New EMFI Attack Against Drones Leads to Complete Take Over

Based on the recent reports by IOActive, Drones, also called Unmanned Aerial Vehicles (UAVs), are vulnerable to code injection, which would result in gaining complete access to the firmware and core functionality of the drone.

Drones have been used in many industries like aviation, agriculture, and law enforcement. They are often operated remotely, which offers an attack surface for threat actors to gain control over them.

Stealing a drone can offer much more sensitive information for an attacker and can also pave the way for implanting malware on the system.

According to the report, it is possible to exploit a drone by injecting a specific Electromagnetic glitch during a firmware update that could result in complete control over the drone.

EMFI Attack Against Drones

DJI drones are considered for testing purposes as they offer many security features in their products like Encrypted firmware, Trusted Execution Environment (TEE), Secure Boot, etc.

Furthermore, the whitepaper published by IOActive also covered Attack Surface, Technical Background, First and Second Approaches, and their Mitigations.

Attack Surface

Source: IOActive

Backend

There are multiple attack surfaces for a drone in a wireless network. Like any other system with a backend, drones are also made up of servers vulnerable to SQL injections, SSRF, and many other backend-based attacks.

Mobile Apps

Today’s drones are controlled by mobile applications mostly, which can be a great attack surface for threat actors.

The vulnerabilities include operating system and application-based vulnerabilities.

Radio-Frequency

RF-based attacks like interference, jamming, spoofing, and other attacks are also possible on these UAVs.

DJI drones also have OcuSync, a protocol for low latency between the controller and the drone. 

OcuSync protocol can automatically switch between multiple communication channels to have stable and strong connectivity.

It can also be used in environments where large radio interference is present.

Physical Device

Physical access to a drone can give a wide range of information to threat actors like firmware and other sensitive information.

The whitepaper mentioned that the technical information for this attack vector relied on three main types of side-channel attacks,

Timing Attacks

This attack relies on targeting the time taken for the completion of an operation which can be used for other attacks like breaking cryptographic implementation and guessing PIN numbers.

Power analysis

The voltage path for the chip is tracked and monitored for Simple Power Analysis for a targeted operation. Later, this can be used to recover secrets like cryptographic keys.

EM Analysis

An EM probe can retrieve power-based information, which can be less invasive. However, it must be kept very near to the drone chip.

EMFI (ElectroMagnetic Fault Injection)

The drones are susceptible to an EMFI, which can disrupt the hardware while processing some operations due to the EM probe attack.

This can change a lot of behavior of the CPU of the drones resulting in a gain complete takeover of the drone.
IOActive has published a complete attack report and mitigation steps.

Stop Advanced Email Threats That Target Your Business Email – Try AI-Powered Email Security

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Russian Hacker Indicted Over $24 Million Qakbot Ransomware Operation

The U.S. Department of Justice has unsealed a federal indictment against Rustam Rafailevich Gallyamov, 48,…

18 minutes ago

Fortinet Zero-Day Under Attack: PoC Now Publicly Available

FortiGuard Labs released an urgent advisory detailing a critical vulnerability, CVE-2025-32756, affecting several Fortinet products,…

44 minutes ago

Global Crackdown Nets 270 Dark Web Vendors in Major Arrests

A sweeping international crackdown, codenamed Operation RapTor, has dealt a significant blow to the criminal…

2 hours ago

CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets

On May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent advisory…

2 hours ago

CefSharp Enumeration Tool Identifies Critical Security Issues in .NET Desktop Applications

Cybersecurity researchers and red teamers, a newly released tool named CefEnum is shedding light on…

14 hours ago

Russian Hackers Exploit Oracle Cloud Infrastructure to Target Scaleway Object Storage

Russian threat actors have been leveraging trusted cloud infrastructure platforms like Oracle Cloud Infrastructure (OCI)…

14 hours ago