Hacking a Commercial Drone with Open-Source Software: Exploring Data Privacy Violations

Drones have been discussed frequently in both governmental and commercial sectors for their normalization in the airspace. Nonetheless, drones bring diverse privacy concerns to users. In this paper, we explore the ramifications to data privacy from the perspective of drone owners. To investigate privacy in this context, four experiments targeting a commercial drone were conducted using open-source software. The experiments identified personal data (e.g., audio, video, and location) that are at risk of being compromised particularly through the execution of a basic deauthentication attack launched at a commercial drone. Our findings indicate the severity of risks affecting commercial drones. This makes the case for more effective privacy regulations and better guidelines suitable for securing drones.

I. Introduction

The Internet of Things (IoT) together with drones, also called Unmanned Aerial Vehicles (UAVs), have seen in the last couple of years an unhinged increase in both areas of use and users operating drones for commercial, military, and private purposes. The number of hobbyists and commercial drones registered only in the United States was 1.512 million units in 2017 [1]. According to the Federal Aviation Administration (FAA) the estimated growth factor in civilian and governmental drone usage is a factor of 10 between 2016–2021 in the United States [1]. Whilst IoT and UAVs are increasing in popularity within both the commercial and governmental sectors, privacy concerns need to be addressed. Recently, Kaspersky released a report [2] identifying more than 100 million attacks on IoT devices were detected during the first half of 2019. This is a severe increase from 2018 when 12 million attacks were detected during the same period. The global average cost for a data breach in 2020 was estimated to be $3.86M [3] and amounting in total to approximately$386 trillion.