3Drone Overview Base Drone $479.00 GoPro Hero 3 Black $399.99 Dronefly.comGoPro Hero 3 Black $399.9964GB High Speed Micro SD $129.99Spare 2200 mAH Battery $27.00Complete Starter Package $
4Drone Features Receiver Range GPS Wind Compensation 1000m (.6 miles)GPSAccurate Within .8 m Vertical 2.5m HorizontalWind CompensationMax Speed 10m/sec (22mph)Payload1000grams (2.2 pounds)
5Drone Modifications 2 axis Gimble Fatshark First Person Video Motors Zenmuse H3-2D $699More control and less JelloingFatshark First Person VideoCan Transmit from GoProLive Flight ViewCan record video from goggles$299.99MotorsBladesBatteries
6Drone Reactions People oblivious Turkey Police Neighborhood Spying Youtube
7Current HacksUnable to find documentation on attacking the drone’s wireless communication, only modifications
9Communications – Protocol 2.4 GHz Direct Sequence Spread SpectrumUnlicensed ISM band (2.400 GHz to GHz)
10Communications – Microcontroller Atmel ATMEGA MicrocontrollerGives interface to wireless module for drone’s Master Controller
11Communications - ChipCypress CYRF6936 – WirelessUSB LP 2.4 GHz Radio SoCTransmit power: up to +4 dBmReceive sensitivity: up to -97 dBmDSSS data rates up to 250 kbps, GFSK data rate of 1 Mbps98 different channels available
12Interface to Chip 4 MHz Serial Peripheral Interface (SPI) 4 pin serial communications protocolSCK, MISO, MOSI, SSEasily implemented (i.e. Raspberry Pi)Used to configure and send data to CYRF6936Cypress Semiconductor Corporation - Document #: Rev. *J – page 1
13Data Transmission Modes GFSK (Gaussian frequency-shift keying) Mode1 Mbps, no DSSS8DR Mode8 bits per symbol transmittedDDR Mode2 bits per symbol transmittedSDR1 bit per symbol transmittedLower data rates reduce error rate
14Typical Packet Structure GFSK and 8DR have a max payload of 40 bytesDDR and SDR have a max payload of 16 bytesOptional packet framingSOP required in GFSK and 8DR, optional in DDR, not supported in SDRIf SOP enabled, length field requiredLength field required in GFSK and 8DR modesCRC 16 has a configurable seedCypress Semiconductor Corporation - Document #: Rev. *J – page 5
15Potential Hacking Options TargetedTake over controlInterferenceArea of EffectJamming the 2.4 GHz ISM frequency band
16Targeted Attack Plan: Prototyping Items needed:Two transceiver chipsTwo breakout boardsTwo sets of supporting circuitryPrototype both with Raspberry Pi
18Targeted Attack Plan: System Investigation Use an oscilloscope to see SPI signals from microcontroller to receiver chip on the DJI PhantomDetermine how the CYRF6936 is configured for receiving data from the remote controlMimic the receiver chip configuration on the prototype systemStimulate remote control and see what actions on the remote control correspond to data payload content
20Targeted Attack: Custom Control Once we have an understanding of the packet payload and operating modes, we can simulate the remote control and send commands to the DJI PhantomWe should receive some sort of acknowledge at least, hopefully some data feedback.
21Targeted Attack: Field Trials Use Raspberry Pi and CYRF6936 in transmit mode to interfere with existing communication between the remote control and DJI PhantomChange operating modesSend the DJI Phantom away, attempt to turn it offSend malformed packet payloads and see how it behaves.
23Potential Challenges Payload data may be encrypted Unlikely because of small microcontroller connected to CYRF6936Scoping out SPI configuration may take a whileInterference between Raspberry Pi and remote control may result in erratic and non-deterministic behavior.Range of Raspberry Pi will be shorter than remote control due to decreased signal integrity.If we were to build a custom PCB, we can overcome this and drastically increase the strength of the transmit signal with a power amplifier.
24Cost of Development BOM: Time to develop estimated at 40 hours 2x 12 MHz Crystal (~$10)2x CYRF6936 (~$10)2x Breakout Board (~$25)2x Antenna (~$5)2x Passives (~10$)Total Cost ~$60Time to develop estimated at 40 hours
25Area of Effect: Jamming Need a lot of power for a small radius of jamming (need to be close to operator)Possible to jam 2.4 GHz frequency bandFCC violations, jamming 2.4 GHz band is illegalWhen the GoPro transmits the video via 2.4GHz band, the DJI Phantom has erratic behavior and flies offWould expect similar effect with jamming the transmitter
26Hardening Encrypt packet payload Requires more hardware, but possibleGet a transceiver that has a wider bandwidth (1 GHz – 10 GHz) and implements dynamic frequency hoppingMay not exist, but if it does it probably violates FCC regulations