Tuesday, June 25, 2024

New EMFI Attack Against Drones Leads to Complete Take Over

Based on the recent reports by IOActive, Drones, also called Unmanned Aerial Vehicles (UAVs), are vulnerable to code injection, which would result in gaining complete access to the firmware and core functionality of the drone.

Drones have been used in many industries like aviation, agriculture, and law enforcement. They are often operated remotely, which offers an attack surface for threat actors to gain control over them.

Stealing a drone can offer much more sensitive information for an attacker and can also pave the way for implanting malware on the system.

According to the report, it is possible to exploit a drone by injecting a specific Electromagnetic glitch during a firmware update that could result in complete control over the drone.

EMFI Attack Against Drones

DJI drones are considered for testing purposes as they offer many security features in their products like Encrypted firmware, Trusted Execution Environment (TEE), Secure Boot, etc.

Furthermore, the whitepaper published by IOActive also covered Attack Surface, Technical Background, First and Second Approaches, and their Mitigations.

Attack Surface

Source: IOActive


There are multiple attack surfaces for a drone in a wireless network. Like any other system with a backend, drones are also made up of servers vulnerable to SQL injections, SSRF, and many other backend-based attacks.

Mobile Apps

Today’s drones are controlled by mobile applications mostly, which can be a great attack surface for threat actors.

The vulnerabilities include operating system and application-based vulnerabilities.


RF-based attacks like interference, jamming, spoofing, and other attacks are also possible on these UAVs.

DJI drones also have OcuSync, a protocol for low latency between the controller and the drone. 

OcuSync protocol can automatically switch between multiple communication channels to have stable and strong connectivity.

It can also be used in environments where large radio interference is present.

Physical Device

Physical access to a drone can give a wide range of information to threat actors like firmware and other sensitive information.

The whitepaper mentioned that the technical information for this attack vector relied on three main types of side-channel attacks,

Timing Attacks

This attack relies on targeting the time taken for the completion of an operation which can be used for other attacks like breaking cryptographic implementation and guessing PIN numbers.

Power analysis

The voltage path for the chip is tracked and monitored for Simple Power Analysis for a targeted operation. Later, this can be used to recover secrets like cryptographic keys.

EM Analysis

An EM probe can retrieve power-based information, which can be less invasive. However, it must be kept very near to the drone chip.

EMFI (ElectroMagnetic Fault Injection)

The drones are susceptible to an EMFI, which can disrupt the hardware while processing some operations due to the EM probe attack.

This can change a lot of behavior of the CPU of the drones resulting in a gain complete takeover of the drone.
IOActive has published a complete attack report and mitigation steps.

Stop Advanced Email Threats That Target Your Business Email – Try AI-Powered Email Security


Latest articles

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...

Microsoft Power BI Vulnerability Let Attackers Access Organizations Sensitive Data

A vulnerability in Microsoft Power BI allows unauthorized users to access sensitive data underlying...

Consulting Companies to Pay $11 Million Failing Cybersecurity Requirements

Two consulting companies, Guidehouse Inc. and Nan McKay and Associates, have agreed to pay...

New RAT Malware SneakyChef & SugarGhost Attack Windows Systems

Talos Intelligence has uncovered a sophisticated cyber campaign attributed to the threat actor SneakyChef....

Chinese Winnti Group Intensifies Financially Motivated Attacks

Hackers are increasingly executing financially motivated attacks and all due to the lucrative potential...

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles