Drones are expected to have a huge effect on industries across the board in the coming decade. So much so that business owners like Chuck Williams, owner of Float Avionics, believe that drones able to move autonomously as well as digitize and send that information to the relevant people will be as important to businesses as the spreadsheet has been. Drones, Williams added, are the physical extension of an increasingly digital world.
Usually when one thinks of drones and security, the first thought is the dangers to airplanes or privacy violations. But because drones are basically flying computers, the potential for security-related flaws and vulnerabilities is there. In fact, at least one strain of malware has been found to directly affect drones; it can allow attackers to remotely control the device.
Drone security is complicated, however, because it encompasses so many different types of security threats. This is creating challenges for programmers, lawmakers and the general public, who need to address drone security without lessening the positive aspects of the devices.
Drone Security 101
Click through for a rundown from Sue Marquette Poremba on what you need to know about drones and the security challenges they pose.
Top Security Concerns for Users
According to Richard M. Lusk, director of the UAS Research Center with the Oak Ridge National Laboratory, the largest risks to users of small unmanned aerial systems (sUAS), usually quadcopters, include, in order of likelihood:
- Financial loss due to destruction or “fly away” of the vehicle itself.
- Physical injury due to cutting injury by propellers.
- Legal liability for disobeying FAA regulations or violating federal, state or local laws.
Top Security Concerns for Programmers
For programmers, the most pressing security concern is developing a product that always works but that also avoids vulnerabilities that hackers can compromise. “When something goes wrong in the air, you don’t have time to make many decisions as most errors will put a drone on the ground pretty quickly or result in it going haywire,” said Float Avionics owner Chuck Williams.
Top Security Concerns for the General Public
Privacy is the issue that the general public tends to worry about most. While Williams stated that the “Peeping Tom” aspect may be overblown, the fact is that most commercial drones do have cameras and many photographers, both professional and amateur, are using drones for aerial pictures. The general public simply doesn’t know if and when their likeness is being captured.
Drones can be a threat to physical security for the general public, as well, said Ryan Jones, partner at Coalfire Labs, as more users are modifying their drones to be weaponized and to carry everything from handguns to rifles to chainsaws.
Malware Developed to Specifically Target Drones
Malware is definitely a consideration for sUAS as they become more involved in commercial enterprises, and as they become more ubiquitous in performing missions in support of agriculture, infrastructure and environmental monitoring and first response, Lusk pointed out, adding that military mission-capable, large “drones” have already been hacked.
A piece of malware known as Maldrone is believed to be the first backdoor malware developed specifically for sUAS devices. On the military side of things, there was at least one incident of a keylogger malware infecting a drone fleet at Creech Air Force Base in Nevada, which supposedly happened due to an operator using the control PC of a drone to play a video game.
Why Malware Targeting Drones Matters
Drones are controlled by a remote control computer with differing levels of human input, explained Williams. Some drones can fly autonomously on a programmed route, some can “see” obstructions in front of them and avoid them (though that technology is still lacking). Remote controls on various frequencies send different signals back and forth to the drone (controls; video signals; information like speed, altitude or range). Malware can disrupt any or all of these control signals.
Regulators and Lawmakers
What regulators/lawmakers are doing to handle security risks caused by drones
According to Lusk, at least 41 states are considering legislation related to drones in the 2016 legislative year, while six states have actually passed something. While most of those new laws deal with outlawing drones for hunting, Oregon legislation makes it a misdemeanor to operate a weaponized drone and can regulate the retention of data collected via drones.
As of yet, it does not appear much is being done to address malware risks.
Drone Security Concerns of the Future
This is emerging technology, so you know bigger security risks are on the horizon. The experts agree that the scariest future security concern for drones is the ability to carry explosives and be used in a targeted terrorist attack.
Decreasing Security Risks
What can be done to decrease potential security risks caused by drones
To decrease potential security risks involving drones means investing in anti-drone research, which is expected to grow rapidly over the next six years. Terrorist threats, security breaches and cybersecurity issues are driving the anti-drone research push.
According to Jones, Los Alamos National Labs is doing research into making drones more unpredictable while still achieving their goals, in order to reduce the possibility of an ambush in military situations.