8 ms·
A proof-of-concept system for counter-surveillance against spy drones
- alistproducer2 9y ago>In other words, they can see what the drone sees, pulling out their recognizable pattern from the radio signal, even without breaking the drone's encrypted video. The most interesting part of this is how encrypted traffic leaks enough info to be reliably analyzed. Really cool stuff.
- DannyB2 9y agoThe key insight is that the drone should store the video to local storage for later (1) recovery or (2) buffered encrypted transmission to the mother ship which would eliminate the leakage of clues about what subject is being spied upon.
- cavanasm 9y agoThe problem with that is the video feed is being actively used. If you want to know where someone is going, you can't just make your drone fly around randomly for hours recording video of the area you think they're in, you have to visually acquire your target, and then follow them.
- deleted 9y ago[deleted]
- lb1lf 9y agoBuffered transmission is unlikely to help; after all, the surveillance target could store the received stream and look for patterns - it would only delay detection for the length of the buffer (which often would need to be kept short due to the real-time nature of much surveillance. Granted, you could obfuscate things by varying the buffer length and padding the data stream (as suggested near the end of the article) - but at some point, a high-value surveillance target will probably just assume that a nearby drone is probably not operated by an avid bird-watcher or something like that and just blast the drone out of the sky. (Preferably using a laser or better still lots and lots of microwave RF - tends to get the surroundings less aggravated than using a shotgun...)
- alistproducer2 9y ago>Granted, you could obfuscate things by varying the buffer length and padding the data stream Or maybe sending the blocks out of order to be reconstructed according to a shared ordering key?
- yjftsjthsd-h 9y agoI don't think that helps with metadata analysis? Assuming I'm following correctly, we're already encrypting, so it shouldn't matter what order we send... Unless you mean to shift around bandwidth spikes, which could help some
- yarg 9y agoBuffering doesn't eliminate the VBR issue, it just obfuscates it in a breakable way. The fix is a constant bitrate with a sensible block cipher mode.
- dumbfounder 9y agoSeems like you could also hijack their signal to use for your own communications. By affecting the frequency and intensity of the variations you can create a binary or analog signal that rides on top.
- godelski 9y agoFrom my limited knowledge of encryption, this is why you don't compress before you encrypt. So if I understand the following article correctly, this kind of attack is well known. https://blog.appcanary.com/2016/encrypt-or-compress.html https://blog.appcanary.com/2016/encrypt-or-compress.html
- anfilt 9y agoCompress, and then encrypt can be quite devastating if the attacker can insert data into the encrypted payload. For instance, let's say I can insert any word into an encrypted message. Let's say I insert the word "THE". I can compare the size of the two messages one with the inserted "THE", and the one without. If the size instead of increasing by three bytes increases by less than three. I can be certain the word "THE" is in the message or at least some of the characters. I can keep doing this till I can extract useful information out the message. This is just the same thing. Video that is static compresses well, but video with lots of change does not compress as well. So the camera basically let's you insert extra information into the encrypted data stream. Based of the changing size it leaks info. This one is quite simple. It just tells you where the camera is looking, making the scene more dynamic. However, the issue of compression and encryption applies to much more than just drones.
- nostromo 9y agoIt'd be easy enough to prevent this by not compressing the video feed before it's transmitted. That's not feasible for Netflix to do, of course, but it'd be trivial for the NSA or other spy agencies.
- vernie 9y agoA more practical solution would be to use constant bitrate compression or to randomize bitrate on the sender side.
- zaksoup 9y agoWhat's really interesting to me here is the watermarking part of this. I imagine a future where everybody has little IR pins on their shoulder and phones scanning encrypted traffic for their watermark...
- jessaustin 9y agoThis would be the second-greatest antiprivacy device ever. Just behind the mobile phone.
- gruez 9y agoit doesn't work if everybody's doing it. your pin's flashing will get drowned out in the noise of everyone else's pin.
- FabHK 9y agowell, you might be able to recover it using something akin to CDMA.
- anfilt 9y agoNot sure if I would call it clever. Crypto will always leak the amount of data if you don't pad or ensure a constant data rate. Its also far from the first time compression has lead to a side channel. For instance https://en.m.wikipedia.org/wiki/CRIME https://en.m.wikipedia.org/wiki/CRIME -edit- Even durning world war you if you were listening on enemy radio commucations and they had not been decrypted you could tell if the enemy was planning somthing by noticing a large increase in radio communication. This a long known issue if you dont pad your data and send it at a constant stream. You may leak some information.
- kbhn 9y ago> Not sure if I would call it clever What do you mean it's not clever? Sure, they applied a known weakness of non-constant data rate encoded messages to drone monitoring, but that's never been done before. What have you done that's so impressive that gives you the confidence to scoff at the accomplishment of the talented engineers and developers who created something brand new?
- Terr_ 9y agoPerhaps we could at least say it's not novel/new? What grabs the attention is isn't so much the procedure or technology itself, but the narrative that we're in a future where this kind of thing might be genuinely useful to somebody someday.
- anfilt 9y agoPerhaps, how I said that was a bit ambiguous/unclear. However, the article is calling it clever. The research demonstrates a weakness with the communication layer. Just because it applies to drones(insert buzz word) does not make it a novel idea. I just find it funny that Wired is writing about it since it deals with drones, but I have read multiple other papers on the mis-application of compression and cryptography. Finding, flaws is important, I just feel like the article was kinda over selling the concept.
- jscheel 9y agoCouldn't you defeat this detection by moving the drone or camera in a pre-programmed pattern that you could then reverse to stabilize the video later?
- jeanmichelx 9y agoOld technique with "spying drone" buzzword
- anfilt 9y agoMy thought as well.
- deleted 9y ago[deleted]
- gruez 9y agoeasy countermeasure: CBR video compression
- codewritinfool 9y agoIsn't this an expected outcome of variable-rate compression? Switch to a constant-rate compression or pad with random data to reach that constant rate.
- personjerry 9y agoMy tl;dr understanding: Drones send video back to operator. Video is typically compressed so that it only updates part of the picture that have changed. Even if the video is encrypted, the researchers are able to measure the bitrate. Thus when the researchers make a significant change like putting a board against a window, and seeing if the traffic increases, the researchers can determine whether the drone is looking at that window.
- Sargos 9y agoI'm assuming this is predicated on the drone being absolutely still and that nothing in the scene (leaves on trees) is moving? Is that even realistic?
- godelski 9y agoIf you do a regular sequence of major changes, you could pick that signal out. This would create a larger and more regular signal in the data than the random noise from leaves. I don't think you could accurately predict observation with just one set of environmental changes.
- Kalium 9y agoGenerally speaking, inter-frame video compression uses an amount of data directly related to the amount that things change from one frame to the next. So while noise like leaves moving shows up as small changes moment to moment, larger changes are still realistically visible. My younger years spent screwing around with video for a hobby are coming back to me now.
- kmm 9y agoShouldn't simple linear movement of a scene still compress really well?
- godelski 9y agoYes. The compression works by analyzing changes in the screen. A simple example of this would be if you are displaying data. Say you are taking real time data and it is scrolling across the screen. Your display moves the data to the left, drops off what moved out of the frame, and adds what is new. Pictures are more complex, but the idea is the same. Only take what is new.
- misterbowfinger 9y agoOriginal paper: https://arxiv.org/pdf/1801.03074.pdf https://arxiv.org/pdf/1801.03074.pdf
- icegreentea2 9y agoThis defense is plausible for fixed frequency broadcast video feeds. Likely as drone usage grows and becomes ever more sophisticated (say nothing of current 'nation state grade' systems), their video feeds will likely be spread spectrum and highly directional (if nothing else, directional transmission makes the drone's video feed far more power efficient), making intercept and this type of analysis difficult.
- stretchwithme 9y agoAnd that is why drones will start landing on tree branches and the poles of street lamps. And why they'll start using cell networks.
- callumprentice 9y agoI expect image detection in a video stream is pretty advanced these days but I'd imagine you'd need to rotate the image being recorded 3D space to match the plane of the window so you can compare them both? If you know the position of the drone relative to the window, that's doable. Maybe the algorithms are clever enough to account for that these days. Interesting article - thanks for sharing.
- m4x 9y agoTheir technique doesn't actually do any image analysis at all, since the video stream from the drone is encrypted and they can't view it. Rather, they monitor the bitrate of the video stream and exploit the fact that static/unchanging scenes compress well and have a low bitrate while scenes which are changing have a higher bitrate. They then deliberately change the scene (by blacking out a window) and see whether the bitrate of the video stream increases. If there's a strong correlation between blacking out the window and changes in bitrate, they can conclude the drone is observing their window.
- callumprentice 9y agoGot it - thank you.
- irishcoffee 9y ago"A clever radio trick can tell you nothing" - works on drones for a living.
- anigbrowl 9y agoConstant bit rate compression isn't a cure-all. It's generally inferior to VBR which is why the latter took off in the first place. CBR is easily degraded by just increasing the amount of visual complexity. Leaves moving on trees in a breeze is a typical problem case. So if you're worried about being spied on, high-resolution mosaic patterns are your friend. Mirror or high specularity pigments will enhance the effect. For fixed installations a few discoballs and a laser will mess up someone's day. Of course, if you want real security you'll triangulate on the drone signals and jam, because if you really need to do so getting busted by the FCC is probably the least of your worries.
- electrograv 9y agoThe minimum bar for usable quality can be defined precisely, and an encoding algorithm designed around it. One obvious extreme example of this would be no compression at all, but it's easy to imagine much better designs. For example, imagine I define a spec where I require quality no worse than a lossless 500x500x24bit/frame video stream. If we budget a bit rate higher than is required for the naive raw transmission of those frames, we can first encode the naive frames, then encode the deltas between them (upscaled to full resolution) such that the reconstruction error is minimized while not exceeding any maximum tolerated error per pixel. With this approach, you are not crippled when facing an adversarial pattern generator of some kind, yet when transmitting regular natural scenes, you can benefit from significant quality increase. As you suggest though, it's true that generating the most complex patterns possible will reduce any drone's video quality as much the codec's design permits -- however accomplishing this seems much more expensive for relatively little benefit versus other counter-drone approaches.
- kang 9y agoThe important lesson being don't secure the signal, hide it in the noise.
- tehsauce 9y agoPretty clever! Definitely possible to beat by changing the way video is compressed/transmitted, but perhaps not without a performance loss
- a3n 9y ago> All of that may seem like an elaborate setup to catch a spy drone in the act, when it could far more easily be spotted with a decent pair of binoculars. But Nassi argues that the technique works at ranges where it's difficult to spot a drone in the sky at all, not to mention determine precisely where its camera is pointed. This technique could also be used in legal proceedings to establish that someone or some org was spying illegally.
- exabrial 9y agoI thought this was supposed to be prevented by your cipher mode?