Hackers can shoot down DJI drones mid-flight; to understand

security experts Identified 16 serious vulnerabilities DJI drone. Of the identified vulnerabilities, 14 used remote access to the operator’s smartphone, and had the potential to shoot down drones mid-flight.

The survey was conducted jointly by the University of Bochum (Germany) and CISPA (Helmholtz Center for Information Security). According to the researchers, the vulnerabilities allowed to locate both the pilot and the drone, access cloud-synced data, and change device credentials.

Unencrypted security protocols

One of the measures to regulate drones includes the DroneID protocol, which transmits information in real time to air traffic regulators. This data includes user and device locations, as well as access and registration credentials.

While the researchers did a superficial analysis of possible entry doors to the drone system, the protocol in question is not encrypted. Using simple reverse engineering applications, it was possible to access all this information.

It was also possible to explore. Vulnerabilities via cookies on DJI forums. Because it was a system of integrated users, this attack allowed hackers to take control of accounts and other sensitive information.

In both cases, remote access to the operator’s smartphone and thus to the drone was provided. This allowed it to hit him mid-flight. Changing the serial number of the device by hiding its identity, and Bypass security measures that prevent drones from flying over restricted areassuch as airports and prisons.

pic.twitter.com/ulRp2w3hjy

— DJI (@DJIGlobal) March 8, 2023

Because these are extremely sensitive issues, the researchers submitted the full vulnerability report to DJI before publishing the research. According to the company, all the security flaws mentioned have already been fixed.