Parrot Drones Hijacking

Explore the intricate world of consumer drone architecture and security vulnerabilities in this RSA Conference talk. Delve into the communication protocols between pilots and drones, focusing on manual reverse engineering of binary protocols to identify and understand drone commands. Learn to assess the security of drone-pilot protocols, master new reverse engineering methodologies, and review best practices for securing drone environments. Gain insights into the evolution of Parrot drones, from AR.Drone to Bebop and Disco models, examining their operating systems, motherboards, and internal applications. Discover techniques for UDP data analysis, statistical analysis, and command coding using ARDroneSDK3. Investigate firmware update injection, packet injection automation, and methods for locating and hijacking drones. Apply this knowledge to enhance drone security and understand potential risks in the rapidly evolving field of consumer drone technology.

Intro
About this presentation
About responsible disclosure
A little bit of background: AR.Drone
A little bit of background: hacking AR.Drone
Bebop drone: a new hope
Bebop drone: the O.S.
Bebop drone: the motherboard
Bebop drone: apps inside the O.S.
The pilot: "FreeFlight3"
Bebop drone: UDP data analysis
Bebop drone: statistical analysis
Bebop drone: linux client
ARDroneSDK3: commands coding
San Francisco, november 2015, Parrot announces the Bebop 2
Bebop2 vs Bebop
Las Vegas 2016, Parrot announces Disco
Disco: the motherboard
ARDroneSDK3: Disco, Bebop & Jumping
Drones and boards
This is NOT all about manual flight mode (ii)
Firmware update injection
Packet injection automation
Part III
Locating drones (ii)
SFA parrot drones
Drone hijack process
Apply