Slashdot Mirror
Glaring Vulnerabilities Make Many Commercial Drones 'Insecure by Design' (threatpost.com)
Slashdot reader msm1267 quotes ThreatPost:
Drones, many readily available on ecommerce shops such as Amazon, are plagued by vulnerabilities that could give attackers full root access, read or delete files, or crash the device. The United States Computer Emergency Readiness Team (US-CERT) published a warning about one model, the DBPOWER U818A WiFi quadcopter, last month, but according to the researcher who reported the vulnerabilities, multiple drone models -- manufactured by the same company but sold under different names -- are also vulnerable.
They contain two appealing attack vectors: an open access point and a misconfigured FTP server. If an attacker was within WiFi range of the drone they could easily obtain read and write permissions to the drone's filesystem and modify its root password... Like any attack dependent on Wi-Fi, an attacker would need to be in close proximity to the drone to carry out an attack, but an attacker could connect their computer to the drone access point, essentially treating it as a proxy to spy on the device's live feed or the drone's open ports.
They contain two appealing attack vectors: an open access point and a misconfigured FTP server. If an attacker was within WiFi range of the drone they could easily obtain read and write permissions to the drone's filesystem and modify its root password... Like any attack dependent on Wi-Fi, an attacker would need to be in close proximity to the drone to carry out an attack, but an attacker could connect their computer to the drone access point, essentially treating it as a proxy to spy on the device's live feed or the drone's open ports.
Nothing about commercial drones is safe. They've been designed by people who don't give a shit about safety, are unaware of aviation, and don't give a shit if they hurt someone. Nothing says capitalism like throwing away a hundred years of aviation safety research.
TFA makes a big deal about vulnerabilities in 'commercial' UAVs but then goes on about obtaining root in an obvious 'toy' quadcopter. Not the $60,000 big boys that might be fun (or lucrative) to steal or, more threateningly, drop on somebody's head. A half kilogram plastic thing that might poke your eye out if you tried hard enough.
Hell, I (and a whole bunch of others) would love for somebody to root the DJI quads. Then we can get rid of some of the more recent 'improvements' in the firmware.
Really, I'm not seeing this. Somebody pops the innards of a cheap, Chinese toy.
Woot!
Faster! Faster! Faster would be better!
I appreciate that there are certain mission critical systems where security is paramount and lives are at steak... but this is certainly not one of them. Simply put, nobody is going to waste the time an energy to exploit this whole for no reason other than because it's there. These are just reasearchers trying to issue random alerts about every little thing to try to justify their budget. In reality all their doing is scaring people and numbing people to the fact that other, more important systems have attack vectors that do need attention.
The Internet of Shit has been known to be insecure for a long time. Now there are people bricking these shitty devices which I do not object to because it's only possible due to neglect by the device maker.
Anons need not reply. Questions end with a question mark.
You are all tasty cows. Moo! say the tasty coys...MOOOO!
A car with a speed of 320 km/h, an engine of 500 hp, and a weight of 3 tons is potentially much more dangerous than a tiny drone, isn't it? Still basically anyone can buy and drive a car.
An 80 dollar shitty toy that no one gives a fuck about. Fuck off slashdot.
How else do you allow updates to the system without root access?
Someone evidently saw this talk and decided to try it at home. These vulnerabilities have been public for a couple years now.
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
Even if it's just "toy" drones in question, laws are written in many countries now with strict liability for the operators of the drones, on the primary assumption that they are the only ones using the drone, and are therefore liable for any accidents or breaches of the law caused by drone operation.
As a drone operator, even if the drone isn't a danger to others, you'd have to be worried that someone who doesn't want you operating the drone nearby, or perhaps has commercial reasons for attacking your fleet, might use this to cause you harm - kind of like "SWATting" but on a different level.
And, of course, people think wifi is close-range, but with the right antenna, tens of kilometers is quite possible to access wifi -
So this does represent a significant threat - though perhaps not so much to the general public.