Hacking Drone Warfare

Hacking Drone Warfare

Speakers: Oleg Shakirov, PhD student, Johns Hopkins

Conference: CYBERWARCON

YouTube: https://www.youtube.com/watch?v=qddvT-hqsyI

Overview

In an insightful presentation at CYBERWARCON, Oleg Shakirov, a PhD student at Johns Hopkins, illuminated the intricate and often clandestine world of hacking in drone warfare, specifically focusing on the ongoing conflict between Russia and Ukraine. The talk delved into how commercial off-the-shelf (COTS) drones, primarily used for civilian purposes, are being repurposed and weaponized for military operations through sophisticated firmware modifications and improvised IT infrastructure. Shakirov's research highlights a unique convergence of grassroots technical expertise, cyber operations, and kinetic warfare, demonstrating how civilian technology supply chains and support networks have become critical targets in modern conflict.

The core of Shakirov's discussion revolved around the "weaponization" of drones through custom firmware, exemplified by a specific variant known as 1001, for DJI drones. This talk is highly relevant as it uncovers the practical realities of adapting readily available technology for combat, showcasing the rapid innovation and significant cyber risks inherent in such ad hoc systems. It underscores how both offensive and defensive cyber tactics are being deployed not merely against traditional military systems, but against the very tools and infrastructure enabling this new era of drone-centric combat, with direct implications for battlefield effectiveness and operational security.

Background

▶ Watch: Introduction: Hacking commercial drones for war (0:00)

The contemporary conflict between Russia and Ukraine has become a crucible for the rapid evolution of drone warfare, distinguishing itself into two primary categories: long-range strategic strikes and localized battlefield use. Oleg Shakirov's presentation primarily focuses on the latter, particularly the deployment of First-Person View (FPV) drones in close-quarters combat. Unlike the highly structured and often proprietary systems characteristic of traditional military hardware, the battlefield application of FPV drones is marked by an extraordinary degree of innovation, improvisation, and reliance on ad hoc solutions by both Russian and Ukrainian forces.

A critical aspect of this improvised warfare is the widespread adoption of commercial off-the-shelf (COTS) drones, with various DJI models being prominent examples. These drones, designed for civilian applications such as aerial photography, surveying, or hobbyist flying, come equipped with numerous security and safety features. These include no-fly zone restrictions (preventing flight near airports or sensitive areas), flight length and height limitations, and checks for original equipment manufacturer (OEM) batteries. While invaluable in a civilian context for preventing accidents, ensuring regulatory compliance, and enhancing user safety, these features are antithetical to the demands of a combat environment. In a war zone, operators require unrestricted flight capabilities, maximum operational range, and the flexibility to use any available power source, regardless of origin. This fundamental mismatch between civilian design and military necessity creates the imperative for "hacking" or "jailbreaking" these drones—a process Shakirov aptly terms "weaponization"—to strip away their civilian safeguards and unleash their full destructive potential.

Key Findings

▶ Watch: Ukrainian forces using Russian-developed firmware (3:57)

Shakirov's research reveals several pivotal findings regarding the intersection of hacking and drone warfare in the Russia-Ukraine conflict:

Firstly, the emergence and professionalization of custom firmware development for COTS drones is a significant trend. What began as rudimentary modifications to disable basic security features has evolved into a sophisticated, quasi-IT support sector. This sector now produces and distributes specialized firmware variants tailored for military use. A prime example is the 1001, firmware designed for DJI drones, which was first introduced in July 2023 by a volunteer group identifying as "Russian hackers for the front." This firmware is engineered to deactivate multiple critical security features, including no-fly zone restrictions, flight length and height limitations, and the requirement for original batteries, thereby transforming civilian drones into highly adaptable battlefield assets.

Secondly, the talk highlights the remarkable cross-pollination and rapid adoption of this custom firmware across adversary lines. The 1001, firmware proved so effective that, according to Ukrainian experts, it was obtained from captured Russian drones. After several months of analysis and adaptation, Ukrainian forces released their own modified versions in early 2024, demonstrating an accelerated cycle of technological acquisition and counter-adaptation in the conflict. This shared reliance on the same core weaponized firmware underscores the pragmatic and often resource-driven nature of innovation in wartime.

Thirdly, the distribution mechanism for this specialized firmware constitutes a novel and vulnerable improvised IT infrastructure. Unlike many other custom firmware variants that might be downloadable, 1001, is distributed through a tightly controlled network of over 400 "drone service centers" located across Russian regions and within the conflict zone. These centers are equipped with specialized laptops or terminals provided by the "Russian hackers," which receive firmware updates from centralized servers. This bespoke, distributed network, designed to control proliferation to civilians and adversaries (though unsuccessfully in the latter), paradoxically created a centralized point of vulnerability for cyberattack.

Finally, and most strikingly, this very distribution network became the target of a cyberattack. On July 4th, the "Russian hackers" reported a cyber incident where a malicious message was distributed to their service terminals. The message falsely claimed that recently updated drones were unsafe to fly, aiming to induce a recall of hundreds of drones and halt their operational deployment. While the attackers did not manage to modify the actual firmware, the incident successfully caused a two-week operational pause in weaponization activities, as over 400 terminals had to be recalled, inspected, and verified for integrity. This event vividly illustrates how cyber operations can directly impact the logistical and operational tempo of kinetic warfare, even without direct manipulation of weapon systems.

Technical Deep Dive

▶ Watch: Cyber attack on the drone firmware distribution (6:00)

The technical core of drone weaponization, as described by Shakirov, revolves around the modification of firmware within commercial DJI drones. The 1001, firmware, developed by the "Russian hackers for the front," exemplifies this process. This custom firmware is designed to bypass or disable several integral safety and operational parameters hardcoded into the original DJI software. Key features targeted for modification include:

• No-Fly Zone (NFZ) Restrictions: Commercial drones often have geofencing capabilities that prevent them from operating in restricted airspace, such as near airports, government facilities, or active conflict zones designated as no-fly areas by the manufacturer. The 1001, firmware eliminates these digital barriers, granting operators unrestricted flight access critical for military operations.
• Flight Length and Height Restrictions: Standard commercial firmware might impose limitations on how far or high a drone can fly, often for battery conservation, regulatory compliance, or to maintain line-of-sight. By removing these, the custom firmware allows for extended range and altitude, crucial for reconnaissance, targeting, and delivering payloads.
• Non-Original Battery Usage: DJI drones often include checks to ensure that only proprietary batteries are used, which can be a logistical bottleneck in a combat zone where specific power sources may be scarce. The 1001, firmware enables the use of non-original batteries, providing greater flexibility and resilience in power supply.

The distribution of 1001, is a fascinating aspect, resembling a highly controlled, decentralized, yet centrally managed software distribution network. The "Russian hackers" established a "quasi IT support sector" comprising over 400 drone service centers. Each center is provided with specialized laptops or terminals that serve as flashing stations. These terminals are designed to connect to centralized servers operated by the Russian hackers, from which they receive authenticated firmware updates. This model aims to prevent unauthorized access and proliferation, ensuring that only approved drones used for the "special military operation" receive the custom firmware. This architecture, while robust in its control, inherently creates a single point of failure or a highly attractive target for cyber adversaries, as demonstrated by the July 4th attack.

The cyberattack on this distribution network was not a direct firmware manipulation, but rather a sophisticated defacement and social engineering operation. The attackers exploited a vulnerability in the communication channel or the terminals themselves to distribute a false message to the service centers. This message claimed that drones recently updated with the 1001, firmware were unsafe to fly. The primary objective was to sow fear and distrust, compelling the service centers to recall hundreds of drones from the front lines and halt their weaponization activities. This tactic, while not achieving direct control over the drones or their firmware, aimed to induce a significant operational disruption through psychological warfare and logistical paralysis. The "Russian hackers" confirmed that the firmware on their central servers had not been modified, but the terminals themselves were deemed compromised, necessitating a recall of all >400 units for inspection and re-securing. This incident highlights the potency of supply chain attacks targeting the logistical and support infrastructure of modern warfare.

Demo / Proof of Concept

▶ Watch: Impact: 2-week pause, recall of 400 terminals (7:27)

While Oleg Shakirov's talk did not feature a live technical demonstration or a real-time proof of concept of hacking a drone, it provided a detailed account of a real-world cyberattack against an operational drone weaponization and distribution network. The presentation served as a comprehensive case study, outlining the methods, targets, and consequences of such an attack within the context of the Russia-Ukraine conflict. The speaker presented a screenshot of the defacement message that was distributed to the compromised terminals, offering concrete evidence of the incident and the attackers' intent to disrupt drone operations by inducing a recall. This real-world incident effectively served as a "proof of concept" for the feasibility and impact of cyberattacks on the improvised supply chains of modern drone warfare.

Defensive Implications

▶ Watch: Key takeaways: essential hacking, improvised infrastructure (11:10)

The insights from "Hacking Drone Warfare" carry profound defensive implications for military strategists, cybersecurity professionals, and national security organizations. The reliance on COTS drones and improvised support infrastructure introduces a complex array of vulnerabilities that demand innovative defensive strategies.

1. Supply Chain Security for COTS Military Tech: The most critical implication is the absolute necessity of securing the entire supply chain for COTS technology repurposed for military use. Unlike traditional military hardware with established procurement and security protocols, improvised drone weaponization relies on ad hoc networks, making them prime targets for supply chain attacks. Defenders must implement rigorous firmware integrity verification mechanisms, not just at the point of initial modification but continuously throughout the distribution and operational lifecycle. This includes secure boot processes, cryptographic signing of firmware, and robust auditing of distribution terminals.

1. Protecting Improvised IT Infrastructure: The "drone service centers" and their centralized servers represent a novel attack surface. Defensive strategies must extend beyond traditional military networks to encompass these quasi-civilian, volunteer-driven IT systems. This requires implementing standard cybersecurity best practices:

• Endpoint Security: Robust antivirus, endpoint detection and response (EDR) on all service center terminals.
• Network Segmentation: Isolating the firmware distribution network from other less secure segments.
• Access Control: Strict authentication and authorization for accessing firmware updates.
• Vulnerability Management: Regular scanning and patching of all software and hardware components within the distribution network.
• Intrusion Detection/Prevention Systems (IDS/IPS): Monitoring network traffic for anomalous activity indicating compromise.

1. Countering Information Operations and Social Engineering: The cyberattack described was primarily a defacement and social engineering tactic aimed at inducing fear and operational paralysis. Defenders must train personnel, particularly those in support roles and operational command, to recognize and resist such information operations. Establishing clear, out-of-band communication channels for critical security alerts, separate from potentially compromised systems, is vital to verify the authenticity of messages and prevent panic-driven operational shutdowns.

1. Operational Security (OpSec) in a Hybrid Environment: The rapid sharing and adaptation of custom firmware between adversaries (e.g., 1001, being used by both sides) highlights a significant OpSec challenge. Defenders must assume that any custom modifications or vulnerabilities they introduce will eventually be discovered and potentially exploited by the adversary. This necessitates constant vigilance, rapid patch deployment, and the development of multiple, diversified solutions rather than relying on a single, potentially compromised firmware variant. Furthermore, preventing the capture and reverse engineering of drones and their firmware should be a high priority.

1. Addressing the Broader Drone Life Cycle: Shakirov's broader points about hacking throughout the drone life cycle (training, acquisition, operations, post-use) suggest further defensive priorities:

• Training Simulations: Securing pilot training simulation software from sabotage.
• Acquisition Channels: Protecting volunteer networks and manufacturing plants from cyberattacks.
• In-Flight Security: Developing robust anti-hijacking and anti-jamming measures for drone signals.
• Post-Capture Data Protection: Implementing self-destruct mechanisms or robust encryption for sensitive data on drones to prevent adversary reverse engineering or data extraction from captured units. The reported malware on Ukrainian drones to prevent reuse is an offensive OpSec measure that defenders might consider.

1. Recognizing the Tech-Savvy Adversary: The observation that volunteers and operators in drone warfare are often more tech-savvy implies that traditional "dumb" cyber defenses may be insufficient. Defenders must anticipate sophisticated tactics from an adversary that understands the underlying technology and is capable of rapid improvisation. This necessitates a proactive, adaptive defense posture that continuously evolves with the threat landscape.

In essence, defending against "hacking drone warfare" requires a holistic approach that integrates traditional cybersecurity, physical security, intelligence gathering, and robust OpSec across a highly dynamic and often unconventional battlefield.

Key Takeaways

• Hacking is Essential in Modern Drone Warfare: While dedicated cyberattacks on drone warfare infrastructure may seem rare, hacking (e.g., firmware modification) is a foundational element in adapting commercial drones for military use.
• Improvised Infrastructure is a Key Vulnerability: The reliance on custom software, ad hoc solutions, and volunteer-driven IT support networks creates a unique and vulnerable attack surface for cyber operations.
• Cyberattacks Can Directly Impact Kinetic Operations: As demonstrated by the 1001, incident, cyberattacks targeting the logistical and operational support infrastructure of drone warfare can lead to significant operational pauses and disruptions on the battlefield.
• Supply Chain Attacks are Potent: The defacement attack on the firmware distribution network highlights the effectiveness of supply chain attacks, even when they don't involve direct manipulation of weapon systems, by leveraging social engineering and logistical disruption.
• Rapid Adaptation and Cross-Pollination are Norms: The quick adoption and modification of adversary-developed firmware (like 1001, by both Russian and Ukrainian forces) underscores the rapid pace of technological innovation and counter-adaptation in modern conflict.
• Tech-Savvy Participants Drive Innovation and Risk: The high technical proficiency of volunteers and drone operators on both sides contributes to rapid innovation but also necessitates a heightened awareness of cyber risks and vulnerabilities in their improvised systems.

About the Speaker(s)

Oleg Shakirov is a PhD student at Johns Hopkins University, where his research focuses on critical aspects of modern conflict, particularly the intersection of technology and warfare. His work, as demonstrated in this CYBERWARCON presentation, delves into the practicalities of drone warfare, specifically exploring how commercial technologies are adapted for military use and the subsequent cyber vulnerabilities and implications that arise from such adaptations. Shakirov's expertise lies in analyzing the improvised and rapidly evolving cyber landscape surrounding the use of drones in conflicts like the one between Russia and Ukraine.