Even expensive police drones are easy to hijack, hacker says
Just because they cost thousands of dollars doesn't mean their systems are secure.
Authorities shouldn't trust their UAVs too much, even if they're of the more expensive variety. Nils Rodday, a security researcher working for IBM, demonstrated at the RSA security conference in San Francisco how a high-tech, pricey police drone* can be hijacked. Someone with the skills can take over its controls from as far as a mile away, using only a laptop and a USB radio chip. According to Wired, Rodday discovered that it's possible to get in between a police/military quadcopter's controller module or "telemetry box" and its real pilot's tablet when he was a graduate student at the University of Twente in the Netherlands.
In order to hijack a police UAV's controls, he said attackers can exploit either the WiFi connection between their modules and the operators' tablets or the radio protocol between the modules and the drones themselves. Both connections are rather weak and can easily be cracked. Those with truly malicious intent could exploit the flaws to crash the quadcopters into people/buildings. They could also steal them for their info or for the purpose of selling them in the black market. You can listen to Rodday explain the vulnerabilities below or check out his slides from the RSA conference.
In this particular slide, he noted that he only needed $40 worth of hardware parts to set up a system that can hack professional UAVs:
Rodday also published a thesis about his study, which focuses on a particular $21,000 surveillance quadcopter Dutch cops use. He believes a lot of expensive, advance drones share its flaws, though, so authorities have to take precautions whatever brand they get.
*Note that while the drones authorities use tend to be on the more expensive side, some are more affordable than others. The San Jose Police once secretly bought a UAV for $7,000.
