SoK - Security and Privacy in the Age of Drones: Threats, Challenges, Solution Mechanisms, and Scientific Gaps

Abstract

The evolution of drone technology in the past nine years since the first commercial drone was introduced at CES 2010 has caused many individuals and businesses to adopt drones for various purposes. We are currently living in an era in which drones are being used for pizza delivery, the shipment of goods, and filming, and they are likely to provide an alternative for transportation in the near future. However, drones also pose a significant challenge in terms of security and privacy within society (for both individuals and organizations), and many drone related incidents are reported on a daily basis. These incidents have called attention to the need to detect and disable drones used for malicious purposes and opened up a new area of research and development for academia and industry, with a market that is expected to reach $1.85 billion by 2024. While some of the knowledge used to detect UAVs has been adopted for drone detection, new methods have been suggested by industry and academia alike to deal with the challenges associated with detecting the very small and fast flying objects. In this paper, we describe new societal threats to security and privacy created by drones, and present academic and industrial methods used to detect and disable drones. We review methods targeted at areas that restrict drone flights and analyze their effectiveness with regard to various factors (e.g., weather, birds, ambient light, etc.). We present the challenges arising in areas that allow drone flights, introduce the methods that exist for dealing with these challenges, and discuss the scientific gaps that exist in this area. Finally, we review methods used to disable drones, analyze their effectiveness, and present their expected results. Finally, we suggest future research directions and discuss whether the benefits from the decision to allow drones to fly in populated areas are actually worth the risk.

A Review of Counter-UAS Technologies for Cooperative Defensive Teams of Drones

“…In this case, the spoofing source sends false signals to sensors, which can lead to the destabilization of the malicious drone control system. For example, as indicated in [91] and in references reported there, gyroscopes and accelerometers are sensitive to ultrasound at their resonant frequency and this vulnerability can be attacked. In [92], the authors spoofed the gyroscope of a drone, causing it to land.…”

“…However, these attacks require powerful speakers and are limited in range due to the degradation of the sound wave with distance. Furthermore, a reference for a possible solution to an acoustic attack is always present in [91]. Other sensors that can be spoofed are those of the optical flow type.…”

“…Their vulnerability was demonstrated in [93], where a method was presented to hijack a drone by spoofing the camera (thus affecting the stabilization algorithm) by means of a laser and a projector aimed at the drone's surface. Again, in [91], there was evidence of the fact that the presence of a magnetic field in the vicinity of a drone, in this case the DJI Phantom, always requires the recalibration of the relative magnetometer before take-off.…”

“…These attacks can also be aimed at drones. For example, as documented in [91], some commercial drones based on Wi-Fi communications that do not require authentication for network access have proved to be vulnerable to de-authentication and flooding towards the drone network interface controller (NIC). In particular, with deauthentication, it was possible to disconnect the commercial drone from its remote pilot in order to activate a security procedure and take advantage of the disconnection window to take control of it.…”

Detection and Classification of UAVs Using RF Fingerprints in the Presence of Wi-Fi and Bluetooth Interference

“…Moreover, drones are becoming tools for cyberattack and terrorism. For instance, Wi-Fi sniffing UAVs can eavesdrop on smartphone users and steal sensitive data without being detected [5], [6].…”