to five drones
that you can launch the attack against.
We hope once we launch this,
and once the open-source community start contributing,
it blows up.
And it will show all the available drones.
And once you select the available drone,
the next thing that will be asked to the user is,
which connectivity to be used.
Do you want to attack it on WiFi?
Do you want to attack it on RF?
Do you have any other mode of connectivity?
Do you have some information regarding the connectivity?
Do you know the MAC address?
Do you know the username and password?
So, the more information that you give,
the more easier the attack will be.
So, if you know the username and password,
the number of attacks that is available for you
will be way more than if you don't know
the username and the password
for the drone connectivity.
Once you give the connectivity options,
then it gives all the attacks that is available
with the information that you gave.
And you could just click the attack
that you wanna launch the attack,
and the attack will execute.
At the end of the attack,
it will give a prompt back to the user saying that
the attack is finished,
it is either successful or unsuccessful.
And the report is generated,
you can go and look for the report
in the Report menu.
That comes to the third option,
which is the report mode.
The user goes goes to the reports
and search for this particular report that is generated
and export that into a CSV and end of process.
Admin mode is a bit, little different.
A bit different.
It has two different modes,
which is managed drones and managed attacks.
This is basically because sometimes
when you create a new attack,
they may not be any single attack against that drone.
And that drone may not even be in our framework.
In this case, you may need to add
that new particular type of drone
onto the framework.
So, when you don't see,
so if you want to add a specific attack
against a specific drone, you can look for that drone.
And if it is not there, it add that drone, right?
Once you add that drone
as an option into the draft framework,
then you can add different attacks
against that drone, right?
Similarly, you can remove drones from the attack framework.
So, you feel that certain attacks are not anymore valid.
You don't want to lose your local database space.
So, you can delete all those unwanted drones
from your local databases.
The same goes with attacks.
You can add specific attacks.
You can add attacks which are generic to all drones.
You can add specific attacks
which are specific a specific drone.
You can remove all attacks.
You can remove attacks which are specific
to specific drones.
Okay, now let us briefly look into
what are the different types of attacks
that we have already have in this game.
So, mainly three different types of drones
are aimed at or targeted at,
which are Tello Digital Drones, Hubsan drones,
and DJI Mavic Pro and Mavic Enterprise.
So, all the attacks that is launched
against Mavic Enterprise
works on Mavic Pro two as well.
So, let us look into each specifically
and go through each of that one by one.
The Tello attacks
basically means attacks against DJI Tello drone.
So, Tello has an open UDP port on 9999 for communication.
So, we sent junk packets to the port
to disturb the live video feed
at least for four seconds and more.
Hence, intermittent frozen video will happen.
This means that you can completely freeze
the drone controls this video
and the video is completely disturbed
and no one can see what's happening
and the drone will be disabled.
To do this you need to know the drone's IP address.
The second attack on drones, Tello drones
is Wi-Fi WPA2 password crack.
This is very similar to our password crack attack
that we launched against any WiFi-based system.
This is the reason why this works on Tello is that
Tello works over the normal WiFi protocol.
And we can launch a dictionary attack using Aircrack-ng.
So, the attack is very similar
to the normal WiFi password crack attack using Aircrack-ng.
Just that, you have to cater it,
fine tune it for that drone's hardware.
The third attack against digital is DJI Tello,
is DoS or denial of service.
What happens here is
we disrupt the command from the controller,
and we authenticate the controller.
So, the controller completely loses control over the drone.
The drone will still be flying or whatever it is doing
and the behavior of the drone is erratic after that.
We cannot predict what the drone will do after that
because the controller completely loses control
over the drone.
The last one which is an effective attack is
line of sight attack.
It is similar to video disruption attack
but not as dangerous as video disruption.
In this case, we disrupt the video transmission,
by ARP for ARP poisoning.
But the controller still has control over the drone.
The only thing is that the controller cannot see
anything from the camera.
The live stream from the camera is completely disturbed.
So, the controller still have control,
but he has to use his line of sight
to bring the drone back to wherever the drone started.
So, this makes his life a bit harder
because it's drone is a bit further away.
He has no idea what the drone is trying to see.
So, in the case, it can be used in different ways.
For instance, if you are looking at a drone that is invading
into your territory,
you disturb the line of sight
and see what the controller of the drone
is trying to make the drone do.
Is he trying to bring it back home? I don't know.
So, you can follow the drone without the controller
knowing that you're following the drone.
Hubsan attacks are a bit more sophisticated
than DJI Tello.
Simply because DJI Tello was one of the easiest
that we encountered among the different drones.
The security mechanisms were a bit more relaxed
in DJI Tello compared to Hubsan or Mavic Pro Enterprise.
Hubsan attack, the same attack that he created for Tello,
for WiFi-WPA attack works in Hubsan attack as well.
So, the same attack mistakes could work for Hubsan.
It's exactly the same.
And then, the second attack
that we have launched against Hubsan
is Authentication Flooding,
So, we use Mac spoofing,
and the tool has the same Mac as a client controller.
We make sure that the tool has the same Mac address.
And this enables multiple connections to the drone.
And now is instead of
the drone connecting from the controller,
I can flood connection request from a system
using different programs within my system.
And authentication flooding will bring down the drone
and disconnecting the controller from the drone.
The last one, which is a flagship as of now
is Mavic Enterprise Pro or Mavic Pro two.
Where we have a few attacks that were created,
GPS spoofing, firmware modification,
DJI app reverse engineering.
GPS spoofing is
you need a hardware for GPS spoofing
along with the...
With the Drudge framework.
So, this information will be given
when you open the draft framework of that particular attack.
So, the attack will say, "For this attack to work,
"you may need to connect HackRF in this format."
So, it will be giving some instruction
how to launch this attack when you need extra hardware.
So, what we did was, we used HackRF hardware
to spoof the GPS coordinate
which is transmitted with the GPS STS sim.
So, every country has their own no-fly zones.
Well, in Singapore there are specific areas
which are no-fly zones,
like the Changi Airport.
You cannot fly anything near the Changi Airport.
There are specific military establishments,
you cannot fly anything near that.
There are specific areas where you cannot fly.
So, what we can do
is to change or to spoof the GPS coordinates
as one of the no-fly zone areas.
And immediately once you do this,
the civilian GPS is
work something similar to WiFi,
whichever the strongest signal,
it takes a stronger signal.
So, our GPS signal will be the stronger
because that is closest to the drone.
So, the drone will think that,
instead of flying in a fly zone which it is
all of a sudden it is a no-fly zone.
And the drone's automatic landing procedure comes in,
kicks in and it lands.
Other attack that we have launched against Mavic Enterprise
is based on firmware modification.
So, we change the form of modification.
By changing the configuration values,
we can tweak the configuration values.
So, when the drone is flying,
we can change the configuration values
of say break sensitivity from point six to point two.
So, all of a sudden,
you expect the drone to stop at a certain speed
and it does not stop and then go and hit something
on the left side or right side.
So, we can change different configuration values
to make the drone behave erratically.
You can discuss more on this, on this Slido.
Oh, I'll be available on Slido right now.
So, if you have other questions,
please feel free to throw questions at me.
Finally, what we did was looking at the security
of the Android application, which DJI provides.
So, DJI Mavic Pro in itself looks like a very strong
security concerned development,
but the app is not.
At least for us.
So, we managed to bypass the authentication
mechanism in the DJI app.
Which means you can log in offline,
you don't need the username and password
to connect to the drone from the app, the changed app.
So we reverse engineered the app,
changed the code, which leads to authentication.
And now the repackaged application
can connect to any drone,
not just supported drones on the app.
Tello unsupported drones as well.
And you don't need authentication mechanism to connect.
We removed some functions like, all in function,
updating the firmware, a bit false.
These things were removed
so that we can work with the old firmware
in the drone.
So, we don't need firmware updates
or sometimes it says,
"You cannot run the drone without updating the firmware."
That doesn't happen to us
because we have changed that option.
So, these are some of the tags that we have
in Mavic Enterprise Pro.
More to come.
There are a few engineers and a few of my students
and myself, we're working on a few other drones.
Right now we are working on a DJI Mavic Mini,
DJI Phantom, Accord drone
on different attacks like GPS jamming, replay attack,
GPS spoofing with router smartphone,
sniffing the USB traffic between the RC and mobile form.
So, remote controller and the mobile phone,
It's a funny part
because, one, most of the drones,
it comes with the controller.
And because mobile phones is an integral part
of all of our lives nowadays,
they give an option to connect your mobile phone
to the controller
and use an application on your mobile phone
to control the controller, right?
It is completely not needed
if you just want to control the drone,
but most drones have this.
But this opens up a new area to attack,
which is a flawed phone.
Now, what is this malicious program
that is running on the phone along with the DJI app?
Then can we take control of the drone?
So, that is what we're working on,
we're sniffing this USB traffic
between the controller and mobile phone
to see what kind of attacks that we can launch then.
And finally, we are also doing an attack
on video streaming protocol called RTSP protocol.
So that it our kind of work.
More work will be added to it soon.
So, what can we get from this?
I mean, I said what we did, what we have blah, blah, blah,
but I'm sure that you are not interested...
As intriguing as it is,
you wanna know, when you can have a hands on this thing.
Soon, very soon.
This is a project which is funded by our university,
and a few organizations
which include our government entity as well.
We need need the permission to release it as open source
to the public.
We have in principle permission from them.
The IP rights belong to us.
But, we are soon having a review with the organizations
and the user before we released our GitHub code as public.
So, that will happen soon in a couple of months.
By the time this presentation is over,
it should most probably be there.
What can you get?
You can get an open source drawn pen testing framework,
with readily available attack polyfills.
And how can it contribute to it?
Once it is public, you can add your own attack modules,
you can probably fix some of the problems
that our modules have.
Maybe like, there are instances of video freezing attack.
It started as a video.
Man the middle attack for the video,
to grab the video without the controller knowing it,
but it didn't work.
We had to be satisfied with video freezing,
but it is well documented
so you can see what went wrong.
You can add more things
and make sure that we could grab the video
and not just froze the video.
So, with that, I will stop my short presentation.
Thank you for listening to me.
Thank you RSA for giving me this opportunity
to share this platform to this reputed panel and audience.
And any questions, please feel free to email me
or ask in the Slido.
Thank you