[Music]
Alessandro Fausto is the next
speaker Alessandro has a phd from the
University of Genoa he has delivered
Research on radio and
telecommunication and
antarctica research and is now Working
as a Security researcher for Nozomi
networks Which is a one of Our sponsors
but actually also one of the
contributors
to interesting talks in this Edition of a
no hat um the presentation is about
the analysis of RID protocols that are
using drones
identification telecommunication and
Reverse engineering and nov
vulnerabilities have been discovered by
alessander and his Team
so the presentation is not the drones
you are looking to give a big Welcome
to Alessandro
[Applause]
Fausto Thank you h Hello everybody asomi
we have analyzed two of the most Used
drone telemetry identification protocol
and
communications in this Talk We
Present the Reverse Engineering Process
we have done on the two protocols and
the vulnerabilities Found through
analysis
in the last Years drone
has a New Challenge for the Civil
Aviation
authorities the number of drones Flying
Around has
exploded
Dev difficult to SP ands
Enter forbid
areas
but Still F
Around the Civil Aviation authorities
have Grad introduced the requirement for
remote
identification of drone and
Pilots Special protocols was developed
and also appliance to monit
protocol
and Capture data and
display the remote identification
protocol use radio
frequency Signal to broadcast
information using several type of radio
frequency protocols When possible the
RID was integrated Into the
drone is transmitted by external
attached to the drone
Body telemetry
Pet from the take off to the landing of
the drone and contain several
information regarding the drone and the
Operation the drone location The
direction and the velocity is
transmitted in broadcast also also the
time Stamp the status of the drone and
information
information Must Be received by
different People First of all the Law
enforcement
officer drone
Pilots Need to see if is drone in
area to keep a Secure appro We to
encrypt or at Digit Sign telemet
data We Need a Key Distribution
infrastructure to distribute Key and
eventually revoke encryption
Keys encryption Key Must Be securely
stored on the drone and on Cellular
phone Matter can Get even more Complex
here Because We Must ensure That the
firmware is
encrypted the update Method is Secure
And there
is a hardware Protection Against
hardware tampering otherwise The key can
be extracted from the
drone As You can
[Music]
see situation is
Complex and so currently is no
Security There is no encryption in
Place so by example your position and
your drone serial number can be
discovered by any person There is no
authenticity nor integrity
check So we can Forge fake telemetry
data in one statement We cannot Trust
the Rid protocols
analyzed in
Research During this Research we have
analyzed ID protocol Covering a big
Slice of the drone Models and also two
appliances to
monitor the DJ dji drone ID is
proprietary protocol and is Used by dji
drones delet can be Captur and shown by
the dji aeroscope
device the Open drone ID or Audit is an
Open Source
protocol and was chosen by regulatory
framework as requirement in various
nation countries in Europe in USA and
Japan Are Now
mandatory the Open
the ait protocol can be captured by the
blue Mark drone scout DS
213
device and we have completely Reverse
engaged this device and we show what we
have discovered in a next
slide the scope of this Research was the
Commercial drone not the Military drone
we have chosen the dji Mini 3 Pro
kg and a Lic to be driven it support bji
drone ID proprietary and Open Source
protocol now I Present to you some
information
regarding protocols
the dji Mini 3 Pro Send ITS drone ID
rangefinders using the proprietary ocusync
3.0 physical Ler
protocol The protocol Use a classical
ism frequency 2.4 and and 5 gigz band
with an Ann Logic Open Logic
the Sign band is 10
MZ the duration is Less than 1
millisec and the Signal can Travel 12
km the Signal use two different
modulation the telemet stream is
modulated using a
square shift Key thens
Signal transmitted
using the ofdm modulation is a
orthogonal frequency Division
multiplexing technique and 2 Z of2
sequence has been added to the Signal
for synchronization
purpose two diagonal
h Z of
sequences and Block
ofdm
symbols to be decoded We need to perform
a lot of dsp Digital Signal Processing
Operation over Signal and short stream a
crucial Point is the synchronization of
the Signal the Signal Must Be
synchronized in frequency AND in
Time the first synchronization
Us spectrogram
to Cer
frequency
then
we then we do the time
synchronization IT can be Complex toise
in aisy in a Noisy
environment When we do the Time
synchronization We use the position of
the two Z two sequences identif Starting the
we can also
use Z of sequence to estimate and
compensate the channel Distortion These
sequences can be also
Used as
fingerprint if both of them are Present
in the Signal and the distance between
them is about
142 microseconds
anal detect as dji telemet
Signal to dec this Signal We need to
demodulate the ofdm modulation and qpsk
Signal from Inside the
modulation and the turbine
coding During the removal of the turb
Codes some transmission error
automatically
corrected because turb code
a Forward error correction
System the Signal Must Be captured With
an SDR card able to receive and
transmit 15 Millions of samples by
second the sample Complex number so
There is a lot of data to be analyzed
all dsp Operation are performed in
software so the computational
requirement
High As You can see in the image the
data is completely completely
unencrypted and this telemetry packet
contain fake data the drone serial
Number Is Don't Trust me
the second String You can see on the
Inside the packet is asmodeus is one of
the Great Demon in the n last
levels information Just binary data
encoded
in
Bytes to capture and visualize this
packet fake packet and also Real packet
we have used the dji aeroscope mobile
Dev device use Android
tablet as a graphical user interface
while Most of the work is done by a
Custom radio frequency capture board
this board is
Inside Plastic Plastic
Block
applian djes
ins
database so for each drone we can The
flight and get all information at any
time
theit is an protocol is Open sourced and
is Based on standard wireless
protocol data can be sent using WiFi
beacon or Bluetooth advers
adverse or Bluetooth
beacons The telemetry Message structure
is Complex and is separated into
different message
Type an Open Source library was made
Made available to completely decode this
message the dji Mini 3 Pro Send also
WiFi bz telemetri using the
ASM
f341 standard is the USA regulatory
standard this Format is supported by the
Audit protocols also this protocol as
you can see in the image is completely
unencrypted
and unprotected Against
modification the information
sent nearly the same sent by the dji
drone ID telemetry Format As You can see
you have drone position
velocity operator ID and several type of
information all sent in
Clear to capture and visualize ait
telemetry we used the blue Mark drone
scout monitoring
appliance device captured telemetry and
S them to mq Broker for later
analysis to Place the drone on a map and
visually track it We modify the mqtt
Broker to send the position Speed ​​and
going of the drone to a modified
version of adsb TAR 1090 is a software
used to capture and visualize
adsb Airplane
Ringing different vulnerabilities We
Present in
slide Now we Present some Attack Against the
telemet
data in the following
slide We expose the weakness
of Bot dji drone ID
and protocols the telemetry data is sent
in Clear and is not protected Against
modification we can change any
information we want we can spof drone
identity Dr position and valu we canate
unque identification
code protocol and monitoring appli Can
Be the target of this Attack of the
Attack presented in the next
slide this Attack was made broadcasting
fake a
telemetri telemet packet contain a sle
drone Following
as
can0 Map The drone scout Dev Take values
as valid and S all data tott
brer i show to you This video is a video of the
Attack the
drone the drone is Moving to Como Lugano
Highway and is also railway line on the
left drone
is not a fake
drone telemet was created
using code Script
in this case We Just Send WiFi beacons
we can use different type of hardware to
do this There is a lot of Open
Source programs in internet You can use
to do the same thing
but Against drone ID System the
broadcasted drone telemetry packet
contain a single drone looping Over the
Barn
Airport the dji aeroscope device data as
valid and plot the position of the fake
drone
and also for for ATT the video
now the
drone to the
airport following a
classical Plane landing
Path also in this case The drone do not
exist and is completely
fake SDR
card Now do naudo dji drone Take
Off and go back to ITS initial position
This is a variation of Previous Attacks
It was made Brad casting fake coded
telemetri with
several drone serial numbers Each drone
follow
AS
telemetri to mqtt Broker for
the drone scout rangefinders Real
drone This is the video of the
tack Now we start Start to send fake
data and create Start from a position
and
telemetry Are Just WiFi beacon packet or
Bluetooth advertisement packet So we can
create as many drones as we want
This is an type of Attack We sent as
many drone ID telemetry as we can trying
to FL the monitoring device
in you see the first drone appear next
to the drone to the bern Airport
followed in 10 second by a continuously
increasing number of
drone This is the video of this type of
Attack This is the first drone
then Each drone have a different serial
number but do not Move and
Lot can be difficult to Find a a Real
drone Inside this mess if the real drone
exist for each New drone appearing on the
map the device Play a Loud
Sound this can be really Annoying with
10 of New drones Each of New drones Each
Each second
Dev is kind of Attack in Attack We
position Real drone and we create a
Cloud of fake drone surrounding
it the movie of the Attack
Now a drone Now drone is appeared is
detected by drone scout
device
then to
Attack creating a Cloud of Random drone
surrounding the real drone and Moving
with it
Inside Inside this Cloud of fake drone
is one Real drone but can be interesting
Toe That the drone can be also first
drone can be a fake drone
and it is difficult to find it the real
drone Inside th clouds of
drone Now we change the Point of View We
Attack the monitoring
device the blone scout completely rever
engaged we have Found Three Different
vulnerabilities the Critical and Medium
vulnerabilities can be exploited in a
similar way leading to a drone
trajectory
hij the High Risk vulnerability can be
used to Flash a custom firmware taking
of
Comm arm Based edard with to Linux as
operating
System the image show to you the update
script As You can see
the software was executed using The
insecure Command line
parameter so
of the update
server performing a Man in a Man in the
Middle Attack we can intercept this
download request passing a custom
firmware in Place of the Real
one with the custom firmware an attacker
can completely control or overtake dev
Now foc Medium Risk
vulnerable this vulnerability depends on
the internal Message handling loop
Logic the drone scout
device identify the drone
using
address only
theed from
Coming from the
address As You can see in the
image Each
message arriving After
Less 500 millisec
the Lower image show an attacker can
exploit this Logic to inject fake data
hijacking the drone
trajectory an attacker can Send a
specially crafted
message Less than 500
millisecond before a Real
packet forcing the drone scout device to
Drop The Following Real drone telemetry
data Attack is not completely
reliable because depend on internal
timer state but We still have a
19% of su
rate we can do
the using the Critical Risk
vulab as
prev vulnerability
depend message handling
Logic When During The Loop a message is
captured on anent WiFi Channel with an
Energy
gr
an Message from the addig
Attack is completely
reliable an attacker can
S Power specially crafted
message WiFi Channel to completely Over
the drone telemetry
anding TR
the trajectory hijacking Attack can be
performed only Against unpatched drone
scout device this Attack do not work
Against the J aeroscope because it is
related to a Logic Us Used Only in the
drone scout
app We Can Force the drone scout to
track a fake
operated by example we Move thee to the
West If we
stop ATT the drone
scout plot
drone to
Drop
drone and
and
drone
real this is the video of the
Attack also This time is performed
Against drone Flying Around the Como
Lugano Highway
stop the Attack the drone come back to
Real
position then Attack and the drone
Start the West
When we Stop when we stop the Attack the
drone come back to Real position we can
perform Attack as many as Many Time We
want Now Start tove W
and is just sending fake
WiFi beacon on a Side
Channel nent
Channel in the
future We Need a reliable remote
identification of drones
ATT can use some Method to detect fake
rangefinders for example we can check some
Basic physics
Rules the we can also check for Signal
intensity Signal intensity Must Be
compatible With the distance between the
sender and the receiver we can also
check Each single telemetry data Matrix
the drone
altitude a drone cannot Fly Inside a
Mountain the ITS position and altitude
Must Be compatible With orography of the
area and also They can fly They Can't
intit in theot distance between the
drone and the other was
about
164 km This is
Impossible because aned Signal cannot
Travel so far They
Just
[Music]
trav Space Just 12
km Thank you for the Attention and if
you have some Question Just Ask
[Applause]
[Music]