Slashdot Mirror
GPS Spoofing Attack Hacks Drones
Rambo Tribble writes "The BBC is reporting that researchers from the University of Texas at Austin managed to hack an experimental drone by spoofing GPS signals. Theoretically, this would allow the hackers to direct the drone to coordinates of their choosing. 'The spoofed drone used an unencrypted GPS signal, which is normally used by civilian planes, says Noel Sharkey, co-founder of the International Committee for Robot Arms Control. "It's easy to spoof an unencrypted drone. Anybody technically skilled could do this - it would cost them some £700 for the equipment and that's it," he told BBC News. "It's very dangerous - if a drone is being directed somewhere using its GPS, [a spoofer] can make it think it's somewhere else and make it crash into a building, or crash somewhere else, or just steal it and fill it with explosives and direct somewhere. But the big worry is — it also means that it wouldn't be too hard for [a very skilled person] to work out how to un-encrypt military drones and spoof them, and that could be extremely dangerous because they could turn them on the wrong people."
IRL?
Why is this surprising? Thought that's how the military one was captured a little while ago...
Thanks a whole bunch, Treyarch, way to give the terrorists awesome ideas. Maybe next time make a game called Rainbow Factory: Gumdrop River 2 and we don't have to cower in fear everywhere we go ^ ^,
That's how they brought down that blended-wing-body drone a while back.
"When information is power, privacy is freedom" - Jah-Wren Ryel
So yes you can fool a civilian drone or airliner this way (but they have access to other navigation technologies like marker beacons). But it won't work on military systems.
I wonder if we'll ever have a civilian system using an encrypted public/private key system where the public key is distributed to all equipment manufacturers?
isn't that exactly how Iran caught that US drone a few months ago?
google...
tada:
http://news.slashdot.org/story/11/12/15/2013249/us-sentinel-drone-fooled-into-landing-with-gps-spoofing
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Like, 6 months ago? If I remember it was a proper predator 2, even, not some experimental prototype.
Also, use it on the wrong people? I would imagine those getting fired at with hellfire missels from unknown planes silently circling and spying with robotic eyes would think, "gee, THOSE guys are the 'wrong people'"
It's difficult but not really all that difficult relatively speaking to slap an encrypted GPS transmitter on a weather or spy satellite. Since another slashdot article says we're running low on Earth-monitoring satellites for weather and stuff, the government always wants more spy satellites, and now they need an expanded encrypted GPS network, they could possibly justify launching a do-it-all satellite for cheaper than 3 separate ones. I believe cost was the reason all 3 of those haven't been launched much lately.
Is anyone else troubled that civilian planes use unencrypted GPS and are therefore susceptible to spoofing?
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
Drone's URL, USB key-stick, log-in and password theoretically can be bought.
Certainly, we entertain an idea that there are no traitors, who sell information for money, but it happened before.
Drones raining death from the sky shouldn't be killing *any* people.
See title.
This is plane wrong. One of the drones sends the video stream back unecrypted and it was a large issues quite recently. Also all GPS signals are unencrypted. How people took this long to realize it is beyond me. I knew this was possible back in high-school I just didn't realize it would be so cheap to do.
It's not that all drones are used on the right people nowadays.
Here's a paper on this from 2002.
All they did was purchase a commercial GPS simulator, which is used by companies to develop their GPS receivers and is easily attainable. They just connect an antenna to the simulator and beam it at the direction of a GPS receiver, jam the receiver so it loses current lock, and then it'll be spoofed once it locks onto your antenna. I always thought you needed to do some super complicated math and use multiple sources since GPS relies on careful timing information to get position, but the commercial simulator handles it all for you.
Why not? It's not like they have a fundamental disability.
it also means that it wouldn't be too hard for [a very skilled person] to work out how to un-encrypt military drones and spoof them
Jam? Sure. But one of the reasons millitary grade hardware is so expensive redundant systems, take one out, you can still function. In this case, very good interial navigation systems.
But "not very hard" to break military grade encryption on something as vital as the defense channel from GPS satellites... if that's easy we've got bigger problems than rogue drones. They're not using WEP, after all.
Cheap assed weapons, built by lowest cost contractors, flown by kids who are probably on low pay, and in an enviroment that pandering to the lowest user operations. They already changed from Windows to Linux due to malware/virus infestation.
None of any of it is impressive. I think any serious nation state, or indeed well padded grouping could probably dig for some extended time and develop counters and counter operations against drome based operations.
And I suspect that somewhere in the drone ops, there are radio or systems that are actually very old, and have major flaws, and there will be aspects of the drone be it GPS or otherwise that are achillies heels.
That and the fact that someone one day will realise that a real airforce with real aircraft kill capacity would eliminate drone fleets on an industrial scale. Especially in 5-10 years when 'clever' Generals and Politicians have concluded that they can do away with airforces almost totally and just have a bunch of drones.
Everything in warfare is the established case of counter, then counter again.
We`re all equal
This is plane wrong. One of the drones sends the video stream back unecrypted and it was a large issues quite recently. Also all GPS signals are unencrypted. How people took this long to realize it is beyond me. I knew this was possible back in high-school I just didn't realize it would be so cheap to do.
No, the drone sent a video signal to the ground unencrypted (it was intended to be visible to troops, and was presumably unencrypted to allow ease of viewing. Stupid, yes, but it makes a kind of sense). And military GPS signals are encrypted, specifically to prevent spoofing. The P-code the military GPS system uses is encrypted, and has been for years.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
shhhh, that's why the cancelled The Lone Gunman" series.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
FTFA:
Todd Humphreys and his colleagues from the Radionavigation Lab at the University of Texas at Austin hacked the GPS system of a drone belonging to the university...They demonstrated the technique to DHS officials, using a mini helicopter drone
So they were able to take control of their own model helicopter. And they hypothesize that IF they could break the encryption of a military drone they could do the same thing. But that's a huge IF.
It didn't happen in Iran, several drones have crashed in Afghanistan and Pakistan, and I assume several more have crashed in the US. Without a pilot onboard a fairly minor electronic or mechanical problem will bring them down.
This would only work if the drone was using only GPS to fly from place to place. Most drones have a pilot who direct them most of the time and uses GPS to find it's location. A pilot would notice the discrepancy between what the GPS plot shows and what he sees in the camera monitor and assume the GPS screwed up.
This next statement is just stupid;
But the big worry is — it also means that it wouldn't be too hard for [a very skilled person] to work out how to un-encrypt military drones and spoof them, and that could be extremely dangerous because they could turn them on the wrong people."
The way the current system probably works is that it transmits signals similar to the ones from the satellites. To spoof an encrypted drone one can not "unencrypt" it. That would be equivalent to convincing the drone to accept un-encrypted GPS signals. That should be impossible. If someone could send out false data that is encrypted using the same keys and algorithms as the satellites that would ba a major issue as cruise missiles could be spoofed. That kind of spoofing is not something that can be done by "a very skilled person" as it would require knowing the encryption keys.
The following statement is also bunk;
The same method may have been used to bring down a US drone in Iran in 2011.
One can speculate all one wants but that does not make it true. It is much more likely that the drone lost contact with the pilot center and auto landed. Lets use a real life unverifiable incident to support our FUD.
They also talk about hijacking drones delivering FedEx packages. Fred Smith, CEO of Fed Ex says he wants them but he is nowhere near getting them. Even if they did use drones I bet Fed EX would use the encrypted channel and they would rely on navigation aid other than GPS as verification.. If you want to scare us at least talk about something real.
We have plenty of real things to worry about rather than to fall for FUD.
I certainly don't see how the skills necessary to broadcast a spoofed GPS signal relate to cracking the encryption of the military GPS. Also, inertial information can be used. The original post about the drone in Iran talks about this a lot:
http://news.slashdot.org/story/11/12/15/2013249/us-sentinel-drone-fooled-into-landing-with-gps-spoofing
This seems a little sensationalist.
That WHHHHHOOOOOOOOSSSSSHHHH you just heard was the sound of a hijacked drone making a low pass before unleashing a hellfire missile to recalibrate your sarcasm detector.
BAE Systems is developing a navigation system that uses "signals of opportunity" Wired has an article describing the system: http://www.wired.co.uk/news/archive/2012-06/29/bae-gps
Clearly, the solution is to arrest and prosecute the researchers and pretend that this isn't a giant security hole. That way, the company's profits will still be protected and they won't have to spend more R&D money on fixing the problem.
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
We have no reason to believe encrypted GPS signals can be decrypted easily, but that doesn't mean they can't be spoofed.
You can record them and play them on a delay of your choosing (with higher local signal strength)
Since GPS positioning is all about the relative delay if you control the delay you don't need to decrypt the signal of create your own.
The comments also mentioned their is a pilot normally in control of the drone,
but since the pilot is connecting remotely the control signal can theoretically be jammed, at which point the drone will normally
try to assume a predefined course.
Obviously there are technical difficulties, but one theory is that this is exactly what the Iranians did to the US drone a while back.
There are countermeasures available but this is a very real threat.
Encryption doesn't prevent spoofing. When people who thinks it does are involved with designing cryptographic systems we end up with insecure systems that are broken the first time somebody knowledgeable looks at it.
You can add message-authentication-codes or digital signatures to your data. That will ensure the data is authentic, but it won't stop replay attacks.
If you replay the authentic signals a little bit delayed and with a little bit more power than the authentic signal, you can throw off the navigation even without knowing the actual meaning of the signal.
To protect against that sort of attack, you are going to need a challenge response protocol. The receive will need to send a signal to the satellite, and the satellite will need to respond. The roundtrip time will give the receiver a maximum distance between itself and the satellite. With a few such maximum distances the position can be narrowed down.
Do you care about the security of your wireless mouse?
Anyone else remember the story of the Iranian concrete from a while back? Read about how much it blew away the competition at a concrete strength contest and brought the issue to light. 50-60k PSI concrete failure strength is just insane.
Rock Us, Dukakis.
The civilian signal signal has the ability to use selective availability . It is turned off right now but can be turned on at any time and has in times of war to deny GPS information to the enemy. The military channel is also transmitted as accurate as possible but is not available to civilians because it is encrypted.
Yes, it does prevent spoofing. How do you send a valid, encrypted signal if you don't have the encryption key? This isn't like public-key encryption where anyone can generate a valid signal: if the encryption key itself is secret, you can't either encrypt or decrypt the signal without knowing it, and that does prevent spoofing. You can jam the signal, sure, but not spoof it. For reference, the source P-code, which is encrypted with the W-code (the details of which are secret) is 720 gigabytes long, and only replays once a week or so (each satellite has it's own P-code). The W-code is significantly smaller, but probably still long enough that brute-forcing it is impossible. A replay attack is impossible, as long as the W-code and the P-code are not in sync (i.e. the encrypted Y-code doesn't repeat, which it doesn't). The result is that the encrypted signal is little better than noise to an observer: you can't fake it.
The only problem with the current system is that you can't always use the encrypted system alone (you have to lock on to the unencrypted signal first). The modernization of the GPS system is looking to fix that problem, too.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
This is why we need to remove Critical Thinking subjects from our educational curriculum. If nobody could figure out how to break or fool weak encryption, these sorts of devices could be much less expensive to produce and operate.
I'm a UAV guy but not much of an RF guy. Anybody know what chance there is to selectively jam one band while letting the other band pass? I don't think it's very likely, so slim chance of jamming P/Y code to spoof the C/A fallback (if it's being used at all). Frankly, I wouldn't use CA fallback anyways if I suspect jamming. I'd look at my residuals (dead reckoning navigation errors) and try to head towards my pre-defined return home point. Which brings me to my next point.
If you want it to use the return-home function that results from a lost datalink you need to jam the datalink. And that's still not a landing instruction, just a safe point to fly to in order to reacquire, so spoofing to return-home is unlikely to give you an intact drone.
To actually command a landing at a certain spot you need to know which coordinate to spoof your GPS towards, which implies that you unencrypted the datalink AND know its packet structure to interrogate, if not redefine, the recovery point, which is pre-programmed during pre-flight checklist and not casually redefined during normal operations.
In my professional opinion, all this adds up to a high improbability of Iran deliberately bringing down that drone. Unless some incompetent decided to use an unencrypted GPS receiver and datalink on one of the most valuable assets in the inventory. Then I'd have them fired. Out of a cannon.
"Now, I doubt any of you would prefer a rolled up newspaper as a weapon against a dictator or a criminal intruder."
Why would you not have some sort of self redact function to fix the problem of a drone going down in hostile territory??
All you really have to do is program the drone to Explode/Thermite the electronics bay if it reaches Zero Velocity without some sort of HomeBase signal being received (rotate the exact signal on a weekly basis)
or even put some sort of DeadMan switch in the electronics bay that you have to open another panel (and insert a SafeKey) to disable.
Any person using FTFY or editing my postings agrees to a US$50.00 charge
if your signal is vulnerable to a replay attack, then you designed your protocol wrong.
i recently developed a wireless communication protocol for a project i was working on, you could record and replay the encrypted signals all you want, and it would reject the replayed signal as invalid. you could take it a bit further and if it detects a lot of replayed signals it could alert you that someone is being nefarious.
simplest solution i can think of...send a timestamp as part of the signal...that time code should always increase, if it doesn't you know something isn't right with the signal and someone is trying to replay it...and if i recall correctly the GPS signal basically is a timestamp...so just do some validation to make sure it always increases, you can even compare it to your internal clock to ensure it increased by the expected amount. **unless you built a time machine
Iran bragged about doing this to the US's drone months ago. *Yawn*
Am I supposed to be impressed? What drone was it? Why no pictures or any information other than the university owned the UAV. For all I know their "drone" is just a model airplane project a student jury rigged using a cellphone.
Just to be safe lets go with military drone images on all of these web sites parroting the same story and mention someone from DHS was present as well. What does that matter?
Was the drone using raim? Did it use other sensors like fluxgates, rlgs to confirm position? Is ANY useful information available?
I would say that a low cost spoofing solution should be easy to detect by a half decent drone design even when you don't use encrypted position codes (which would be unlikely). For a start, a signal that was stronger from below the horizon than in the air are not trustworthy, after all, what obstacles are above a drone? Any signal that causes extreme difficulty in the equations that resolve an accurate space and time fix converging can be marked as untrustworthy too. Also any space and time fix that doesn't also correlate with the inertial guidance can be marked as untrustworthy(with modern mems technology, who wouldn't have this on board ?).
The new GPS satellites no longer have Selective Availability capabilities, or so the government claims (and I have no reason to disbelieve them on this subject).
Considering that GPS is widely relied upon for aviation, land, and marine navigation, surveying, public safety, and precision timekeeping, I suspect that it would be very unlikely for the government to turn SA or otherwise degrade the accuracy of GPS.
Portuguese and british were masters of Ded (deduced) reckoning much before the term was even invented. Humans can do that. Why computers can't?
Is there a right people to turn the drone on?
The problem with the ever-increasing timestamp concept is that it doesn't account for multi-path issues. I thinks the GP's idea of replay is to do it quick enough that it looks like a stronger multi-path version of the signal. However, there are two problems with that I see. 1. Without being able to decrypt the original message and encrypt a new one, I don't see how one would do the replay with any use. 2. Even if you did have the ability to decrypt and encrypt, it would take far too long to do all that an re-transmit in time to fit in the multi-path search window. GP said you could do this without knowing the actual meaning of the signal. I'm not sure what that would accomplish other than either amplifying the signal, or jamming it.
This is plane wrong.
ROFL! Oh...you mean that wasn't supposed to be a pun? :P
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
I'm pretty positive this drone wasn't using very many advanced algorithms. I mean, in the base case, you could easily spoof the unencrypted signal and try to force the drone to change directions. Unfortunately, this really only works when you're using Pseudorange measurements, as opposed to Carrier Phase. Moreover, if there was an INS on the drone as well, this interference problem would become rather trivial.
When using a GPS, if you notice large gaps where your data suddenly "jumps" from one location to another, it tends to be due to poor satellite geometry, i.e.: you have a cycle slip and you need to reconnect to the satellite and estimate the carrier ambiguity again before you can continue to use that satellite's measurements. Of course, this sort of thing is only detectable if you use Carrier Phase measurements, because Pseudorange can have an expected error of +/-10 metres. Now, suppose you're using Carrier Phase to detect cycle slips, and somebody manages to still spoof the signal. With an INS on board, you can still detect the direction of travel, as well as the acceleration at which you are traveling. If your INS does not agree with your GPS, then it would be assumed that the GPS is erroneous, and thus to ignore it until it starts agreeing again. There should be next to no excuse for somebody to take over a drone other than a mechanical malfunction or shoddy software.
Lastly, the idea that the military channel (aka P-code / encrypted channel) could easily be spoofed is ridiculous. GPS gives updates for satellite position approximately every 2 hours, if I remember correctly. That means you could effectively update the keys for the encryption every 2 hours, if you were so inclined. On top of that, the bandwidth of the P-code is much higher, and when interference/multipath/noise/spoofed signals try to mess with that, they end up having a far smaller effect on the signal than is given to consumer / civilian channels. Overall, the P-code is really hard to break, since encryption roll over can update very frequently, and noise and other interference can be mitigated quite well. It should also be noted that military based systems use very expensive receivers, often ones that don't track weak signals (that are more easily spoofed) and ones that can track multiple frequencies (L1, L2, L5, L1C, L2C, P-code) as well as multiple systems (GLONASS, GPS, Beidou/Compass, and more). Quite frankly, it's too expensive and too difficult to spoof that many signals and systems, since GLONASS runs on completely different frequencies, and doesn't even use the same type of signals (Amplitude Modulated GPS vs Frequency Modulated GLONASS). Overall, this article is FUD, and shows that the writer doesn't know jack lanterns about GPS.
People need to understand that just because is high-tech doesn't mean that there's an easy or brute-force countermeasure. People were actually hacking into drone feeds not too long ago, so I'm not really surprised. And it could be the shiniest drone ever, but it only takes one exploitable security flaw ( because someone was lazy or incompetent or rushed to deliver on schedule) to compromise it.
Yeah you could spoof the altitude by +1000 ft, so when the drone came in for a landing it would crash into the ground instead. (But make sure your operation is well hidden in a farmhouse somewhere bordering the airport.)
With GPS the exact timing of the message is critical as that is how it calculates its position. i suppose if you could retransmit the encrypted message on an extremely short delay and get it to accept your signal because it is the strongest one, you probably could introduce an error into its position calculation, and continuing to do this over time eventually cause it to go off-course.
that might be a bit difficult to protect against seeing that gps (at least for civilians) is one way communication. it seems even with a challenge/response such as the ggp mentioned, if the enemy can delay the signal by even a fraction of a second, by retransmitting a stronger version, it could throw off the gps calculations. This may even be worse than having it be jammed.
I suppose that's why inertial navigation is such a good backup for any sane person who is going to design a military drone.
It's useless to spoof the GPS signal unless you know, apriori, where the drone is going. Lying to it about where it is is only useful if you lie to it relative to its destination, unless you are trying to lie it into a target very near the jamming signal source.
The Iranian spoof worked because the self destruct wasn't armed, and when jammed, the drone was known to be programmed to return to its launch site, which was a known location, and THAT location could be spoofed.
I imagine that there were a number of experiments in jamming to see what the behaviour of the drone would be when its communications were jammed, and the first several probably had armed self destructs and just blew themselves up. Given that these things are somewhat expensive, they probably stopped arming the destruct, which prevented the jamming from being used as a remote "blow the drone up" trigger. And then after a couple of them returned to base, and it became SOP to not arm the self destruct, the spoofing started, resulting in the drone capture.
As was pointed out here this was not a military drone. Until they can spoof p(y) code, this is nothing. For just this reason, all military equipment is required to use an encrypted signal (of course, this was as of 10 years ago, when I was still working with military GPS systems)- civilian GPS can be pretty easily jammed and/or spoofed- "civilian" GPS is also called "C/A" or coarse acquisition- which was designed only to get you "about right" before the receiver switches over to the more precise encrypted code. Anti-spoofing is a very important part of true military grade GPS. Many civilian users (surveying companies, particularly) would pay *big* money to get access to this- but they don't get the keys.
I think this article should be more accurately titled "Texas college hacks insecurely designed civilian drone"
An ounce of fact is worth many tonnes of theory.
The facts as we know them:
1. Drones were unquestionably being flown over the area.
2. The US stated that the drone could not have crashed or shot down as photographs suggested it was highly intact, attempting to falsify the claim on that basis.
3. It would be possible to force the drone to land if it did not use INS but used unencrypted GPS
Note that I do not include the Iranians actually capturing a US military drone as a fact. It is not. It is a claim. It might have been a mock-up (as the US claimed) or it could have been a civilian drone of similar type run by one of the many militant and terrorist groups in the region - the US has been known to sell arms to Iranian groups in the past, so cannot be assumed to have not sold "civilian" drones in the present.
Nor do I include the US using encrypted GPS as a fact - it is not. It is also a claim, the US is very good at overstating such arguments. Groups such as SPAWAR do get exemption certificates for not complying with standards from time to time, so although such a standard may be in place, it requires one piece of paper in some dusty filing cabinet to render it ineffective.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
generating realistic GPS signals is easy.. a few dozen lines of matlab code. Generating GPS signals that are consistent with the UAVs motion is much trickier. You need to transmit a signal to the drone that shows up with the correct relative time offsets from the satellites. OK, so you get your GPS simulator (cheap.. 1 bit playback from FPGA does it).. synthesize all the satellites with the correct timing for the "spoof" position.. transmit it with a high power transmitter and directional antenna, so it shows up at the drone's receiver with at least 10, but preferably 100 times the power from the real satellites (recall that the GPS antenna is facing up, so you need a fair amount of power, if you're 100 km away). Still not really a challenge.
Then, you need to fool the drone's flight computer into ignoring the real GPS and reacquiring on yours. It's very hard to "match signals", so your best strategy is to jam the real signal (same transmitter and antenna) forcing it to drop lock, then put your signal in, so it picks it up. Of course, any decent autopilot/nav software is going to be checking the GPS signal after reacquisition to make sure it's "reasonable", so it has to match position and velocity fairly well. Then, you can carefully walk the spoofed signal off (making sure that it remains consistent with the Inertial data from the IMU and the air data from pitot probe and altimeter). It's not entirely clear how you would, for instance, generate a varying set of GPS signals to make the drone fly in a different direction, since it has a magnetic compass. You'd have to fool it into thinking that there's a strong cross wind or something.
This is all very non trivial.
Jamming easy.. Sending GPS signals easy. Figuring out what those GPS signals should look like? real hard.. especially in real time.
it sure would be tragic if someone re-pointed one of these things as a drone command center...
Some were suspecting that was how Iran got one of our drones.
How long before we get a Tomorrow Never Dies-like situation? One would hope that the military models' encryption is sufficiently hardened, but given the security records of pretty much every company out there...
Fear the penguin.
Look up malleability. There are plenty of papers on the subject.
Do you care about the security of your wireless mouse?
Exactly.
The point is that the receiver knows what roundtrip time it got. The adversary can only delay the signal, not speed it up. So the receiver will know that it is within a ball of a certain radius around the satellite. That's a huge ball, several times larger than the Earth. However by having this done against multiple satellites means you'll know your position to be within the overlap between multiple such balls. If you combine that with a somewhat reliable measurement of altitude based on air pressure, you can narrow down the position. And most importantly, you will know how accurate the position is. An attacker can then only make the measurements less accurate, effectively the same as jamming the signal altogether.
The reason the adversary can only delay the signal is that the legitimate signal would take the fastest possible path. It is not physically possible to send the signal faster than c. If the legitimate signal had not been radiowaves but for example photons in an optic fibre, then speeding up the signal would be possible to an adversary. Some of the suggestions on how to attack flawed quantum crypto hardware involves using a line of sight radio link to speed up the signal in order to compensate for the latency introduced by the eavesdropping.
Do you care about the security of your wireless mouse?
Serious business! ;-)
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Oh right.. budget cuts.
A$$holes.
Would be prudent to have a inertial navigation system to fall back on when its determined the gps data is junk, just like on the big jets...
Absolute rubbish. Just because in the movies it takes 5 minutes, doesn't mean it really is possible, even with 100 supercomputers running for a lifetime.
It takes more than just having a "very skilled" person to break encryption.
crash into a building? That's a bit outrageous. I don't know of any drone that uses GPS for obstacle avoidance.
Just imagine some patriotic Pakistani able to spoof a USA War machine drone filled with explosives aimed at innocent villagers going peacefully about their lives and revert it into some landmark building in the USA.
Wonderfully poetic justice.