Cyber Attack Vulnerabilities Analysis for Unmanned Aerial Vehicles

Abstract

As the technological capabilities of automated systems have increased, the use of unmanned aerial vehicles (UAVs) for traditionally exhausting and dangerous manned missions has become more feasible. The United States Army, Air Force, and Navy have released plans for the increased use of UAVs, but have only recently shown interest in the cyber security aspect of UAVs. As a result, current autopilot systems were not built with cyber security considerations taken into account, and are thus vulnerable to cyber attack. Since UAVs rely heavily on their on-board autopilots to function, it is important to develop an autopilot system that is robust to possible cyber attacks. In order to develop a cyber-secure autopilot architecture, we have run a study on potential cyber threats and vulnerabilities of the current autopilot systems. This study involved a literature review on general cyber attack methods and on networked systems, which we used to identify the possible threats and vulnerabilities of the current autopilot system. We then studied the identified threats and vulnerabilities in order to analyze the post-attack behavior of the autopilot system through simulation. The uses of UAVs are increasing in many applications other than the traditional military use. We describe several example scenarios involving cyber attacks that demonstrate the vulnerabilities of current autopilot systems.

Etyka robotów bojowych

“…Spełnienie wymagań autonomii jest wszakże ogromnym wyzwaniem technicznym, a tymczasem już proste systemy zdalnie sterowane pozwalają osiągnąć zasadniczy cel robotyzacji -ograniczyć ryzyko dla żołnierzy, przez eliminację człowieka z pokładu maszyny podczas wykonywania najbardziej niebezpiecznych zadań. Najpoważniejszą wadą zdalnego sterowania jest możliwość zakłócenia kanałów łączności albo wręcz przejęcia kontroli nad nimi przez przeciwnika (Kim, Wampler, Goppert et al 2015). Sprowadzenie na ziemię i przejęcie w stanie praktycznie nieuszkodzonym amerykańskiego drona rozpoznawczego RQ-170 Sentinel przez Iran (Hartman i Steup 2013: 7-8) dobitnie pokazuje, że jest to niebezpieczeństwo realne.…”

A Review of Cyber Threats and Defence Approaches in Emergency Management

“…Up to now, they have confirmed that GPS spoofing can lead a UAV astray and in manner that may not be detected by the legitimate operator. In addition, they have analysed a gain-scheduling attack affecting the vehicle's controls and stability through sensor spoofing, and a fuzzing attack where the attacker injects random inputs to the vehicle's actuators [117]. In parallel, a less technical high-level analysis of the potential impact of cyber attacks on UAVs has been presented in [118].…”

“…Fuzzing attack [117] Random inputs to vehicle's actuators [117] No known solutions 2.4.1. Manned Vehicles EM can be impaired by the means of transportation used by affected citizens, the emergency response vehicles used to carry people and equipment to and from the scene of the disaster, as well as by the local traffic.…”

“…Malware infection of on board computers [113] Hijacked control of locks, brakes and engine Malware detection [113] GPS Spoofing [50,117] Artificial traffic jam caused Signal analysis [51][52][53] Web-based immobilisation hijacked [114] Cars immobilised remotely and simultaneously Web security literature [46] GPS Spoofing [50,117] Unmanned vehicle redirected [117,118] Signal analysis [51][52][53] Gain-scheduling attack [117] Control stability affected [117] No known solutions…”

R2U2: monitoring and diagnosis of security threats for unmanned aerial systems

“…Figure 5 shows how our R2U2 framework monitors the various inputs going into the UAS system (GCS and GPS), as well as sensor/actuator signals and status of the flight software for post-attack analysis. We next consider modeling for attacks and post-attack behavior, loosely following [21].…”