Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Reversed a Drone and Landed It with My PC

hardbreak.wiki

Post reply on HN
Print view View original

31–40 of 51 posts

Re: I Reversed a Drone and Landed It with My PC

#31

Post by makira »

magnat wrote: post #24
orliesaurus wrote: post #13

can anyone advise me on a drone brand or something that comes with an "API" that allows me to use it like a programmable interface, on the fly. Would love to write some script to make my drones do predefined things depending on API calls - any clues?

Lots of no-name or DIY drones use flight controller running a BetaFlight [1] firmware, which is open source and quite hackable. If you want low-level real-time programmatic control (like manipulating servos, lights or camera), that is most likely the easiest way. There is also ArduPilot [2] firmware, which is focused more on the high-level control (like managing GPS waypoints and autonomous takeoff/landing). In both…

Any reason BetaFlight doesn't appear to have even basic pre-shared key symmetric encryption? Some ciphers aren't that CPU intensive.

Re: I Reversed a Drone and Landed It with My PC

#32

Post by numpad0 »

theamk wrote: post #16
numpad0 wrote: post #11

Are Parrot drones insecure or deliberately built with zero security? I thought they're French made, and France tended to be more scared with technological resistance to government interventions than US or China.

What are you talking about? The Anafi drone uses regular wifi, with ESSID and password, and that's how the security is achieved. There is no need for additional encryption on protocol level. It's really the best way - instead of making ad-hoc security mechanisms, rely on well-researched and well-tested wifi security. (That first sentence, "Start by connecting your PC to the Parrot Anafi’s Wi-Fi network", really carri…

They used to have root shell on telnet in early consumer drones. It was a long time ago, but that can't happen by accident; they could have used dropbear with known fixed password, Wi-Fi MAC as password, etc. They also had wildly different mass than competitors - realistically DJI - at same price/performance ranges.

So I assumed ever since that they have their unique opinions about security and architecture of a flying machine control software. Is that odd?

Re: I Reversed a Drone and Landed It with My PC

#33

Post by numpad0 »

makira wrote: post #31
magnat wrote: post #24

Earlier quoted context omitted.

Lots of no-name or DIY drones use flight controller running a BetaFlight [1] firmware, which is open source and quite hackable. If you want low-level real-time programmatic control (like manipulating servos, lights or camera), that is most likely the easiest way. There is also ArduPilot [2] firmware, which is focused more on the high-level control (like managing GPS waypoints and autonomous takeoff/landing). In both…

Any reason BetaFlight doesn't appear to have even basic pre-shared key symmetric encryption? Some ciphers aren't that CPU intensive.

I think ciphering is not always allowed on remote control hobbyist bands. Some jurisdictions allow stronger radio output in exchange for such restrictions.

That and lack of demand. Most people are nice, key management is PITA, losing expensive toy from a crypto library bug is going to be frustrating.

WPA2 should be still strong enough for most purposes too(threat_model != CIA).

Re: I Reversed a Drone and Landed It with My PC

#34

Post by chrisdalke »

palata wrote: post #30

I am confused... isn't Parrot's ground SDK open source? https://github.com/Parrot-Developers/groundsdk-android Why reverse it?

That was my thought, at least one of those packets in their snooping (src. port 14551 / dest port 14550) is the standard Mavlink port to send to the GCS.

I wonder if the proprietary packet they decoded here is actually just a MAV_CMD_DO_SET_MODE setting the drone into a takeoff flight mode.

Re: I Reversed a Drone and Landed It with My PC

#35

Post by magnat »

makira wrote: post #31
magnat wrote: post #24

Earlier quoted context omitted.

Lots of no-name or DIY drones use flight controller running a BetaFlight [1] firmware, which is open source and quite hackable. If you want low-level real-time programmatic control (like manipulating servos, lights or camera), that is most likely the easiest way. There is also ArduPilot [2] firmware, which is focused more on the high-level control (like managing GPS waypoints and autonomous takeoff/landing). In both…

Any reason BetaFlight doesn't appear to have even basic pre-shared key symmetric encryption? Some ciphers aren't that CPU intensive.

BetaFlight doesn't deal with over-the-air bits, it just receives PWM/PPM/S-Bus/whatever signals your receiver provides. There is no point to have encryption in firmware, because connection between RX and FC is hardwired and can be trusted.

Lack of OTA frames encryption, as far as I can tell, is mostly due to legacy reasons. In DYI FPV there are only couple of transmission standards, most of them using 2.4GHz FHSS or some CC2500 clone so you can mix-and-match transmitters and receivers as you wish. If you use custom TX/RX devices, you are pretty much locked in to that specific vendor. Also, designing a nice transmitter UX-wise requires quite a different skillset than designing nice transmitter RF-wise, so manufacturers tend to choose off-the-shelf RF modules.

Re: I Reversed a Drone and Landed It with My PC

#36

Post by chrisdalke »

makira wrote: post #31
magnat wrote: post #24

Earlier quoted context omitted.

Lots of no-name or DIY drones use flight controller running a BetaFlight [1] firmware, which is open source and quite hackable. If you want low-level real-time programmatic control (like manipulating servos, lights or camera), that is most likely the easiest way. There is also ArduPilot [2] firmware, which is focused more on the high-level control (like managing GPS waypoints and autonomous takeoff/landing). In both…

Any reason BetaFlight doesn't appear to have even basic pre-shared key symmetric encryption? Some ciphers aren't that CPU intensive.

It's probably the wrong place in the stack to implement this, these are very low-cost commodity microcontrollers running the firmware and the design of flight controller software is focused on time guarantees and reliability.

With the exception of low-cost consumer drones, most larger drones have at least a "Flight Controller" (embedded MCU handling guidance, navigation, and control) and a "Flight Computer" (Higher level *nix based computer running autonomy software), and the flight computer is IMO a more appropriate place to put this.

You could encrypt any Mavlink or proprietary protocol at the application layer if you're using an IP link, or you could also just rely on the telemetry radio to perform encryption between the drone and your ground station.

Re: I Reversed a Drone and Landed It with My PC

#37

Post by savrajsingh »

orliesaurus wrote: post #13

can anyone advise me on a drone brand or something that comes with an "API" that allows me to use it like a programmable interface, on the fly. Would love to write some script to make my drones do predefined things depending on API calls - any clues?

Check out ardupilot

Re: I Reversed a Drone and Landed It with My PC

#39

Post by hw-f3nter »

palata wrote: post #30

I am confused... isn't Parrot's ground SDK open source? https://github.com/Parrot-Developers/groundsdk-android Why reverse it?

For context, this drone was reversed back in 2018 as part of my bachelor thesis. At the time, the SDK hadn’t been released yet I believe, so reversing was the only available option. Recently, I revisited this work and decided to include it on my new hardware hacking wiki - HardBreak.

Re: I Reversed a Drone and Landed It with My PC

#40

Post by jdietrich »

magnat wrote: post #35
makira wrote: post #31

Earlier quoted context omitted.

Any reason BetaFlight doesn't appear to have even basic pre-shared key symmetric encryption? Some ciphers aren't that CPU intensive.

BetaFlight doesn't deal with over-the-air bits, it just receives PWM/PPM/S-Bus/whatever signals your receiver provides. There is no point to have encryption in firmware, because connection between RX and FC is hardwired and can be trusted. Lack of OTA frames encryption, as far as I can tell, is mostly due to legacy reasons. In DYI FPV there are only couple of transmission standards, most of them using 2.4GHz FHSS or…

The threat model for most FPV pilots (either hobbyists or people in Ukraine) doesn't really include hijacking of the air link. It's trivial to just shoot something down with interference, sometimes inadvertently.

Pretty much everyone in FPV is now using ExpressLRS, which is an open protocol. If you want an encrypted air link, then the best option I'm aware of is the proprietary TBS Crossfire protocol.

https://www.expresslrs.org/

https://www.team-blacksheep.com/

Post reply on HN