Recent years have seen a significant increase in the use of unmanned aerial vehicles (UAVs) across a wide range of industries, from agriculture to law enforcement. While UAVs offer numerous benefits, including cost savings, improved safety, and greater efficiency, their increased use has also made them a target for cyberattacks. Now, new research from cybersecurity firm IOActive has found that drones may be vulnerable to electromagnetic fault injection (EMFI) attacks, which could compromise their systems and control.
Regarding IOActive
IOActive is a Seattle-based cybersecurity research and assessment company that specializes in identifying vulnerabilities and helping organizations enhance their security posture.
EMI Attacks Explained
Despite the many security measures in place, UAVs are still vulnerable to a range of cyber attacks, including sophisticated hacking techniques. One such method is EMFI attacks, which involve using a strong electromagnetic field to cause temporary or permanent changes in a chip. These attacks can be used to disrupt normal operations, change stored data, or execute malicious code, among other things.
To illustrate the potential impact of EMFI attacks, IOActive conducted tests on a DJI Mavic Pro drone. DJI is one of the leading manufacturers of drones, and its products are popular among hobbyists and professionals alike. DJI’s drones feature signed and encrypted firmware, secure boot, and a trusted execution environment (TEE), all of which are designed to prevent unauthorized access.
Results of the experiments
During the tests, IOActive researchers injected a specific electromagnetic glitch at a particular time during the firmware update process. They found that this could enable an attacker to execute arbitrary code on the drone’s main processor, potentially taking control of the vehicle. While memory corruption had been previously proven to exist, this new result is more troubling, as it could enable an attacker to gain full control over the drone.
Further development of the exploit
Although IOActive researchers were able to prove that such attacks were possible to carry out, they have yet to develop a fully working exploit that could give attackers full control of the drone. However, the potential for such an attack is significant and it remains a major concern for drone manufacturers and users alike.
Implications for drone security
The goal of IOActive’s research was to highlight the potential new attack surface that could be used in the future by threat actors. EMFI attacks, if successful on drones, can be used to disrupt normal operations, communication links, or even take control of the drone. Therefore, the researchers recommend that drone manufacturers work to implement both hardware and software countermeasures for EMFI attacks to ensure that their products remain secure.
The wider scope of the EMFI method
While IOActive’s experiments focused on DJI drones, the EMFI attack method could be used against any type of drone. Therefore, it is essential that drone manufacturers and users are aware of the risks and take appropriate measures to protect their systems.
In the light of the research, SecurityWeek reached out to DJI to inquire if the company was planning on adding EMFI protections to its drones. At the time of publication, DJI had not responded to the request for a comment.
As drones become more ubiquitous, the need for robust cybersecurity measures becomes increasingly critical. As shown by IOActive’s research, drones are not immune to EMFI attacks, and drone manufacturers and users must take proactive steps to protect their systems and data. The threat of cyber attacks on drones is real, and the stakes are high due to the multiple applications of drones across various industries. Therefore, organizations must continue to invest in ongoing research, analysis, and development of reliable cybersecurity measures that address emerging threats.