National audienceThe commercial drone market has significantly taken off for a few years. In 2016, sales of drones used for commercial and enterprise purposes was worth 3.4 billion dollars [3]. This fast-growing field raises many questions regarding security since damages caused by such drones could be disastrous. Knowing that in some cases, transmission range is so wide (7 kilometers for a DJI Phantom 4 Pro) and that some drones can lift off more than 30 kg worth of equipment, we cannot deny that there will be (and already are) unexpected and unwanted uses of such a technology. In this article, we introduce DroneJack, an automatic anti-drone solution that can protect an area from being flown over. Using DroneJack, you can conduct a predefined defense over foreign drones as shutting them down, pilot them instead of the true user, direct them towards some GPS coordinates. You can also exploit data owned by the drone to recover photos, videos or flight logs. Even better, you can configure your own attacks on foreign drones and deploy them on DroneJack. Let's play

Audren de Kerdrel, Paul

Cotret, Pascal

Fournier, Guillaume

Viet Triem Tong, Valérie

INRIA a CCSD electronic archive server

HAL Id: hal-01635125https://hal.inria.fr/hal-01635125Submitted on 14 Nov 2017HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.DroneJack: Kiss your drones goodbye!Guillaume Fournier, Paul Audren de Kerdrel, Pascal Cotret, Valérie VietTriem TongTo cite this version:Guillaume Fournier, Paul Audren de Kerdrel, Pascal Cotret, Valérie Viet Triem Tong. DroneJack:Kiss your drones goodbye!. SSTIC 2017 - Symposium sur la sécurité des technologies de l’informationet des communications, Jun 2017, Rennes, France. pp.1-8. ￿hal-01635125￿DroneJack: Kiss your drones goodbye!Guillaume Fournier1, Paul Audren de Kerdrel1, Pascal Cotret2, andValérie Viet Triem Tong3guillaume.fournier@supelec.frpaul.audrendekerdrel@supelec.frpascal.cotret@centralesupelec.frvalerie.viettriemtong@centralesupelec.fr1 CENTRALESUPELEC, Rennes, France2 SCEE CENTRALESUPELEC/IETR/CNRS, Rennes, France3 EPC CIDRE CENTRALESUPELEC/INRIA/CNRS/University of Rennes 1Abstract. The commercial drone market has significantly taken off fora few years. In 2016, sales of drones used for commercial and enterprisepurposes was worth 3.4 billion dollars [3]. This fast-growing field raisesmany questions regarding security since damages caused by such dronescould be disastrous. Knowing that in some cases, transmission range is sowide (7 kilometers for a DJI Phantom 4 Pro) and that some drones can liftoff more than 30 kg worth of equipment, we cannot deny that there willbe (and already are) unexpected and unwanted uses of such a technology.In this article, we introduce DroneJack, an automatic anti-drone solutionthat can protect an area from being flown over. Using DroneJack, youcan conduct a predefined defense over foreign drones as shutting themdown, pilot them instead of the true user, direct them towards some GPScoordinates. You can also exploit data owned by the drone to recoverphotos, videos or flight logs. Even better, you can configure your ownattacks on foreign drones and deploy them on DroneJack. Let’s play!1 IntroductionUnmanned aerial vehicles (UAV) were originally made for the military mar-ket for training, reconnaissance missions or bomb transports. Nowadays,drones are mainly used by civilians for aerial pictures, wildlife discovering,hunting, search and rescue missions.Drone manufacturers, such as Parrot or DJI, are in a constant com-petition resulting in incredible toys able to fly several kilometers awayfrom their base station; however, security is not often taken into account:for instance, between October 2014 and February 2015, 17 nuclear plantshave been flown over in France [6]. Another example is the famous dronethat crashed on the White House lawn in June 2015 [8]. Fortunately, those384 DroneJackstories had harmless endings. But we claim that under precise circum-stances as the defense of sensitive areas we need practical solutions to takecontrol of foreign drones. We present here DroneJack as an off-the-shelfanti-drone solution for protecting a given area. DroneJack automaticallydetects and takes the control of multiple foreign drones relying on WiFicommunications that cut across a given area. We particularly focus onParrot AR Drone and Bebop, widely spread commercial drones.Section 2 presents some existing anti-drone solutions. Main lines ofDroneJack are detailed in Section 3. Finally, Section 4 explains howDroneJack can be used to control captured drones.2 Existing anti-drone solutionsBeing able to stop a drone flying over a given area has become a securityand a privacy question whose importance has grown for the last fewyears. As stated before, we particularly focus here on commercial dronesthat can be bought by anyone. These devices are equipped with specificautonomous features such as altitude stabilization, take-off and landing,automatically landing upon loss of control signal, Return-to-home, Follow-me, GPS navigation, orbit around an object. These devices can also obeyto remote orders to accomplish various tasks such as mapping, surveillance,search or tracking operations. In this context, there are two main ways toprevent drone from flying over a given area. First, we can try to physicallycapture the drone: for instance, the Dutch National Police Force hastrained eagles to help take out illegal drones [9]. We can also use a biggerdrone equipped with a huge net meant for capturing and disabling smallerdrones [7].The second approach consists in taking control of the device withoutphysical interactions. This approach exploits the fact that the modeof communication between the drone and its master is wireless. Themain goal of existing tools of this second approach is to disrupt thecommunication between the drone and its master intentionally by causinginterferences or collisions at the receiver side.Drones communicate with their operators at common frequency bands(2.4 GHz in Europe4). DroneWatch [4] is a full anti-drone solution. Thisproject can detect, track and identify many types of civilian drones. Ituses optical and radio frequency based technologies in order to providean accurate position of a malicious drone. Unfortunately, it appears4 If you are familiar with frequencies, you may already know that 2.4 GHz is thefrequency used by the WiFi protocol, this will be important in the followingG. Fournier, P. Audren de Kerdrel, P. Cotret, V. Viet Triem Tong 385that the only countermeasure implemented is a jammer. In other words,DroneWatch is an accurate drone detector but does not provide anyreal world solution once the drone has sneaked into a restricted area.DroneDefender is another solution that works by directing radio energyat the drone, disrupting the remote control link between the drone andthe operator [2].This approach seems to have been chosen by Airbus Defence andSpace [1]. However, it presents several problems. First, it requires adefender agent and a clear line-of-sight to be effective. Therefore, dronesdetection is performed with naked eyes. It can only deal with one droneat a time: the defender must wait until the targeted drone has landedbefore taking care of another one. Such rifles can only land a drone orreturn it back to its owner, the defender cannot control it as he wants.Drones commonly communicate with their operators thanks to wirelessconnection. SkyJack [5] exploits this feature to remotely take the controlof foreign drones. More precisely, SkyJack is a kind of guardian drone thatflies over a monitored area and seeks the wireless signal of any other dronein this area. Once detected, SkyJack disconnects the wireless connection ofthe true owner and authenticates himself with the target drone. SkyJackcan thus feed commands to the captured drone. SkyJack is available onGithub at https://github.com/samyk/skyjack, it is a Perl applicationthat uses aircrack-ng (https://www.aircrack-ng.org/) which is acomplete suite of tools to assess WiFi network security.From our point of view, SkyJack is an appealing approach allowing totake the control of foreign drones without leaving home. Unfortunately,and as far as we know, this solution lacks essential features to be consideredas a real anti-drone system, the defender does not have any control overthe drone once it has been compromised. The only thing SkyJack can dois trigger a hard-coded animation of the drone after which the control islost. Moreover, the real owner can reconnect to his drone a few secondsafter the beginning of SkyJack attack. It means, for instance, that he cantrigger a Return home order immediately after regaining control, this way,the SkyJack attack would become useless.3 DroneJackThis work presents DroneJack a complete anti-drone solution dedicatedto the prevention of unwanted drones flight over. DroneJack allows todetect, track, take over and control drones using WiFi communications. Itimplements deauthentication attacks to disconnect true users of multiple386 DroneJackdrones and prevents their reconnection. DroneJack is developped fromscratch and become an off-the-shelf component with a web interface thatpermits a defender to cope with multiple drones. DroneJack implementsvarious features as tracking the drone flight on a map, taking over thevideo stream produced by the drone, ordering the target drone to go-home, to kill himself or to go to specific GPS coordinates. Moreover, thenumber of attacks is not limited: the defender can install new featuressince DroneJack website accepts uploads of new attacks and installs themon all connected DroneJack instances.DroneJack is a mobile protection system composed of a collection ofRaspberry Pi 3 (DroneJack Probes) that have to be placed on the areato defend and a web server responsible of these Raspberry management.DroneJack is not limited by the number of DroneJack Probes, allowing itto cover an area as large as needed. Moreover, using the website interface,the operator does not have to be on site to manage threats. Figure 1 givesan overview of the global architecture of DroneJack.Fig. 1. DroneJack architectureDroneJack distinguishes 3 main phases in a successful attack on adrone: Detection/ Takeover / Attack performed on the drone. This sectiondescribes how the first two phases work and how they are synchronized inorder to have a continuous drone scanner.G. Fournier, P. Audren de Kerdrel, P. Cotret, V. Viet Triem Tong 387Phase 1.1: Detection The first step in WiFi based drone detection, isto know what to look for. In this study, we aim at discovering WiFiaccess points coming from drones. For that purpose, DroneJack relies(as SkyJack) on airodump-ng a complete suite of tools to assess WiFinetwork security. DroneJack monitors WiFi communication continuouslyand our WiFi scanner produces every 5 seconds a list of the surroundingaccess points. Detecting a drone in this list is as simple as checking if oneMAC address is owned by a drone Company. Fortunately, owned MACaddresses are public and can be found online. For instance, accordingto the IEEE Standards Association Registration Authority, Parrot ownsfive MAC address ranges. Once a drone has been detected, a semaphorereleases phase 2. As it can be seen in the following sub-sections, phase 2handles those drones sequentially. However, if a drone is being monitored(phase 3) and another one is found, then the second one is put in a waitingstate: the owner is disconnected and the drone hovers until the first dronehas been handled.Phase 1.2: Drone tracking Another interesting feature of phase 1 is adrone tracking system. Knowing a drone is trespassing is one thing, butbeing able to track it in real time is undeniably better.Using the RSSI (Received Strength Signal Indicator) of the beaconssent by the drone, each DroneJack node computes the distance to thedetected drone. Then, the DroneJack web interface centralizes all the dataand triangulates the drone position (provided that the GPS coordinatesof DroneJack nodes are known). Depending on how many DroneJacknodes detected the drone, the web interface draws a circle, which radius isthe distance in meter to the drone, or the accurate position of the drone(Figure 2). Once again, DroneJack uses a new thread to track each newlydetected drone.Phase 2: Takeover Once a drone has been detected, phase 2 is launched.This phase has 2 steps:1. First, DroneJack uses desauthentication packets to disconnect theowner from the drone. Those packets are sent continuously untilthe end of phase 3 using aireplay-ng. After this step, almost everycommercial drones hover in the sky waiting for their owner to reconnect.2. Then, DroneJack connects to the detected drone and releases phase 3.DroneJack can only connect to unsecured networks, but this concernsa lot of drone models: Parrot AR Drones and Bebop for instance. Incase the access point is secured with WPA, then DroneJack stops afterthe first step.388 DroneJackFig. 2. DroneJack website - mapThis work is a continuous protection system, which means that takingover a drone does not stop phase 1. Therefore, new drones can be detectedwhile others are already being handled. Here is how DroneJack takes careof this situation: the first detected drone is the first one to go throughphase 2 and 3, but as long as phase 3 is not completed on this drone, theother detected drones go only through the first step of phase 2. In otherwords, it means that each detected drone is disconnected from its ownerand therefore hovers peacefully until DroneJack is done with the previousones.4 Turning Drones into ZombiesOnce DroneJack has taken over a targeted drone, it gives the ability tothe defender to pilot the captured drone. A complete web interface hasbeen developed allowing the defender, wherever he might be, to controlthe drone with a video stream.Beyond that, the defender may have to cope with an attack of multipledrones at the same time. For that purpose, DroneJack phase 3 can beset to many other automated attacks. The three main behaviors alreadyadded are the following:1. The kill switch: Parrot Drones have an emergency button that imme-diately stops the rotors. With this attack set, DroneJack will simplyG. Fournier, P. Audren de Kerdrel, P. Cotret, V. Viet Triem Tong 389trigger this emergency procedure and all detected drones will fall likestones from the sky.2. Go Home: this attack simply sends the drone back to its home GPScoordinates. This is the least offensive defense of DroneJack.3. Go to GPS coordinates: this attack sends the drone to a set of GPScoordinates you previously set in each DroneJack configuration.Moreover, DroneJack offers the possibility to any developer to uploadhome-made attacks through the website. Versions and configurationsettings are automatically synchronized if DroneJack Probes are used in anetwork configuration. Following the requirements of DroneJack software,an operator can upload software coded with any programming languageexecutable by Kali Linux. As soon as the attack finishes, the output willbe uploaded to the website.We presented two custom attacks as an example of what can be donewith this feature:1. nmap scan: when this attack is triggered, DroneJack will perform afull nmap scan of the drone. Using this scan the operator can learnmore about the operating system of the drone as well as the servicesrunning, the open ports. . .2. Delete all recordings: when possible, this attack will delete all videorecordings on the drone. On Parrot drones for instance, this attack isquite simple as both AR Drones and Bebop drones run an open FTPserver from which you can delete any file you want.5 ConclusionDrone protection systems are bound to be a fast-growing field in thenext few years. With always more powerful performances, drones arebecoming a real security threat. Knowing that drone manufacturersare probably going to step up the security of their drones, there willbe a real need to defend critical sites, such as nuclear plants or otherhazardous industrial sites. In this article, we have proposed DroneJack acomplete anti-drone solution allowing a defender to prevent overflight of aspecific zone. DroneJack relies on its DroneJack Probes which monitorthe wireless communications and can track, takeover and control multipleforeign drones. DroneJack exploits as most as possible vulnerabilitiesof current commercial drones. It prove by example that widespreadcommercial UAV can escape to their legitimate user. In this context, itpermits to protect a sensitive area but, in another context, it may appearas a serious security flaw.390 DroneJackReferences1. Kelsey Atherton. Airbus introduces a system to jam drones out of the sky. http://www.popsci.com/airbus-wants-to-jam-drones-out-sky, January 2016.2. Kelsey Atherton. This device turns any gun into an anti-drone ray. http://www.popsci.com/dronedefender-is-an-anti-drone-rifle-attachment, Febru-ary 2016.3. Valour Consultancy. The future of commercial and industrial uavs. http://www.valourconsultancy.com/wp-content/uploads/2015/12/The-Future-of-Commercial-and-Industrial-UAVs-2016-Information-Brochure.pdf, August2016.4. DroneWatch. Dronewatch. https://www.droneshield.com/dronegun, January2015.5. Samy Kamkar. Skyjack. http://samy.pl/skyjack/, December 2013.6. LeMonde. Au total, 17 sites nucléaires ont été survolés par des dronesdepuis octobre. http://www.lemonde.fr/planete/article/2015/01/29/dix-sept-sites-nucleaires-ont-ete-survoles-par-des-drones-depuis-octobre_4565967_3244.html, January 2015.7. Bryan Lufkin. The anti-drone drone - a bigger, badder flying copter debutsto catch trespassers. https://www.scientificamerican.com/article/the-anti-drone-drone/, February 2016.8. Zeke Miller. Drone that crashed at white house was quadcopter. http://time.com/3682307/white-house-drone-crash/, January 2015.9. James Vincent. Dutch police are training eagles to take out drones. http://www.theverge.com/2016/2/1/10884586/drone-vs-eagle-dutch-police, Febru-ary 2016.

DroneJack: Kiss your drones goodbye!

https://hal.inria.fr/hal-01635125/file/SSTIC2017-Article-dronejack-fournier_cotret_audren-de-kerdrel_viet-triem-tong.pdf

DroneJack: Kiss your drones goodbye!

Abstract

Similar works

Full text

Available Versions

INRIA a CCSD electronic archive server