Time to get Serious About Drone Security

June 17, 2016

By Ernest Worthman

Executive Editor
AGL Small Cell Magazine

June 23, 2016 — If one talks to Google, you find out very quickly that they are vetted in using drones for a number of reasons. They are not the only ones. Drones are expected to play an increasing role in 5G. They are already being trialed in LTE tests and other trials with wireless operators and their vendors. Drones are also becoming popular choice to remotely check on the condition of towers.

All this raises the ante when it comes to security. Inherently, there is no security coded into commercial drone controllers. This was recently brought to light when researchers at Johns Hopkins University demonstrated how they could use a laptop to easily take down a commercially available drone.

They simply bombarded the drone with thousands of processing requests causing the processor to be overwhelmed and have a stroke. In this case, the drone simply crashed.

But ratchet that up a notch. Commercial drone technology isn’t confidential. As commercial products, the components are easily identified and obtained. So far, security hasn’t been much of a problem, but extrapolate that to some more sensitive scenarios, such as terrorist concerns and, all of a sudden, it moves to the center of the radar screen. From taking control of a drone to steal someone’s credit card data and pin at an automated teller, to causing the drone to crash into a structure to actually using it to spy on someone or something are all real possibilities.

As with most consumer tech devices, security simply isn’t a real concern with them. Security is just more overhead on the G&A and usually not budgeted for. That makes them extremely vulnerable to hackers. As expected, when the researchers described their drone exploit findings in a Vulnerability Disclosure Package and sent it earlier this year to the maker of the drone that was tested, the company did not respond. The researchers found at least three points that were actually vulnerable, and in a way that they could actually build exploits for.

With all the security lessons we have learned in the last few years, one would think that the drone manufacturers would be much more in tune with security in their products. But I guess it will take some sort of crisis before they, begrudgingly, decide to add some security.