Drone Threat Intel Report: DroneSec Notify #48
This summary has been extracted from our weekly public threat intelligence report. For more information on the platform or weekly email PDFs, please visit: dronesec.com/pages/notify or email us at [email protected] or join the slack group at dronesec.slack.com
This week, DroneSec is included in the cyber and data security section of the threat intel report. At the AISA 2020 and World of Drones and Robotics Congress 2020 conferences, we announce some major cyber-security vulnerabilities, issues and misconfigurations specifically affecting the drone, UTM and C-UAS space.
Over the past year several security findings were observed by our threat intel analysts but not disclosed in these reports. Instead, they were guided through remediation within client engagements, responsible disclosure process, bug bounty programs or through government agencies. As a result, we’ve summarised (and anonymised) some of the highest impact findings of what we’ve observed to share these with the public. Currently, a large part of the unmanned ecosystem is vulnerable to information leakage, fleet takeovers and even in some cases, remote disabling of Counter-Drone systems.
In the coming weeks, we’ll be releasing more specific guidance to vendors, developers and operators in order to better protect their systems against the specific vulnerabilities we have identified. In the meantime, the presentation will be available in the form of a write-up when the conferences come to a close.
On to the other highlights of the week: an incredibly insightful look and interesting read into Fort Benning military operations with squad UAS and Counter-UAS – one of the key strengths of Notify is that we pick up everything related to UAS security, as long as it’s publicly available. In the Armenia-Azerbaijan conflict, we start seeing more Commercial-Off-The-Shelf (COTS) drones appearing amongst militants – not just the big military drones playing part of the action.
In the USA we observe another medical helicopter interference by rogue drone, and a potential collision with a light aircraft in the Netherlands which involved the Royal Netherlands Air Force to assess damage before making a controlled landing.
In terms of COTS drone modifications, footage has emerged of an 8km height managed with modified batteries in Greece, and an 18km cross-border flight between Singapore and Indonesia, also using modified batteries and range extenders. These artefacts should give law enforcement and security operators a better understanding of the realistic capabilities of modified COTS systems, and the potential range and height they’re dealing with. Similarly, it is important to document the technology enabling these operations to identify potential or future activities in an area.