Law enforcement agencies are in an (unofficial) fight with drone operators. And it’s clear why. While some drone pilots are very careful, some have caused quite some trouble. The fire fighting delays in California and gas leak in New York are two such examples. Up until now, the police either tried to jam the radio for the drone, or try to take it down. (Taking drones down includess eagles, nets, and other shenanigans). Now, a tiny device lets anyone seize control over drones flying over their heads. Meet Icarus the brainchild of Jonathan Andersson, a researcher at Trend Micro’s TippingPoint DVLab. The device works by hijacking the control packet of the DSMx protocol, so the drone “thinks” that the attacker is the rightful remote. Once the drone is hijacked, the operator gains full control, while leaving the original pilot disconnected from the drone.
Anderson explained how the hijack works to ArsTechnica: This attack only works on DSMx controlled drones (mostly lower-end toy quadcopters), so there is no immediate risk to GoPro, DJI and 3DR drones. Luckily, Icarus is also not something you can buy in stores (yet), so I wouldn’t worry about it (now). But now, that the hacking scheme is out, it will not be surprising if drone-hijacking devices start emerging (remember TV-B-Gone?, it’s like that on steroids). Anderson suspects that fixing this vulnerability will not be trivial. The DSMx is has wide deployed and not all devices can update the firmware. To make things worse, he also suspects that hacking a DJI would not be much harder. In a comment on AT he says (bolding is mine): This hack opens a whole new set of operational and legal questions. Will hijacking hardware require a license? Will you need a court order to hijack a drone? and Who will be authorized to operate hijacked drones are jsut some of the more immediate questions that I can think of. And this is not even touching the technical aspect of them. [drone hijacker via arstechnica] P.S. I guess its good news for the eagles though. P.P.S while jamming a drone may seem like a good idea, we know how it goes:
