Antidrone system industries have arised. Due to several, and even classic, vulnerabilities in communication systems now used by drones , anti-drone systems are able to take down those drone by means of well documented attacks. Drone/antidrone competition has already been set into the scene. This talk provides a new vision about drone protection against anti-drone systems, presenting "The Interceptor Project", a nanodrone that is very far from being a kit-assembled drone, but an embedded and hand-sized nano drone based on single-core tiniest Linux Board: Vocore2. This Linux board manages a Wi

1. David Meléndez CanoDavid Meléndez Cano
R&D Embedded Systems Engineer
@taiksontexas
Taiksonprojects.blogspot.com
Project “The Interceptor”:
Owning anti-drone systems with nanodrones

2. David Meléndez Cano
@TaiksonTexas
●
R&D Embedded Software Engineer in
Albalá Ingenieros, S.A. Spain
●
Author of the robots: "Atropos" & "Texas Ranger"
●
Author of the Book "Hacking con Drones"
●
"Reincident" speaker
●
Trainiac

3. David Meléndez Cano
@TaiksonTexas
●
R&D Embedded Software Engineer in
Albalá Ingenieros, S.A. Spain
●
Author of the robots: "Atropos" & "Texas Ranger"
●
Author of the Book "Hacking con Drones"
●
"Reincident" speaker
●
Trainiac

4. David Meléndez Cano
@TaiksonTexas
●
R&D Embedded Software Engineer in
Albalá Ingenieros, S.A. Spain
●
Author of the robots: "Atropos" & "Texas Ranger"
●
Author of the Book "Hacking con Drones"
●
"Reincident" speaker
●
Trainiac

5. David Meléndez Cano
@TaiksonTexas
●
R&D Embedded Software Engineer in
Albalá Ingenieros, S.A. Spain
●
Author of the robots: "Atropos" & "Texas Ranger"
●
Author of the Book "Hacking con Drones"
●
"Reincident" speaker
●
Trainiac

6. @taiksontexas

7. @taiksontexas
Previously in DEFCON...

8. @taiksontexas
Previously in DEFCON...

9. @taiksontexas
Drones as a threat
●
Flying computers. (IoT over your head.)
●
Custom payloads:
– Sniffers
– Jammers
– Network Analyzers
– 3d mapping, cameras.
– Physical attacks, explosives.
– ...

10. @taiksontexas
Detection
●
Thermal and standard cameras
– A.I. to detect drone shape
– Electronics and motor heat detection
●
Characterization of drone noise
●
Detected Radio Frequency and waveform
– Radio signature

11. @taiksontexas
“Voluntary” measures
●
No-fly zone controlled by onboard GPS and
Autopilots
●
Real time telemetry transmission to COPS
●
Give to COPS the ability to take down your
drone and “everything will be alright”

12. @taiksontexas
Counter-Countermeasures
●
Spread-spectrum
●
Frequency hopping
●
Use unespected frequencies by the jammer
●
Robust protocols

13. @taiksontexas
First Round: “ATROPOS”
Dron ATROPOS
●
WiFi Router
●
PIC16F876 for PWM
●
Wii Nunckuck and
Motion + as onboard IMU
●
HTML5 telemetry by router
webserver
●
WiFi comm.
●
WPS Attacks with bully

14. @taiksontexas
First Round: “ATROPOS”
Dron ATROPOS
●
WiFi Router
●
PIC16F876 for PWM
●
Wii Nunckuck and
Motion + as onboard IMU
●
HTML5 telemetry by router
webserver
●
WiFi comm.
●
WPS Attacks with bully

15. @taiksontexas
First Round: “ATROPOS”
Dron ATROPOS
●
WiFi Router
●
PIC16F876 for PWM
●
Wii Nunckuck and
Motion + as onboard IMU
●
HTML5 telemetry by router
webserver
●
WiFi comm.
●
WPS Attacks with bully

16. @taiksontexas
First Round: “ATROPOS”
Dron ATROPOS
●
WiFi Router
●
PIC16F876 for PWM
●
Wii Nunckuck and
Motion + as onboard IMU
●
HTML5 telemetry by router
webserver
●
WiFi comm.
●
WPS Attacks with bully

17. @taiksontexas
Now, what else?
“We count thirty Rebel ships, Lord Vader...
...but they're so small they're evading our
turbolasers”

18. @taiksontexas
Project “The Interceptor”

19. @taiksontexas
Project “The Interceptor”
●
Minimum size and weight (harder to detect)
●
Low budget (no, seriously, really low)
~$40 + $20 with SDR
●
Hacking capabilities
●
“Resilient” control

20. @taiksontexas
Project “The Interceptor”

21. @taiksontexas
Vocore2

22. @taiksontexas
Vocore2

23. @taiksontexas
Vocore2: PWM
●
We need to generate x4 PWM signals to control
the motors
– Hard real time constrained. Need specific HW.
●
x4 channels available, but only 2 enabled
●
Last two overlap with UART2 function
– Disable UART2 in devicetree
– Enable PWMx4 in devicetree

24. @taiksontexas
Vocore2: PWM in the forum
Random guy Q: ¿How can I enable all PWM?

25. @taiksontexas
Vocore2: PWM in the forum
Random guy Q: ¿How can I enable all PWM?

26. @taiksontexas
Vocore2: PWM in the forum
Random guy Q: ¿How can I enable all PWM?

27. @taiksontexas
Vocore2: PWM in the forum
Random guy Q: ¿How can I enable all PWM?

28. @taiksontexas
Vocore2: PWM (pinmux)
./target/linux/ramips/dts/mt7628an.dtsi

29. @taiksontexas
Vocore2: PWM (pinmux)
Pinmux redefinition
ADC chip declaration
Present in I2C for battery
Disabled UART2
Enabled all 4 PWM

30. @taiksontexas
Vocore2: pinmux mt7628
(datasheet)

31. @taiksontexas
Power stage
●
Brushed motors (cheap as hell)
●
X1 MOSFET
●
X1 Capacitor
●
X1 Schottky
diode

32. @taiksontexas
Electrical motor behaviour

33. @taiksontexas
PID tunning

34. Header
AP
“INTERCEPTORINTERCEPTOR”
COMMAND
Preamble
Gas
Pitch
Roll
Yaw
SEQUENCE
NUMBER
SHA256
INITIALIZATION
VECTOR
Forged Beacon Frame injection (PILOT SIDE)
AES-128
BEACON FRAME PAYLOADBEACON FRAME PAYLOADHEADER
Interceptor WiFi architecture

35. @taiksontexas
YAW Indicator
Sequence number
“Ultimate target” channel
Current/target Channel
Pitch/roll Indicator
WiFi mode: monitor or mon+sta/ap
ADC in voltage
Audit console/camera
MOTOR PWM
LEVELS

36. @taiksontexas

37. David Meléndez CanoDavid Meléndez Cano
R&D Embedded Systems Developer
@taiksontexas
Taiksonprojects.blogspot.com
Acknowledges:
José Manuel Hernández
Jesús Fernández
Javier Hernández
Vicente Polo
Daniel Iglesias
Adrian Aznar
Thank you!