My Phantom 4 uses watered-down Lightbridge[0] which I haven't looked at closely but which does tout at least some encryption. Its predecessor, on the other hand

My Phantom 4 uses watered-down Lightbridge[0] which I haven't looked at closely but which does tout at least some encryption. Its predecessor, on the other hand, my Phantom 2 Vision Plus, uses two completely open SSIDs (one hidden, one broadcast). I had a prototype of area denial for all Phantom drones that operated that way cooked up in about two days, so there's a lot of low-hanging fruit to reverse engineer here and not a lot of thought being put into security. Control itself uses a different, "traditional R/C" path (itself ripe for disruption), but there's plenty of possibilities from being hooked up to a Phantom 2's SSID. There are two Linux-based computers on that network: the "guts" and the camera controller. The root password for both is wide knowledge, and you can brick an operating, in-flight Phantom 2 very easily with nothing but your laptop. Hint, hint for a startup here, since I've been on three threads now where folks are looking for drone denial. [0]: http://www.dji.com/product/dji-lightbridge http://www.dji.com/product/dji-lightbridge