Grand Theft Drone: Reaching Breaking Point in Drone Proprietary RF Link Security
summary
Analysis shows Fr Sky access RC uses 47 channels with an exposed hopping index and a fixed hop distance 7, letting a sniffer reconstruct the base sequence. Using SDR/USRP demodulation and PCB tapping, a clone transmitter is built that injects packets within a 1.4 ms window after channel change, overpowers authentic signals out to ~50 m, and achieves Hardware‑in‑the‑Loop hijack demos. Recommendations: obscure sequence fields, use cryptographic PRNGs and authenticated binding.
AI-written summary · about
chapters (25)
- 0:00Start
- 6:33From a security perspective, FHSS
- 7:45FHSS Synchronization
- 9:13Hardware (Transmitter)
- 9:38Hardware (ACCESS Receiver)
- 10:36Continuity Test for Identification
- 11:40Anti Reverse Engineering Techniques
- 11:55RF Analysis And Making Sniffer
- 13:27Control Channels
- 14:10Packet Sniffer Block Diagram
- 15:37Demodulated Signal
- 19:54Timing Diagram of the Receiver
- 20:44Hopping Sequence Extraction
- 22:01Base Sequence Table Generation
- 22:50Base Sequence and Distance in Packet
- 23:31Base Sequence and Channels
- 24:56ACCESS Hopping Pattern
- 25:19ACCESS Hop Distance Identifying
- 25:52Final Hopping Sequence
- 26:27Hopping Pattern between Transmitters
- 30:55Hijacking Attack Model
- 34:52Summary of the Main Points
- 35:32Hopping Sequence Generation
- 36:25RF Packet
- 37:13Flight Controller and RC
related talks
55mAttacking Industrial Remote Controllers
01h 00mHacking the Wireless World with Software Defined Radio - 2.0
28mHacking a Professional Drone
59mWireless security testing with attack
44m"Attacking industrial remote controllers for fun and profit"
53mHacking the Wireless World with Software Defined Radio - 2.0
01h 02mHacking the Wireless World with Software Defined Radio - 2.0
51mSDRs for Real, or How to Catch a Drone?