5 ms·

I tried looking for how they're attacking ELRS (control link), and I'm seeing nothing. There's Joachim's LoRa library. However ELRS uses the 2.4GHz and its a

I tried looking for how they're attacking ELRS (control link), and I'm seeing nothing. There's Joachim's LoRa library. However ELRS uses the 2.4GHz and its a blend of LoRa and FHSS. Basically you need a BladeRF or better to attack the control link properly. And given the RPi platform, they're likely using RPITX as the SDR transmitter. Lucky to get 1MHz bandwidth... And you need 80MHz minimum. And the RPi doesn't have the horsepower to properly do 20 or more LoRa channels, with 112MHz mode on Blade. Until I see a BoM, code, or demonstration, I'm going to consider this to be hogwash.

05 2y ago
No way in hell anyone using drones for military purposes is even using non-modified ELRS, at the very least the hopping sequence is sourced from a CSPRNG and there's packet authentication.
jdietrich 2y ago
Anyone who cares about signal integrity is using dual-band, so you'd also need to cover the 915MHz/868MHz band. It might be possible that there's some kind of hideous vulnerability in ELRS, but there's a pretty high-stakes jamming contest going on right now.
- yostrovs 2y ago
  Apparently they're using some kind of broad spectrum systems in Ukraine that modulate across a wide range of frequencies at the same time, making it hard to jam them.
  - gorbypark 2y ago
    Any sources on some of the tech being used over there?
therein 2y ago
I do wonder if it is using something like this [0], but then there is always PrivacyLRS[1]. [0] https://www.nccgroup.com/us/research-blog/technical-advisory-expresslrs-vulnerabilities-allow-for-hijack-of-control-link/ https://www.nccgroup.com/us/research-blog/technical-advisory... [1] https://github.com/sensei-hacker/PrivacyLRS https://github.com/sensei-hacker/PrivacyLRS
geerlingguy 2y ago
It looks more like someone built a fun cyberdeck-style build with some neat hardware, and have a use case in mind... but until I see any code or evidence it does what it says, I'd be a little doubtful.

05 2y ago

No way in hell anyone using drones for military purposes is even using non-modified ELRS, at the very least the hopping sequence is sourced from a CSPRNG and there's packet authentication.

jdietrich 2y ago

Anyone who cares about signal integrity is using dual-band, so you'd also need to cover the 915MHz/868MHz band. It might be possible that there's some kind of hideous vulnerability in ELRS, but there's a pretty high-stakes jamming contest going on right now.

yostrovs 2y ago
Apparently they're using some kind of broad spectrum systems in Ukraine that modulate across a wide range of frequencies at the same time, making it hard to jam them.
- gorbypark 2y ago
  Any sources on some of the tech being used over there?

therein 2y ago

I do wonder if it is using something like this [0], but then there is always PrivacyLRS[1]. [0] https://www.nccgroup.com/us/research-blog/technical-advisory-expresslrs-vulnerabilities-allow-for-hijack-of-control-link/ https://www.nccgroup.com/us/research-blog/technical-advisory... [1] https://github.com/sensei-hacker/PrivacyLRS https://github.com/sensei-hacker/PrivacyLRS

geerlingguy 2y ago

It looks more like someone built a fun cyberdeck-style build with some neat hardware, and have a use case in mind... but until I see any code or evidence it does what it says, I'd be a little doubtful.