New EMFI Attack Against Drones Leads to Complete Take Over

Based on the recent reports by IOActive, Drones, also called Unmanned Aerial Vehicles (UAVs), are vulnerable to code injection, which would result in gaining complete access to the firmware and core functionality of the drone.

Drones have been used in many industries like aviation, agriculture, and law enforcement. They are often operated remotely, which offers an attack surface for threat actors to gain control over them.

Stealing a drone can offer much more sensitive information for an attacker and can also pave the way for implanting malware on the system.

According to the report, it is possible to exploit a drone by injecting a specific Electromagnetic glitch during a firmware update that could result in complete control over the drone.

EMFI Attack Against Drones

DJI drones are considered for testing purposes as they offer many security features in their products like Encrypted firmware, Trusted Execution Environment (TEE), Secure Boot, etc.

Furthermore, the whitepaper published by IOActive also covered Attack Surface, Technical Background, First and Second Approaches, and their Mitigations.

Attack Surface

Backend

There are multiple attack surfaces for a drone in a wireless network. Like any other system with a backend, drones are also made up of servers vulnerable to SQL injections, SSRF, and many other backend-based attacks.

Mobile Apps

Today’s drones are controlled by mobile applications mostly, which can be a great attack surface for threat actors.

The vulnerabilities include operating system and application-based vulnerabilities.

Radio-Frequency

RF-based attacks like interference, jamming, spoofing, and other attacks are also possible on these UAVs.

DJI drones also have OcuSync, a protocol for low latency between the controller and the drone. 

OcuSync protocol can automatically switch between multiple communication channels to have stable and strong connectivity.

It can also be used in environments where large radio interference is present.

Physical Device

Physical access to a drone can give a wide range of information to threat actors like firmware and other sensitive information.

The whitepaper mentioned that the technical information for this attack vector relied on three main types of side-channel attacks,

Timing Attacks

This attack relies on targeting the time taken for the completion of an operation which can be used for other attacks like breaking cryptographic implementation and guessing PIN numbers.

Power analysis

The voltage path for the chip is tracked and monitored for Simple Power Analysis for a targeted operation. Later, this can be used to recover secrets like cryptographic keys.

EM Analysis

An EM probe can retrieve power-based information, which can be less invasive. However, it must be kept very near to the drone chip.

EMFI (ElectroMagnetic Fault Injection)

The drones are susceptible to an EMFI, which can disrupt the hardware while processing some operations due to the EM probe attack.

This can change a lot of behavior of the CPU of the drones resulting in a gain complete takeover of the drone.
IOActive has published a complete attack report and mitigation steps.

Stop Advanced Email Threats That Target Your Business Email – Try AI-Powered Email Security