9 ms·
Drone hijacked by UT hackers with $1,000 spoofer
- kyle_martin1 14y agoI wouldn't consider this "hacking" or even very impressive. If you deliver enough power to the right antenna with the right carrier frequency you can jam any wireless communication. It's the same concept as "whoever yells the loudest will be heard".
- JabavuAdams 14y agoYour argument just makes this more serious. It's a (possibly easy) exploit with serious consequences.
- kyle_martin1 14y agoI was speaking to how exaggerated the title of the post is, not the ease of exploitation.
- jjwiseman 14y agoVideo of spoofing an iPhone's GPS: http://www.youtube.com/watch?v=ShRPXkpW1mM http://www.youtube.com/watch?v=ShRPXkpW1mM Note that they are able to quite precisely control the spoofed location--there is no hard banking or veering. The phone thinks it's moving smoothly at 40 MPH. Also note that it is believed that people have already been killed by GPS jamming: http://www.newscientist.com/blogs/onepercent/2012/05/gps-loss-kicked-off-fatal-dron.html http://www.newscientist.com/blogs/onepercent/2012/05/gps-los...
- blutack 14y agoIndeed, this is really bad reporting (IAA UAV researcher). They were using a small rotary wing (relatively cheap) research UAV, despite the various articles including pictures of Global Hawks/MQ-9s etc. These small systems are usually designed for research, and so use the same UBlox/MTK/Sirf based GPS chipsets you find in sat-nav systems for example. It looks similar to a Yamaha RMax, although I can't be bothered to find the actual model. The RMax is designed for agricultural use & research, not fighting wars. The vehicle control software simply assumes the GPS is correct. It wouldn't be that difficult to cross-check against the IMU data - our research drones can happily fly for a few seconds if they loose their GPS lock but spoofing would probably knock them down, because we just assume it won't happen! You could build a DIY version of the Texas drone for around $1000 using open source hardware and a COTS model helicopter. --- This not news, anyone who works with these vehicles knows this. It's like shooting a horse and then claiming terrorists can take out tanks with a single bullet.
- asynchronous13 14y agoThe Rmax is much larger than the helicopter UT is flying.
- blutack 14y agoIndeed - I eventually found a picture of it with a person for scale. Do you know what it is?
- asynchronous13 14y agoI believe they are using an electric Logo 500. Edit: yep. It's from Adaptive Flight, Inc. which is a modified Logo 500. http://www.wired.com/dangerroom/2012/07/drone-hijacking/all/ http://www.wired.com/dangerroom/2012/07/drone-hijacking/all/
- SoftwareMaven 14y agoWhile I agree the article is sensationalist and the pictures are misleading, I disagree that there is no relevance. If anything, everything you've said makes it more concerning. These are exactly the kind of drones we will have flying overhead, which will all be easily borked by anybody with $1000 and some good technical knowledge.
- blutack 14y agoI agree it is an area that could do with research. However, we know consumer level GPSs have no protection against spoofing (indeed, you can buy GPS jammers from various websites for defeating fleet tracking systems). You could as well use a replay attack against the pilot's control system (probably on 2.4GHz) using much cheaper hardware. There is still plenty of work to do before these class of research drones become commonplace overhead - in particular, practically every onboard system is a single point of failure.
- jeltz 14y agoSounds to me then like FAA should require all drones to be safe against things like GPS spoofing, GPS jammers and replay attacks before they open up the airspace for drones.
- ricardobeat 14y agoWhat prevents this kind of attack from being used on current commercial airliners?
- jakejake 14y agoYou'd imagine the pilots would notice if the auto-pilot started flying erratically. I'm sure it could be used to confuse the hell out of the pilots though.
- datalus 14y agoPlanes have crashed for lesser reasons...
- bdonlan 14y agoEven if the pilots didn't, ATC would (and the plane's own GPS unit's internal checks might notice as well) - and then it's simple enough to disable GPS and use VOR navigation (or radar vectors, in a pinch).
- lotu 14y agoCouldn't the same thing happen with a drone? After all they are being controlled by someone one the ground. If you notice it behaving erratically or ATC notices and contacts you about it you could correct the issue. In fact that is exactly what happened in this situation the drone's autopilot was overridden by another pilot to prevent it from crashing.
- zcid 14y agoInstrument failure isn't always detected by the crew. In the case of Air France 447 in 2009, even the instruments that were working correctly weren't properly understood. The black box transcript from AF 447 is quite an interesting read: http://www.popularmechanics.com/technology/aviation/crashes/what-really-happened-aboard-air-france-447-6611877 http://www.popularmechanics.com/technology/aviation/crashes/...
- 14y ago
- stfu 14y agoCredit goes to kmfrk who posted the link at http://news.ycombinator.com/item?id=4212085 http://news.ycombinator.com/item?id=4212085
- ARobotics 14y agoI know the title here is the same as the article, but why the heck did sophos choose "Texas college" for the something done by the University of Texas? I assumed from the title it was done by some small school somewhere in Texas, not UT.
- xmmx 14y agoThere is only one school in texas worth knowing about.
- Cyranix 14y ago... Rice University?
- deleted 14y ago[deleted]
- dctoedt 14y agoAmen! I had exactly the same reaction. (Disclosure: I'm an alumnus, twice.)
- RegEx 14y agoTexas College is actually a low-quality college in my town. I was very, very confused for a few seconds.
- tzs 14y agoUT is in the top 30 on the Times Higher Education world university rankings: http://www.timeshighereducation.co.uk/world-university-rankings/2011-2012/top-400.html http://www.timeshighereducation.co.uk/world-university-ranki... They are #13 on the list of world rankings of engineering schools: http://www.timeshighereducation.co.uk/world-university-rankings/2011-2012/engineering-and-IT.html http://www.timeshighereducation.co.uk/world-university-ranki... By saying "Texas college", it makes it sound like some random second or third tier school did it. That's much more sensationalistic as it can easily give the casual reader the impression that pretty much anyone can easily hack these drones. If they said a team from a top engineering school did it, it would not frighten people because that's the kind of thing you EXPECT people from top engineering schools to be able to do.
- nyellin 14y agoEach one of these could be a potential missile used against us. This seems to be exaggerated. Wouldn't you need a drone on American soil, already right next to the target, in order to crash it by sending falsified GPS coordinates?
- hnhg 14y agoOr against US soldiers.
- nyellin 14y agoYou would still need a strong signal near the target, which is more difficult than setting up a drone-trap like Iran seems to have done. Is it possible to somehow sign GPS coordinates? (Perhaps sync an internal clock at each mission's start, and check a time-based signature?) If not, are there practical challenges to integrating the output of a drone's engine and calculating the path travelled, instead of naively believing satellite coordinates? Actually, wind must make that difficult. For a car, you can attach a magnet to each wheel and count the surges as it passes a sensor on each rotation, to give you an idea of where you are. Due to the external forces on a drone, you would probably want to measure forces with an accelerometer/gyroscope, not engine output.) What are the challenges involved in such? Is internal-location tracking even feasible?
- jandrewrogers 14y agoAll military navigation systems are inertial, not GPS. They only accept GPS corrections within the error bars of the inertial system. As a practical matter this means that you can only make a drone deviate from its intended course by a few meters assuming you did a perfect job of spoofing the GPS. GPS spoofing/jamming only works for systems that use GPS navigation systems; military weapons and systems have never used GPS navigation. Inertial navigation systems are spoof-proof.
- smokeyj 14y agoUnless one gets downed abroad and reprogrammed.
- Judson 14y agoThere are a few good comments[1] on the article page that point out that Military drones use an encrypted GPS channel that isn't susceptible to this specific attack. A much more sophisticated attack would have to be used to take over a military drone. [1]: http://nakedsecurity.sophos.com/2012/07/02/drone-hackedwith-1000-spoofer/#IDComment394919998 http://nakedsecurity.sophos.com/2012/07/02/drone-hackedwith-...
- jandrewrogers 14y agoMilitary systems have never relied GPS for guidance. These systems were developed during the Cold War; the Soviets had the ability to take out the GPS satellites directly. The US military has always used inertial navigation systems, usually based on extremely precise laser interferometers. You can't spoof or jam inertial guidance short of locally altering the laws of physics. A few decades ago, GPS was used to apply corrections within the (classified) error bounds of the inertial navigation system, which could be significant; any GPS correction outside the error bound of the inertial navigation system was interpreted as GPS being compromised. As the decades have passed, inertial navigation systems have become progressively more precise to the point that GPS is adding a rapidly shrinking amount of extra precision. In fact, the US military is starting to test a new type of ultra-precise interferometer that allows inertial navigation to exceed the precision of GPS. GPS correct INS will only continue to be used to the extent it is inexpensive and gets the job done.
- frankydp 14y agoThis scenario would also assumes that no human is in the loop and the drone is running on auto pilot. The "hack" was averted by the drone pilot switching the drone to manual in the exercise in question. I am not sure what military drones even have to do with this test.
- grandalf 14y agoThis is part of the clever and gradual propaganda campaign to increase drone funding/sophistication significantly. A new article intended to nudge the reader toward that conclusion is released about every 6 months.
- dusing 14y agoOther people read this and say it is a clever propaganda campaign to promote the danger of using drones that can be turned against us by hackers, etc.... so likely the simplest answer is correct, it's not a giant conspiracy after all.
- grandalf 14y agoUh, that's what the article said, one doesn't have to infer it. Of course if any form of US military technology is easily hackable there is not likely to be much consensus behind the idea of just cancelling the program... The article sets the stage for easy agreement with the idea that US drone tech needs an overhaul. Even if the first appropriations toward this go to a small subset of current military drones, that gets the ball rolling.
- asynchronous13 14y agoEgads, the news coverage of this is horrible fear mongering. The researchers from UT built a system to protect against GPS spoofing. In order to prove that their protection system works, they had to demonstrate that GPS spoofing is feasible. Without exception, every news item on this only mentions the spoofing part, and not the protection part. Military unmanned systems use encrypted GPS that is not vulnerable to the attack demonstrated. Its possible to make a vehicle fly erratically, or even cause it to crash by spoofing GPS. But to take control requires a lot more than what was demonstrated. An error of 1us in the spoofed signal corresponds to 1000ft -- that's why the actual descriptions of the vehicle say 'banked hard' or 'veered' off course. GPS jamming is so much easier than spoofing and results in the same thing.
- erikb 14y agoDo you have some reasonable sources about GPS jamming? From what I know, GPS should be protected against jamming through signal spreading, which means you should be only able to do it with investing unreasonable amounts of resources.
- asynchronous13 14y agoIs this good enough? http://www.jammerall.com/categories/GPS-Jammers/ http://www.jammerall.com/categories/GPS-Jammers/ Low-cost GPS jammers are $30-$50 dollars, though they are illegal to sell or to use. Jamming is a simple matter of sending out a signal more powerful than the signal received from the satellites. 100mW transmitter is more than adequate in close range.
- rabidsnail 14y ago> GPS jamming is so much easier than spoofing and results in the same thing. Does it? Can't the drone tell that the GPS input that it's getting is inconsistent and fall back to flying home using dead reckoning?
- asynchronous13 14y agoTechnically, yes it is possible for an autopilot to use dead reckoning for navigation without GPS at all. (we didn't use GPS to navigate to the moon, right?) However, all commercial autopilots that I know of rely on GPS to some degree. The difference is the use of low-cost gyros and accelerometers. They are good enough when augmented with GPS, but not good enough all alone. Edit: the low-cost sensors can be augmented with sensors other than GPS too, like vision processing. This has been demonstrated but is not yet in widespread usage. I expect to see this become more common due to demonstrated vulnerabilities in GPS.
- joering2 14y agoI believe its too late. Too much money has been already spent by lobbyst and all third parties dying to make trillions off of this scam (vide Chertoff and his radiation scanners: first it was just airports (and I somehow agree) with a reasoning that 300 people aboard a plane can be killed by one idiot with a bomb and when you fly a plane you are in one guy's hands (pilot), but now they are fully rolling it into stadiums, train stations, buses, soon schools universities and all public entities to join, including libraries (no explanation why -- just simple so that bearded guy hiding in Afghanistan mountains won't get you). Chertoff will make ten thousands-fold on his initial investment; brilliant business anywhere outside US would be called illegal and conflict of interest). I bet you DHS will turn this horrible news into a good PR, something like "we noticed they could take over our drone, but you see if we get additional 10 billion in funding, we could use encryption over GPS and then all our drones will be safe again".
- blhack 14y agoI'm moderately certain that military drones use dead reckoning in addition to gps. If they're not: dear DoD, I can fix this for you with about $50 worth of parts.