The document discusses a project called "The Interceptor" which aims to create small, low-cost nanodrones capable of hacking other drones. It describes using a Vocore2 board to generate PWM signals to control motors and transmit WiFi packets for control. It also proposes a fallback radio frequency transmission method using an SDR and Raspberry Pi in case of WiFi jamming. The project aims to build drones that are difficult to detect with hacking capabilities and resilient control.

1. David Meléndez CanoDavid Meléndez Cano
R&D Embedded Systems Engineer
@taiksontexas
Taiksonprojects.blogspot.com
Project “The Interceptor”:
Owning anti-drone systems with nanodrones

2. David Meléndez Cano
@TaiksonTexas
●
R&D Embedded Software Engineer in
Albalá Ingenieros, S.A. Spain
●
Author of the robots: "Atropos" & "Texas Ranger"
●
Author of the Book "Hacking con Drones"
●
"Reincident" speaker
●
Trainiac

3. David Meléndez Cano
@TaiksonTexas
●
R&D Embedded Software Engineer in
Albalá Ingenieros, S.A. Spain
●
Author of the robots: "Atropos" & "Texas Ranger"
●
Author of the Book "Hacking con Drones"
●
"Reincident" speaker
●
Trainiac

4. David Meléndez Cano
@TaiksonTexas
●
R&D Embedded Software Engineer in
Albalá Ingenieros, S.A. Spain
●
Author of the robots: "Atropos" & "Texas Ranger"
●
Author of the Book "Hacking con Drones"
●
"Reincident" speaker
●
Trainiac

5. David Meléndez Cano
@TaiksonTexas
●
R&D Embedded Software Engineer in
Albalá Ingenieros, S.A. Spain
●
Author of the robots: "Atropos" & "Texas Ranger"
●
Author of the Book "Hacking con Drones"
●
"Reincident" speaker
●
Trainiac

6. @taiksontexas

7. @taiksontexas
Previously in DEFCON...

8. @taiksontexas
Previously in DEFCON...

9. @taiksontexas
Drones as a threat
●
Flying computers. (IoT over your head.)
●
Custom payloads:
– Sniffers
– Jammers
– Network Analyzers
– 3d mapping, cameras.
– Physical attacks, explosives.
– ...

10. @taiksontexas
Detection
●
Thermal and standard cameras
– A.I. to detect drone shape
– Electronics and motor heat detection
●
Characterization of drone noise
●
Detected Radio Frequency and waveform
– Radio signature

11. @taiksontexas
“Voluntary” measures
●
No-fly zone controlled by onboard GPS and
Autopilots
●
Real time telemetry transmission to COPS
●
Give to COPS the ability to take down your
drone and “everything will be alright”

12. @taiksontexas
Counter-Countermeasures
●
Spread-spectrum
●
Frequency hopping
●
Use unespected frequencies by the jammer
●
Robust protocols

13. @taiksontexas
First Round: “ATROPOS”
Dron ATROPOS
●
WiFi Router
●
PIC16F876 for PWM
●
Wii Nunckuck and
Motion + as onboard IMU
●
HTML5 telemetry by router
webserver
●
WiFi comm.
●
WPS Attacks with bully

14. @taiksontexas
First Round: “ATROPOS”
Dron ATROPOS
●
WiFi Router
●
PIC16F876 for PWM
●
Wii Nunckuck and
Motion + as onboard IMU
●
HTML5 telemetry by router
webserver
●
WiFi comm.
●
WPS Attacks with bully

15. @taiksontexas
First Round: “ATROPOS”
Dron ATROPOS
●
WiFi Router
●
PIC16F876 for PWM
●
Wii Nunckuck and
Motion + as onboard IMU
●
HTML5 telemetry by router
webserver
●
WiFi comm.
●
WPS Attacks with bully

16. @taiksontexas
First Round: “ATROPOS”
Dron ATROPOS
●
WiFi Router
●
PIC16F876 for PWM
●
Wii Nunckuck and
Motion + as onboard IMU
●
HTML5 telemetry by router
webserver
●
WiFi comm.
●
WPS Attacks with bully

17. @taiksontexas
Now, what else?
“We count thirty Rebel ships, Lord Vader...
...but they're so small they're evading our
turbolasers”

18. @taiksontexas
Project “The Interceptor”

19. @taiksontexas
Project “The Interceptor”
●
Minimum size and weight (harder to detect)
●
Low budget (no, seriously, really low)
~$40 + $20 with SDR
●
Hacking capabilities
●
“Resilient” control

20. @taiksontexas
Project “The Interceptor”

21. @taiksontexas
Vocore2

22. @taiksontexas
Vocore2

23. @taiksontexas
Vocore2: PWM
●
We need to generate x4 PWM signals to control
the motors
– Hard real time constrained. Need specific HW.
●
x4 channels available, but only 2 enabled
●
Last two overlap with UART2 function
– Disable UART2 in devicetree
– Enable PWMx4 in devicetree

24. @taiksontexas
Vocore2: PWM in the forum
Random guy Q: ¿How can I enable all PWM?

25. @taiksontexas
Vocore2: PWM in the forum
Random guy Q: ¿How can I enable all PWM?

26. @taiksontexas
Vocore2: PWM in the forum
Random guy Q: ¿How can I enable all PWM?

27. @taiksontexas
Vocore2: PWM in the forum
Random guy Q: ¿How can I enable all PWM?

28. @taiksontexas
Vocore2: PWM (pinmux)
./target/linux/ramips/dts/mt7628an.dtsi

29. @taiksontexas
Vocore2: PWM (pinmux)
Pinmux redefinition
ADC chip declaration
Present in I2C for battery
Disabled UART2
Enabled all 4 PWM

30. @taiksontexas
Vocore2: pinmux mt7628
(datasheet)

31. @taiksontexas
Power stage
●
Brushed motors (cheap as hell)
●
X1 MOSFET
●
X1 Capacitor
●
X1 Schottky
diode

32. @taiksontexas
Electrical motor behaviour

33. @taiksontexas
PID tunning

34. @taiksontexas
Interceptor WiFi architecture
JOYSTICK
802.11 beacon injection
DRONE
control
AES encryption
telemetry
WEB interface
Change channel management
AES decryption
802.11 beacon sniffing
Websocket
802.11 beacon sniffing
AES decryption
Websocket
802.11 beacon injection
Flight control
And change channel
management
AES encryption
PILOT SIDE AIRCRAFT SIDE

35. Header
AP
“INTERCEPTORINTERCEPTOR”
COMMAND
Preamble
Gas
Pitch
Roll
Yaw
SEQUENCE
NUMBER
SHA256
INITIALIZATION
VECTOR
Forged Beacon Frame injec
on (PILOT SIDE)
AES-128
BEACON FRAME PAYLOADBEACON FRAME PAYLOADHEADER
Interceptor WiFi architecture

36. @taiksontexas
Interceptor WiFi architecture
PILOT DRONE
My channel: 13; Target channel:12
My channel: 12; Target channel:11
My channel: 11; Target channel:10
My channel: 12
CH:13 CH:13
CH:12
CH:12
CH:11
My channel: 11
CH:11
Etc...

37. @taiksontexas
YAW Indicator
Sequence number
“Ultimate target” channel
Current/target Channel
Pitch/roll Indicator
WiFi mode: monitor or mon+sta/ap
ADC in voltage
Audit console/camera
MOTOR PWM
LEVELS

38. @taiksontexas
Fallback FM based TX
●
For a WiFi complete jamming scenario
●
Transmit with an arbitrary frequency
●
Demo in FM band
●
Transmitting in illegal frequencies are the least
problem for bad guys
●
Rpi radio transmission causes harmonics.
Really a problem?

39. @taiksontexas
Fallback FM based TX
http://asliceofraspberrypi.blogspot.com/2014/10/generating-
radio-frequencies-using.html

40. @taiksontexas
Fallback FM based TX
JOYSTICK
Pilot (RPI)
FSK
modulation
RF format
conversion
FM modulated
transmission GPIO
4 bytes
packet DRONE
SDR FM
capturecontrol
Wav audio
conversion
FSK
demodulation
4 byte
For flight control
Connected to antenna
When timeout

41. @taiksontexas

42. David Meléndez CanoDavid Meléndez Cano
R&D Embedded Systems Developer
@taiksontexas
Taiksonprojects.blogspot.com
Acknowledges:
José Manuel Hernández
Jesús Fernández
Javier Hernández
Vicente Polo
Daniel Iglesias
Adrian Aznar
Thank you!