New CS proposal: Drone Security

[godfreynolan]

What is the proposed Cheat Sheet about?

This drone security Cheat Sheet aims to ensure the safe and secure operation of unmanned aerial vehicles (UAVs) in various mobile, web and cloud applications.

What security issues are commonly encountered related to this area?

Insecure Communication Links, data transmitted can be intercepted
Weak Authentication Mechanisms, default or weak passwords can allow unauthorized access
Firmware Vulnerabilities, unencrypted firmware and vulnerable bootloaders can lead to unauthorized modifications
Insufficient Physical Security, need to secure physical access to USB ports and other interfaces to prevent data theft or tampering
Insecure Supply Chain, compromised components from suppliers can introduce hidden vulnerabilities
Unsecured Third Party Components, third-party software libraries and components can compromise drone security
Inadequate Logging and Monitoring, insufficient monitoring of drone operations can delay the detection of security breaches or operational anomalies
Insecure Data Storage, sensitive data stored on drones can be accessed if not encrypted
Spoofing and Replay Attacks, GPS or ADS-B data spoofing or command replay attacks could mislead or take control of the drone
RF Interference and Jamming, drones can be disrupted or controlled through intentional RF interference or jamming
Sensor Vulnerabilities, cameras, GPS and other sensors can be exploited to feed incorrect data to the drone systems.
Cloud Storage and Data Management Vulnerabilities, inadequate security controls for drone data stored in the cloud (e.g., videos, logs, images) can lead to unauthorized access and data breaches
End of Life Decommissioning Risks, inadequately secured decommissioning processes can leave residual data accessible, or hardware could be reused maliciously
Interoperability and Integration Issues, integrating various systems and technologies without a cohesive security strategy can introduce vulnerabilities, e.g. web servers on cameras
Third Party Services and API Security, external APIs used by drones or GCS might be insecure, providing a pathway for attacks
User Error and Misconfiguration, incorrect configuration of drone systems by users can expose them to risks of unauthorized access or malfunction

What is the objective of the Cheat Sheet?

To provide developers working on mobile apps, websites, cloud systems and firmware for drones to understand the wide ranging risks.

What other resources exist in this area?

https://dronewolf.darkwolf.io/intro
https://github.com/nicholasaleks/Damn-Vulnerable-Drone
https://github.com/dhondta/dronesploit
https://github.com/jezzab/DUMLdore

[jmanico]

I think this is a fantastic idea for a cheatsheet. Let's do it. You are welcome to issue a new PR and if you need help with the directory structure of similar let me know!

[godfreynolan]

Thanks, I will take a look and let you know if I need any help.

…

On Mon, May 27, 2024 at 2:15 AM Jim Manico ***@***.***> wrote: I think this is a fantastic idea for a cheatsheet. Let's do it. You are welcome to issue a new PR and if you need help with the directory structure of similar let me know! — Reply to this email directly, view it on GitHub <#1412 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFAXT475LODJXFJA6A3JHTZELFOPAVCNFSM6AAAAABIIABCHSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZSG4YTOMBXG4> . You are receiving this because you authored the thread.Message ID: ***@***.***>

-- Thanks Godfrey Nolan ***@***.*** (248) 286 1227 http://twitter.com/riisllc

[szh]

@godfreynolan Hey are you still working on this?

[godfreynolan]

Sorry fell off my radar for a bit. Plan is to get this completed by the end of month before Commercial UAV.

…

On Wed, Aug 7, 2024 at 4:28 PM Shlomo Zalman Heigh ***@***.***> wrote: @godfreynolan <https://github.com/godfreynolan> Hey are you still working on this? — Reply to this email directly, view it on GitHub <#1412 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFAXT35S276QJFIP5B55PTZQJ7NBAVCNFSM6AAAAABIIABCHSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENZUGI4TAOBTGE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- Thanks Godfrey Nolan ***@***.*** (248) 286 1227 http://twitter.com/riisllc