In its example, Make used a Parrot AR.Drone which generates its own Wi-Fi access point. With these drones, owners can set up an access point on the drone and connect their smartphone to the access point. The smartphone then acts as a controller that is used to fly the UAV. This is a simple and affordable system that gets people flying quickly without the fuss of learning how to use a physical controller with joysticks and flywheels. The system’s biggest drawback is that is very hackable, so hackable that people have even created some related competitions.
To hack into the drone, Make used a laptop with a USB Wi-Fi card and a homemade cantenna to connect to the drone’s very open access point. The cantenna is basically a directional antenna built using a can. It allows you to log into a relatively distant access point. Once connected, the hacker can open a terminal application and telnet to the gateway address of the drone, which is usually the all-too-common 192.168.1.1. Once connected using an active telnet session, the hacker then can perform a variety of commands, including shutting off the drone without the operator knowing.
Telnet is not too difficult to use, but there is an easier way to automate this process using a Raspberry Pi. In its tutorial, Make walks you through the process of creating a script containing a series of commands that will join the Raspberry Pi to the Parrot drone automatically. This connection script then calls a second script that will initiate a telnet session and send the “power off” command to the drone. This command will instruct the drone’s computer system to shut down completely, causing the drone to plummet to the ground much to the bewilderment of the operator.
Besides forcing a drone to stop operating, a hacker also can send many other commands including ones that reroute the drone to a new location, intercept the video feed, and more. There’s even a project that describes how to create an army of zombie drones using a single drone that seeks out other Parrot drones, disconnects them from the operator, and reconnects them to the attacker drone. Once connected, the compromised drones and attacker drone fly away together in their newly created group.
