Project "The Interceptor": Owning anti-drone systems with nanodrones

Video thumbnail (Frame 0) Video thumbnail (Frame 1994) Video thumbnail (Frame 2984) Video thumbnail (Frame 4447) Video thumbnail (Frame 5791) Video thumbnail (Frame 7338) Video thumbnail (Frame 9753) Video thumbnail (Frame 10782) Video thumbnail (Frame 12144) Video thumbnail (Frame 14545) Video thumbnail (Frame 15707) Video thumbnail (Frame 16521) Video thumbnail (Frame 17697) Video thumbnail (Frame 18876) Video thumbnail (Frame 21627) Video thumbnail (Frame 22717) Video thumbnail (Frame 24191) Video thumbnail (Frame 25280) Video thumbnail (Frame 26097) Video thumbnail (Frame 26847) Video thumbnail (Frame 30987) Video thumbnail (Frame 36913) Video thumbnail (Frame 37725) Video thumbnail (Frame 38732) Video thumbnail (Frame 42675) Video thumbnail (Frame 47042) Video thumbnail (Frame 48828) Video thumbnail (Frame 51833) Video thumbnail (Frame 52627) Video thumbnail (Frame 53427) Video thumbnail (Frame 56341)
Video in TIB AV-Portal: Project "The Interceptor": Owning anti-drone systems with nanodrones

Formal Metadata

Project "The Interceptor": Owning anti-drone systems with nanodrones
Alternative Title
Avoiding CounterDrone Systems with NanoDrones
Title of Series
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Release Date

Content Metadata

Subject Area
Antidrone system industries have arised. Due to several, and even classic, vulnerabilities in communication systems now used by drones , anti-drone systems are able to take down those drone by means of well documented attacks. Drone/antidrone competition has already been set into the scene. This talk provides a new vision about drone protection against anti-drone systems, presenting "The Interceptor Project", a hand-sized nano drone based on single-core tiniest Linux Board: Vocore2. This Linux board manages a WiFi (side/hidden) bidirectional channel communication that cannot be deauthenticated and it is replay-resistant, keeping all 802.11 hacking capabilities and standard utilities as any other WiFi hacker drone, with only the built-in adapter of the tiny Vocore2. Also, a "just in case", fallback control by SDR is implemented taking advantage of all the goods that SDR radio gives. All embedded into a hand-sized aircraft to make detection and mitigation a real and new pain, with a very low budget: About 70.
Game controller Software engineering Multiplication sign Projective plane Number Roundness (object) Bit rate Robotics Software System programming Videoconferencing System programming Remote procedure call Hacker (term)
Wave packet Hand fan
Point (geometry) Goodness of fit Process (computing) Software Right angle 2 (number)
Mapping Computer network Disk read-and-write head Computer Neuroinformatik Frequency Type theory Software Telecommunication Reduction of order System programming Right angle Computer worm
Point (geometry) Game controller Noise (electronics) Dot product Waveform Artificial neural network Real number Time zone Cartesian coordinate system Electronic signature Data transmission Measurement Shape (magazine) Electronic signature Frequency Frequency Telecommunication System programming Waveform Musical ensemble
Area Rounding Server (computing) Diffuser (automotive) Line (geometry) Computer programming Web 2.0 Frequency Roundness (object) Frequency Bus (computing) System programming Communications protocol Router (computing) Communications protocol Spectrum (functional analysis) Router (computing) Stability theory
Rounding Perfect group Topostheorie Musical ensemble Demoscene
Data mining Game controller Mathematics Weight Maxima and minima Website Software-defined radio Staff (military) Control flow
Distribution (mathematics) Hydraulic motor Open set Whiteboard Router (computing)
Personal identification number Game controller Serial port Electronic mailing list Electronic program guide Parallel port Real-time operating system Route of administration Control flow Latent heat Latent heat Goodness of fit Process (computing) Befehlsprozessor Internet forum Hacker (term) Function (mathematics) Internet forum Computer hardware Core dump Hydraulic motor Right angle Video game console
Personal identification number Functional (mathematics) Group action Bus (computing) Counting System on a chip Function (mathematics) Musical ensemble
Revision control Execution unit Asynchronous Transfer Mode Information State of matter Telecommunication Magneto-optical drive Perpetual motion Power (physics) Power (physics)
Ocean current Digital electronics Principal ideal domain Hydraulic motor Bit Power (physics)
Laptop Mobile Web Email Frame problem Slide rule Enterprise architecture Joystick Game controller Enterprise architecture File format INTEGRAL Staff (military) Sequence Frame problem Number Software Computer cluster Vector space Telecommunication Encryption Musical ensemble Communications protocol Computer worm
Web page Laptop User interface Game controller Enterprise architecture Information Interface (computing) View (database) Characteristic polynomial Adaptive behavior Water vapor Staff (military) Frame problem Mathematics Loop (music) Musical ensemble Communications protocol
Metropolitan area network Fluid Frequency Software Interface (computing) Demo (music) Musical ensemble Musical ensemble Data transmission
Mathematics Game controller Musical ensemble
Demo (music) Motion capture Software-defined radio Computer programming Data transmission Frequency Videoconferencing Musical ensemble Stability theory Modem Module (mathematics) Enterprise architecture File format Projective plane Data transmission Data mining Proof theory Frequency Software Personal digital assistant Telecommunication Communications protocol Spectrum (functional analysis) Software protection dongle Reverse engineering
Asynchronous Transfer Mode Game controller Enterprise architecture Demo (music) Principal ideal domain Multiplication sign Forcing (mathematics) MIDI Bit Mereology Power (physics) Term (mathematics) Chain Musical ensemble Error message
Asynchronous Transfer Mode Musical ensemble MiniDisc Power (physics)
Vulnerability (computing) Regular graph Telecommunication State of matter Interface (computing) Interior (topology) Convex hull Musical ensemble output Law of large numbers
Trail Game controller Enterprise architecture Computer file Software developer Weight Design by contract Software-defined radio Power (physics) Goodness of fit Regular graph Software Telecommunication System programming Damping Software testing Musical ensemble Communications protocol Spectrum (functional analysis)
Software developer System programming
Davi is going to talk to us about drones and anti-drone countermeasures beyond just simply handing me a drone remote because I got a drone and the only thing I can do apparently is fly the thing into my face and I've done that a number of times so let's speak let's give the video a big round of applause thank you well I can say that I am pretty it's rate so let's get started well welcome to my welcome to my talk glad to see you here and I'm going to pretend the project interceptor was it's about opening and the drone system with none of drones so that's me what I know is melendez I know our the Blauman embedded software engineer in company in Spain and I the creates all the after of the several robots and I going to explain later and they threw the book hugging controllers it's in Spain in Spanish and resident speaker but not here and a trainee ACK well what why I'm saying than I a trainee ACK this
is the this is a Alta velocidad panel it's a pretty cool train is fast school and you go fast but I'm pretty fun of
your trains because they are pretty badass they stack containers and big fan big fan of you guys with honor you folks absolutely so if you you meet me later with me a be careful because I may be I started talking with trains and I can stop so be careful so I would like to
start with our with this and you're laughing pretty good job I I thinking about this guy are Raveena's home honey I'm doing a pretty good job today so that's that's at one point the second point Brazilian Def Con
able to start with drones in Def Con I think that what is the first drones in Def Con with pretty cool stuff we're hacking capabilities you you can take the drone along the city taking a lot of networks and make some cool stuff right and the second one was the video go for
the danger drone and it is a pretty cool stuff because we will reduce 3G and 4G communication and telemetry so that's because several anti-drone systems works indeed with 3G and 4G systems and if you use the same system the anti drones they can be told you know no way to jump your drone but only because it's illegal to jam 3d for the frequencies because some kind of problems so I want to explain
drone SS a three I like that back picture because it's pretty pretty cool well we can start talking about drones as a flying computers it's like internal things over your head IOT is we can call the OT as before we return to to us hoots because there were named quadcopters okay they can use custom payloads sniffer jammers Network analyzers 3d mapping cameras and so on some kind of cool stuff you can become continuous drone so any type of thing you you can imagine you can put it your drone a drone isa is a big hole it's not a weapon is not a hobby it's a tool right so we can detect drones well the
first one is okay I seen a drone okay I detected it so there is a there are thermal and standard cameras well nowadays the a lot of systems that well they are able to detect drones by its aid with artifical and get intelligence and so on and with thermal cameras with electronics and motor hit detection okay you see four dots on the sky are pretty hot it's not a pigeon I think also detection method is a cessation of drone noise a pigeon doesn't sound okay we got it that already frequency and wave form this is the most important method to detect drones because every patron has a signature of radio communication and it's pretty easy to detect that those drones because for example okay on Wi-Fi with the access point name would hear a manufactured drone is much it must be a drone okay [Music]
well over other methods to detect drones I mean a pretty fun of these voluntary measures well if you install in your drone an application that reports to cops that you are flying a drone in a certain area and at 13-time okay no problem at all everything we arrived right so this application give two cops the ability to take down to the drone imani imagine if you install this application on your car okay everything will be alright so perfect
line so how about the counter counter maiasaurs we can use several methods but they are already on the stage like splitter spectrum but you can transmit in our way in a very wide area of Rabi frequency and with the hope that nobody can jump on on all the area freaking hoping you can hope to many channels and use in respective frequencies but the jammer the Emir expect that the drones works in a certain frequencies and robust protocols but we are talking about this well I'm going to explain my
first my first round of this stuff that it is called atropos is our quadcopter that I build like six years ago you can google it using Hockaday and so on and I decided to build with a Wi-Fi router is a Wi-Fi router and Lafon era brutal and well some cool stuff like will remote of Nintendo as inner tell me initial sensors so six years ago there's no Chinese manufactures that you come by and they take your sensor to your home so there was easier to take the the sensor from from the winning Chuck and I decide to to put the sensors to the Rooter directly by attaching the the the bus to light okay and control it by by a web server installed on the Rooter the program the stabilization program is Bramley you see inside the router and it has a an embedded system and also has another capability with bully that is able to to attack other with wi-fi's so you can see the de la Frontera Rooter
some pretty cool and professional soldiering skills and that's perfect
so know what else I like to see this movie because well of the Star Wars movies make me cry so I like this one okay and I like particularly and it scene we count 50cc floor Vader but there is a smile there everybody in our turbolasers that makes that give me an idea why not make a small drone okay with chopsticks okay because people ask
me why why are you using chopsticks do you have a 3d printer or somewhere are you poor or what well if I print the drone no nobody believes me it's mine so this is mine I'm going to check that
actually the drone is draining its battery so maybe I had to to fly before the battle change okay all right so the brain interceptor is based on low budget no seriously low you take a cheap sensor a chips ball and a tip everything my name um sites and wait harder to detect okay and with all staff that the DC on this thing no hugging capabilities and resilient control well this is the drone
and the chopsticks we can see a linux bar inside that is indeed our router we open open wrt Linux distribution inside and some cool stops like loosen motors why whistle because they are cheap ridiculously cheap okay and small so we have transistors and it's the air camera so so you can you can compare with a one euro coin okay and this is the big or
two I think this is more this is a smallest board on the market that these run Linux and we have Wi-Fi yeah does
the specifications and we have a cb1 core of CPU three serial ports and the most important thing is a parallel PWM port there is four rub four ports of pulse width modulation okay these those ports are used to control the motors without any other integrated circuit just because it has to be small it have to be cheap we have to take advantage on all the all the hardware stuff okay so we need four pal pwm signals to control the motors one for each one and they are our real time constrain we cannot emulate an or is very difficult uncomfortable to emulate those signals with the quality required to to make the drone works so we have four channels available we but we only to enable by the manufacturer we have to enable the other one but well what happens when the what the the other two they are the serial debug console good job right okay so we have the disabled to disable the the serial port for debugging and enable all day for things I went to the
forum the guide designed a week or runs with questions and one guy asked for to enable to dispense and the guy as well I say her way you had to do know the way open the Limassol from voqal second find the dds insults I do understand the pin control you have to understand some kind of stuff and then you make magic okay and you will be a good list hacker okay thank you for
nothing guy so you you have the all the stuff that you need to enable and disable all the stuff you have the you are pins defined you hand up in marks okay this is a Mac sir I interconnected inside of the of the other system on chip you have to wire functions while with output because tip has more faction more functions than output and you assign a function and function to an output so you have to to reassign disable the the you are an enable the bubble with modulation we
have to redefine those pins we call I call pal um pins we have the first one the zero the one band they are already defined but I'm going to define the the other two that is called who are two [Music] PWM the group is hard but the faction is PWM additionally in the i2c bus I attach and sensor to to take that count the battery okay we disable you art or we enable the four channels well this is
for only four for your information from the datasheet where I found the information to change that well the
power states is a MOSFET that's mean my work pretending to to know what I am doing with an oscilloscope there is a my my personal version of electronic speed control ok this is the oscilloscope
because with brasses motors we have to deal with a counter electro-motive force because when the motor is spinning I have to do I have to power it but a motor also as a generator and put a current in the circuit our reverse current current so I had to cancel it with a capacitor and a diode Schottky diode this is the bit in the PD tanning
this is the worst part of build a drone you have to tune it from zero zero zero okay
and I'm whoa [Music] I'm going to explain the Wi-Fi architecture of this of this drone that is not a wife a regular drone because it works as a beacon frame based communication that's because if you are not authenticated to any network you cannot beat the authenticated okay you know we come here to a dedication attack and authenticate my drone because it's not authenticated to anything we have a joystick we just if not a fancier se drone remote [Music] [Music] and we have a a pile aside that this is my laptop with an additional Wi-Fi adapter so my my communication protocol is based on beacons become frames so in the payload of those beacon frames travel all the data from from my remote for my joystick and to the pilot and reverbs if you turn on your laptops or mobiles you will see two networks one cow interceptor and the other one called piloto or pilo there are fake networks ok one network is generated bite my laptop and the other network is generated by the drone both sides are designed to listen to east each other and well for control and telemetry as you as you can see that on that slide protected with an encryption algorithm so this is the
packet for packet format and you can see all all the staff of our encryption algorithm we have an initialization vector we have a command a sequence number and integrity check so there is this is the busy they travel inside the beacon frame so I
[Music] we can turn on the drum [Music] I will put on the ground for my safety no for yours [Music] [Music] [Music] maybe I'm going to change the water later I have to change the battery I will check here I bring our Nutter Butter [Music] [Music] well why it starts again I'm going to explain you a particular characteristic of the abyss protocol but because it's allowed me to change the channels of the Wi-Fi of the ball twice the drone and the pilot while I'm flying it without without loosing control that because the Wi-Fi adapters there are no perfect so if you are on channel one you are listening a packet from channel 2 for example this protocol takes advantage of this because if I want to change the channel of the drone to from channel 1 to channel 5 I tailed it wrong change the channel - okay the drone acknowledge that okay and channel to change your view or change to channel 2 so both pilot and wrong are in the channel - so they in a loop changing channels each other until they reach all the to rechannel Phi 4 or a target tunnel that I said this is the interface
well this some common staff of the abyss web interface the info in the interfacing is created on the laptop the Raptor receives the beacon frames they they turn into a WebSocket packet and it's they see on the on the web page so I want to show you a variable
this is the interface on the drone and there are the the networks on my house
the the drone keeps beating the the networks but I can control the drone while the drone is attacking the network's way with bully okay so there is so many networks on on here
I in changing the the channel of the drone well you see they it's over our neurosis in the the change of the other channel you can see you can see that here here channel 8 both okay and they try and they change
simply okay I don't I don't lose the the control that because I don't I don't want to put an extra adapter an extra Wi-Fi adapter on the on the drone okay because it's very expensive is an extra ways to do the wrong especially especially [Music] [Music] are you safe [Music] well it's a it's almost okay so I'm not a very very professional pilot indeed [Music] [Music]
well the other the other investigation that I'm doing with this is to prove that any anybody who is able to build a drone with a custom flight controller like mine this is all all program on see about the stabilization program inside the inside the vehicle and the protocol of communication because I'm working right now on a extra fallback communication system based on SDR okay yes just in case every just in case by a drone jammer detect my network because my network you can see as a pilot or as an interceptor but they can change to to be the same as the of the Nervii networks okay that is to hide the presence of the drone so another protocol is a fallback protocol based on only on FM that is selects an arbitrary frequency inside the brain and start transmitting if the pilot detects that no more telemetry comes from the drone the that the linkage is broken so if is transmitted to with an arbitrary frequency and the Li motive or die's of this project is that transmitting legrand frequencies are the less problem for bad guys if you are to do back things the less of the problem is to transmit on FM okay so this is a warning to to drone manufacturers because I still keep sending comments to the drone even with our Wi-Fi using our raspberry pi radio transmission with our PTX project okay as a proof of concept so I'm selecting the the frequency dynamically so we we survey the the spectrum and I take the the peaks and the valleys and then I select the the best suitable frequency so the for VAR f
n based communication we have a video stick they they are limited to four bytes packet and they are transmitted to FSK modulation using the mini mini mini modem pro yet and there are they turn on into RF format okay we are FM modulated transmission and they are on air by Raspberry Pi so SDR dongle on drone captures that frequency and makes the reverse path okay we have an audio capture and we have to demolish the modulate that packet with the same mini modem but compile with four for the architecture of the drone these MIPS and we have the four byte format for flight control okay okay this was
the demo you can see the unlike Porkins
okay I would like to I would like to explain
more we have more time I will explain a little bit more what what we - I followed - to be tuning because if the hardest part - to make a drone I attach to the six a bench professional-grade with also chopsticks okay and other power other home part on the you can see so you have to tune the piece that is the proportional gain it's a do use and we stay here if the drone still stays here and I want to stay straight there Rory zero is a if is moves there are or chains so we had to multiply the error by the proportional gain okay we have one force the second force is the interval term so I have to take into account how much time is the drone in another state okay and the derivative term is it takes into account the speed that I am reaching the desired position okay that those values multiplied with again we have a real control of the of the drone okay so
this is my pepper okay I would like to
see you
so as conclusions I would like to show
you the conclusions okay [Music]
we have our ridiculous mal size weight and cost this wing to Nana's poem hard working from scratch even you can't track did you buy our Rooter contract that you are building a drone for battle for good okay so we have a side hidden channels communication at a central philosophy no vendor or 340 communications we keep the cost low because we are using Wi-Fi also but we have personal capabilities to keep the communication safe or ask the safe as we can if an expected attack is performed or all the aspects of Wi-Fi the spectrum is SDM we have a file vac system to keep the the drone control we would have people can come steal us we also have a hugging capabilities to hug another Wi-Fi networks pen testing and so on keeping on only one adapter on the drone okay with the same adapter we have a travel we threw out all the Wi-Fi channels so under our control base on SDR protocol so
I would like to thank you to stay here and well if you have any questions so thank you very much [Applause]