And companies should make them more secure before they are more commonplace
Soon, you might have to worry about a hungry hacker
stealing your drone-delivered pizza and delivering it to himself. New
research shows that some unmanned aerial vehicles are almost as easy to
hack as they are to fly.
Hobbyists and corporations alike are
excited about drones, and their popularity has exploded—the Federal
Aviation Administration estimates that 2.5 million of them will be sold in 2016 and last week Walmart announced it might soon use flying drones in its distribution centers. But researchers at Johns Hopkins
feared that, like with many new connected gadgets and appliances, a
rushed production schedule didn’t include the implementation
of proper technological safeguards.
To see how vulnerable drones can be, two
cyber security experts, along with five masters students, attempted to
hack and crash a quadcopter. The researchers tried three different
attacks on a Parrot Bebop, a popular video-recording drone that retails for
$350. In the first test, they bombarded the system with requests to
take over its command, eventually causing the system to shut down and
the drone to fall to the ground. In the second, the students sent a
large packet of data to the drone, which overwhelmed its system and
again caused a crash. In the final technique, the researchers programmed
their computer to impersonate the drone itself. The controller severed
its connection with the real drone, which then made an emergency
landing.
But hobbyists, too, should be wary. “The
fear for the average user is that pictures and videos taken by drones
could be stolen, the drone itself could be hacked and stolen, or the
drone could be hacked and hijacked and used as a weapon to injure a
crowd, either from it falling from a high elevation or from the rotors
causing bodily harm,” Lanier Watkins, a research scientist specializing
in information security at Johns Hopkins and one of the scientists
behind the project, told Vocativ in an email.
For flaws this big, security updates to
existing software probably won’t help, according to Watson. Ideally,
drone software would be more immune to hacks when it leaves the
factory. Average users are more at the mercy of
drone manufacturers to make sure that their systems can’t be hacked. But
companies considering using drones can start the trend towards
requiring stronger security for all kinds of drones. Watkins has a few
recommendations for these companies to minimize the risk of drone hacks.
First, companies should require their drone vendors to conduct security
testing before selling the drone to them, he says.
Companies that are particularly wary can
employ “white hat” hackers—those who can hack systems in order to reveal
security flaws, not to steal information—to be more certain that their
drones are as hack-proof as possible.
The John Hopkins researchers recently began testing higher-priced drones for vulnerabilities. They hope that their work will be a wake-up call to drone manufacturers, companies that use drones, and hobbyists.
So far, they don’t seem to be having much success. Earlier
in the year, the team alerted Parrot of their findings, in accordance
with university policy. The company has yet to respond.
