0x0B: Paolo Stagno - A Drone Tale, All Your Drone Are Belong To Us

### Overview In this presentation, Paolo Stagno (known online as voidsec) details approximately one year of security research focused on commercial consumer drones, specifically the DJI Phantom 3 model. His research investigates the drone's architecture across three main domains: vulnerability research and attack vectors, reverse engineering, and digital forensics. Stagno evaluates how the aircraft, ground controller, and mobile application communicate, exploring several attack surfaces including Wi-Fi, onboard operating system components, proprietary control protocols, and GPS navigation.

### Key Topics - **Drone Architecture and Network Profile:** The Phantom 3 ecosystem uses the ground controller as an access point connecting the drone, gimbal camera, and optional mobile application. Service scans reveal open FTP and application ports, while administrative services like Telnet and SSH are normally filtered. - **Wi-Fi Vulnerabilities:** The default Wi-Fi SSID derives from the ground controller's MAC address with a weak default password (`12341234`). Communication relies on standard WPA2, making it susceptible to deauthentication attacks, four-way handshake brute-force capture (e.g., using Fluxion), and the KRACK attack due to unpatched OpenWrt firmware. - **Firmware Downgrading and Root Access:** Stagno discovered an undocumented gesture in the mobile app—long-pressing three small lines—to trigger a firmware downgrade. Rolling back firmware re-enabled unrestricted FTP access and allowed modification of boot scripts in the underlying OpenWrt ('Barrier Breaker') operating system, successfully enabling Telnet and granting root access with a hardcoded password found in the mobile app. - **Geofencing & SDK Reverse Engineering:** DJI implements no-fly zones (warning, authorization, and restricted) to prevent flights near sensitive locations. Because zone configuration files pushed via app updates are unsigned, they can be altered. Furthermore, reverse engineering the DJI Android SDK revealed that SDK restrictions could be bypassed by editing Java bytecode to bypass API key requirements, and analyzing the proprietary TCP packet structure allowed identification of control headers, checksums, and payload commands. - **GPS Spoofing & Full Hijack:** Civil GPS lacks encryption, enabling replay and spoofing attacks via low-cost software-defined radios (HackRF with an external clock) using ephemeris data. Spoofing can force a drone to land by creating fake no-fly zones (e.g., spoofing the White House location) or unlock restricted flights. Combining a Wi-Fi deauthentication attack (which triggers the automated 'return-to-home' behavior) with spoofed GPS coordinates tricks the drone into navigating in the wrong direction, allowing complete device theft. - **Forensics and Countermeasures:** Forensic artifacts reside in three places: media on the gimbal camera, plaintext flight logs (`.txt`) on the mobile device (which are synchronized to DJI servers), and raw binary `.DAT` flight recorder files on the motherboard flash memory. The `.DAT` files can be parsed using the open-source tool DROP, though flying without the memory chip serves as an anti-forensic measure. Defensive countermeasures against drones—ranging from shooting them down to eagles, nets, or jamming—remain largely ineffective against swarms or small craft.

### Technical Details - **Operating System:** Fork of OpenWrt named Barrier Breaker running custom DJI binaries. - **Default Credentials:** Controller Wi-Fi password `12341234`; root password discovered inside the mobile application configuration (`BigChina`). - **Packet Header:** 4-byte header consisting of a protocol magic byte, packet length byte, SDK version byte, and a custom DJI CRC byte. - **GPS Detection Strategies:** Potential spoofing detection mechanisms include validating GPS subframe data (spoofed signals often zero out subframes), cross-verifying device time against GPS time, and sanity-checking impossible travel velocities between consecutive coordinate fixes.

### Takeaways The talk demonstrates that standard consumer drones inherit common Wi-Fi weaknesses and depend heavily on unencrypted, spoofable GPS signals. Automated safety features, such as 'return-to-home' upon signal loss, create significant exploitation vectors when combined with location spoofing. In addition, the storage and automatic cloud synchronization of flight telemetry highlight privacy and operational security concerns.