DEF CON 23 - Robinson and Mitchell - Knocking my neighbors kids cruddy drone offline
DEFCONConference
AI-assisted summary of DEF CON 23 - Robinson and Mitchell - Knocking my neighbors kids cruddy drone offline — original source. Check the original for full context.
Source published:
Key ideas
- The Parrot Bebop operates as an open Wi-Fi network running unauthenticated FTP and Telnet daemons on outdated BusyBox firmware, allowing unauthorized devices to exfiltrate footage or trigger mid-air shutdowns. (12:38)
- DJI's Phantom 3 relies on proprietary RF links immune to Wi-Fi hijacking, but it can be grounded pre-flight using localized magnets or destabilized in flight by interrupting unencrypted civilian GPS reception. (25:50)
- Analysis of flight logs in Eastern US metro areas showed widespread disregard for no-fly zones, with over 2,000 unauthorized consumer drone flights recorded in Washington, D.C. and New York City. (2:17)
- Federal communications law prohibits civilian GPS jamming with FCC fines up to $112,000, prompting researchers to explore low-power RF testing and physical sensor disruption. (19:48)
Detailed notes
## Background Published on YouTube by the DEFCONConference channel on December 25, 2015, this presentation captures security researcher Michael Robinson at DEF CON 23. According to the video description, the talk documents Robinson's practical research into whether low-level radio signals and targeted RF disruption can force commercial drones—specifically the DJI Phantom 3 and Parrot Bebop—to land without resorting to illegal broadband jamming or physical violence after a neighbor's kid repeatedly flew a quadcopter outside his windows.
## TL;DR Motivated by an intrusive neighborhood drone, Michael Robinson investigates and demonstrates practical electronic vectors to neutralize consumer quadcopters. Analyzing the Parrot Bebop, he reveals severe security shortcomings, demonstrating that Wi-Fi deauthentication, unauthenticated FTP access, and open Telnet sessions allow an attacker to hijack flight controls or execute terminal shutdown scripts that drop the craft mid-air. Shifting to the DJI Phantom 3, Robinson investigates its client-side FlySafe no-fly database, the impact of GPS disruption on automated Return-to-Home stabilization, and how localized magnetic fields prevent the craft from taking off. Across both platforms, Robinson contrasts technical vulnerabilities with federal jamming laws, warning that drone makers must secure open protocols before clumsy government legislation intervenes.
## Atmosphere & style The talk carries an irreverent, humorous hacker-conference energy fueled by a relatable personal vendetta against an annoying neighborhood nuisance. Robinson presents with a dry, conversational wit, balancing serious digital forensic insight with candid tales of destroying test drones against his kitchen stove and losing equipment to ceiling fans. The mood is interactive and collegial, underscored by DEF CON mischief—including audience members discovering and hacking Robinson's open airborne Telnet port before he even took the stage.
## Bulletin - [12:38](https://www.youtube.com/watch?v=5CzURm7OpAA&t=758s) The Parrot Bebop operates as an open Wi-Fi network running unauthenticated FTP and Telnet daemons on outdated BusyBox firmware, allowing unauthorized devices to exfiltrate footage or trigger mid-air shutdowns. - [25:50](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1550s) DJI's Phantom 3 relies on proprietary RF links immune to Wi-Fi hijacking, but it can be grounded pre-flight using localized magnets or destabilized in flight by interrupting unencrypted civilian GPS reception. - [02:17](https://www.youtube.com/watch?v=5CzURm7OpAA&t=137s) Analysis of flight logs in Eastern US metro areas showed widespread disregard for no-fly zones, with over 2,000 unauthorized consumer drone flights recorded in Washington, D.C. and New York City. - [19:48](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1188s) Federal communications law prohibits civilian GPS jamming with FCC fines up to $112,000, prompting researchers to explore low-power RF testing and physical sensor disruption.
## Key takeaways - [02:17](https://www.youtube.com/watch?v=5CzURm7OpAA&t=137s) Hobbyist drone operations remain largely unregulated in practice compared to strict commercial FAA oversight, resulting in extensive airspace violations across major metropolitan no-fly zones. - [10:44](https://www.youtube.com/watch?v=5CzURm7OpAA&t=644s) Parrot Bebop drones function as open Wi-Fi access points that accept multiple concurrent client connections without network authentication. - [10:44](https://www.youtube.com/watch?v=5CzURm7OpAA&t=644s) Sending 802.11 deauthentication frames to the Bebop triggers an abrupt motor shutdown and drop rather than executing its intended autonomous Return to Home protocol. - [12:38](https://www.youtube.com/watch?v=5CzURm7OpAA&t=758s) An unauthenticated Telnet session into the Bebop's embedded Linux environment allows an attacker to execute shell scripts that immediately cut motor power during flight. - [16:09](https://www.youtube.com/watch?v=5CzURm7OpAA&t=969s) Deauthenticating an operator's tablet initiates a race condition where the victim's device auto-reconnects to recognized home Wi-Fi networks, granting the attacker exclusive flight control. - [19:48](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1188s) Federal communications law strictly prohibits radio and GPS jamming under severe civil and criminal penalties, imposing fines of up to $16,000 per day and $112,000 total. - [22:23](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1343s) Subjecting the Parrot Bebop to localized GPS denial causes it to abort Return to Home navigation and freeze in a stationary hover until the battery depletes. - [22:23](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1343s) Mobile control applications store unencrypted forensic artifacts, such as device identifiers, flight timestamps, and hardware serial numbers, within local configuration files. - [25:50](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1550s) The DJI Phantom 3 communicates over proprietary Lightbridge RF rather than open Wi-Fi, preventing network-based in-flight hijacking. - [25:50](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1550s) DJI enforces geofencing restrictions through a mobile SQLite database containing over 10,000 coordinates, but the database is stored client-side and can be modified locally. - [27:38](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1658s) Disrupting the GPS signal on a Phantom 3 disables autonomous stabilization, induces video stream latency, and causes Return to Home navigation to overshoot its origin. - [27:38](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1658s) Placing localized magnets near the Phantom 3 takeoff area triggers persistent compass calibration errors that prevent the flight controller from arming the motors. - [33:59](https://www.youtube.com/watch?v=5CzURm7OpAA&t=2039s) Switching the DJI Phantom 3 into attitude mode (A-mode) bypasses satellite-dependent geofencing, allowing flights within restricted zones. - [38:14](https://www.youtube.com/watch?v=5CzURm7OpAA&t=2294s) Placing a 2-inch by 2-inch square of standard aluminum foil over the top housing of a DJI Phantom 3 physically blocks satellite reception and neutralizes GPS lock. - [43:08](https://www.youtube.com/watch?v=5CzURm7OpAA&t=2588s) Without proactive industry self-regulation and secure-by-default wireless configurations, rising safety and privacy incidents risk triggering heavy-handed legislative bans.
## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=5CzURm7OpAA&t=0s) The Neighbor's Drone and the Urge to Take It Down
Michael Robinson opens by expressing how fun it was to prepare the talk and gives shout-outs to friends and contributors who helped, noting that a few who preferred anonymity had their names printed in black on his slides. He quickly dives into his real-world motivation: a neighbor and his kid whom he describes as “annoying snots” fueled by “way too much discretionary spending.” One day, a quadcopter suddenly appeared, piloted by the kid, who constantly crashed it into neighborhood cars, houses, and trees. At night, Robinson noticed the drone hovering outside windows: “It's like really, dude? That's what the Internet is for.”
His instinctive initial reaction was to imagine blasting it out of the sky with a shotgun. Acknowledging previous DEF CON presentations that emphasized why shooting down drones is legally and practically problematic, Robinson points out the escalating trend of weaponized hobby drones, including news stories of hobbyists in New England mounting semiautomatic handguns to homemade multirotors. If people can mount handguns, shotguns, or even machine guns, the need to reliably counter nuisance drones becomes an urgent practical question. Rather than turning to physical firearms, Robinson wanted to look for a cleaner, more subtle technological approach to force a drone to land or leave.
[02:17](https://www.youtube.com/watch?v=5CzURm7OpAA&t=137s) Drone Regulations, DHS Encounters, and Widespread Violations
Surveying the legal landscape, Robinson points out that although there are countless overlapping regulations attempting to control Unmanned Aircraft Systems (UAS), the majority of strict enforcement targets commercial operations requiring FAA approval or government drone use, while hobbyists remain largely unregulated. To illustrate this, Robinson recounts testing his DJI Phantom 3 in a parking lot when an officer from the Department of Homeland Security's (DHS) drone enforcement division for the Washington, D.C. area approached him:
> “He goes, do you know what the rules are? Yeah. He goes, are you doing this for commercial use. I said no. He goes okay, see ya.”
Robinson pressed the agent for details on local enforcement headaches. The agent described an incident where an operator flew a quadcopter over Nationals Park stadium, lost control of it, and was easily caught: > “Most of the guys who lose these things, you see them running over the hill with their controller, have you seen my drone?”
Existing airspace restrictions include: - **Washington, D.C. Flight-Restricted Zone:** A 15-mile radius centered on the White House where flights are strictly prohibited. - **Airports:** A five-mile buffer zone requiring air traffic control permission, effectively blanketing almost all of New York City (aside from a few parks, with city sidewalks off-limits under reckless endangerment statutes). - **Military Bases:** Complete prohibition. - **National Parks:** Operators cannot legally launch or land inside a national park; while the park service cannot technically regulate the airspace above, rangers will cite operators for reckless endangerment and confiscate equipment, as happened to a pilot filming a sunset over the Grand Canyon. - **Temporary Flight Restrictions (TFRs):** Issued for disaster relief zones, wildfires, sports stadiums, large public assemblies, and several hours surrounding presidential visits. - **Operational Rules:** A 400-foot ceiling (contrasted with Amazon lobbying for a dedicated delivery corridor up to 700 feet with a 100-foot buffer), line-of-sight flying rules, and an outright ban on mounting weapons.
Despite these rules, compliance is virtually nonexistent among average consumers. Robinson compared eastern U.S. no-fly zone maps against public flight logs uploaded directly to Parrot's cloud service from customer devices. The data revealed over 2,000 recorded flights right in Washington, D.C., and more than 2,000 in New York City, proving that consumers are oblivious to airspace rules or disregard them entirely.
```mermaid flowchart TD accTitle: Recreational Drone Airspace Rules vs Reality accDescr: Diagram illustrating common drone airspace restrictions and high consumer violation rates.
subgraph Restrictions["Airspace Restrictions"] A["15-Mile D.C. FRZ"] B["5-Mile Airport Buffer"] C["National Parks (Launch/Land Ban)"] D["400-Foot Altitude Ceiling"] end
subgraph Enforcement["Enforcement Focus"] E["Commercial Operations (FAA Approvals)"] F["Reckless Endangerment Citations"] end
subgraph Reality["Observed Reality"] G["Hobbyists Unregulated & Uninformed"] H["2,000+ Recorded Flights in DC No-Fly Zone"] I["2,000+ Recorded Flights in NYC"] end
Restrictions --> Enforcement Enforcement -.->|"Fails to curb"| G G --> H G --> I ```
[07:59](https://www.youtube.com/watch?v=5CzURm7OpAA&t=479s) Profiling the Parrot Bebop: Return to Home and Hardware Specs
To systematically research forced landings, Robinson targeted two market-dominant platforms: the Parrot Bebop and the DJI Phantom 3. Analyzing the Parrot Bebop reveals that it is essentially a high-speed Linux computer: - Powered by a quad-core processor and internal memory. - Capable of a top horizontal speed of 45 mph. - Equipped with a forward-facing 1080p camera. - Functions out of the box as an open flying Wi-Fi router with DHCP enabled. - Equipped with a GNSS receiver capable of processing both American GPS and Russian GLONASS constellations. - Controlled via the FreeFlight 3 mobile app for iOS and Android, which checks Parrot's servers directly for updates without forcing them through standard app stores.
Robinson paid close attention to the Bebop's automated Return to Home (RTH) logic. If commanded to return home: - If the drone is flying **above 10 meters**, it maintains its altitude and navigates straight back to the takeoff coordinates. - If the drone is flying **below 10 meters**, it automatically climbs straight up to approximately 30 feet, turns to face home, and returns along a direct path.
Robinson notes the danger of this automated altitude climb from personal experience: triggering RTH indoors where GPS is active can send the drone straight into a ceiling fan: > “That's how I lost my first drone.”
According to Parrot's documentation, if the Bebop loses its Wi-Fi connection to the flight controller for 30 seconds, it is programmed to autonomously initiate Return to Home.
[10:44](https://www.youtube.com/watch?v=5CzURm7OpAA&t=644s) Wi-Fi Exploits: Deauth Failsafe and Open Services
Robinson evaluated taking over or neutralizing the Bebop over Wi-Fi. The Bebop advertises its own Wi-Fi SSID and MAC address, allowing standard reconnaissance tools—such as a Wi-Fi Pineapple—to map it. The control link relies on an underlying Wi-Fi connection over which the mobile control application talks to the drone's software.
Testing the documented 30-second disconnect failsafe, Robinson repeatedly targeted the connection with 802.11 deauthentication frames for 30 seconds across five separate trials. Instead of triggering a clean Return to Home, the drone repeatedly failed: > “The return to home function did not work correctly for me. And I did this like five times. I lost like six propellers at the time doing this test.”
During the deauth attack, the Bebop hovered briefly, completely shut off all four rotors at once, and dropped straight down like a stone. While it failed to return home gracefully, it effectively brought the drone down onto Robinson's property where he could confiscate it.
Taking the investigation further, Robinson port-scanned the airborne drone using Nmap: > “Yup, it's a flying FTP server just floating around.”
The scan revealed wide-open internal network services. Up to ten devices could associate to the drone's Wi-Fi network simultaneously; although only one device ran the active FreeFlight control app, the remaining nine unauthenticated clients could freely probe the system. Browsing the Bebop's exposed FTP server, Robinson immediately spotted critical filesystems, particularly the open media directory storing the camera's captured footage.
[12:38](https://www.youtube.com/watch?v=5CzURm7OpAA&t=758s) Telnet, Outdated BusyBox, and Mid-Air Shutdowns
Investigating the Parrot Bebop drone's open architecture revealed shocking security lapses. Connecting to the drone over FTP required absolutely no authentication, giving direct access to thumbnail directories and recorded videos. While the drone was in flight, Robinson realized he could easily exfiltrate videos or swap stored pictures with anything he wanted. Taking it a step further, he opened a Telnet session directly into the aircraft while it was airborne, uncovering the full underlying directory structure. The drone was running a version of BusyBox that had not been updated in roughly three years, missing at least ten subsequent security releases despite the hardware having been purchased brand-new only months prior.
```mermaid flowchart TD accTitle: Telnet Exploit and Mid-Air Shutdown Flow accDescr: Telnet access to the Bebop drone triggers an immediate hard motor shutdown without graceful landing. subgraph Access["Network Access"] A["Open Drone Wi-Fi"] --> B["Unauthenticated FTP / Telnet"] end subgraph Exploitation["Exploitation"] B --> C["Inspect Outdated BusyBox & Shell Scripts"] C --> D["Execute Shutdown Shell Script"] end subgraph Consequence["Physical Consequence"] D --> E["Rotors Instantly Cut Off"] E --> F["Crash Landing: Kitchen Stove / Park Turf"] end ```
Browsing the file system, Robinson noticed several shell scripts. During an experiment with his second drone hovering inside his kitchen, he decided to execute one of the shutdown scripts to see how the system would react. Rather than initiating a controlled, graceful descent, the drone abruptly killed its rotors, dropped out of the air, and smashed straight into his kitchen stove. Testing the command outside in a park produced identical results: the drone immediately tumbled out of the sky without any recovery mechanism. When close to a wall, aerodynamic updrafts made the descent completely unpredictable. Robinson had intended to demonstrate this live at DEF CON, but upon powering on the drone that morning, six attendees had already discovered the wide-open Telnet port and connected to it before he could even take the stage. As Michael Robinson observed of the sudden crash, “I was thinking the shutdown feature would gracefully shut down the rotors and down it would go.”
- **Unauthenticated Services**: Open FTP access exposed flight videos and thumbnail caches with zero credential requirements. - **Outdated Embedded Linux**: The system ran a BusyBox build that was roughly three years old and lagged ten updates behind current releases. - **Abrupt Power Cut**: Executing the shutdown shell script severed power to the motors instantly rather than initiating a controlled landing sequence. - **Conference Shenanigans**: Six DEF CON attendees hijacked Robinson’s open Telnet session within minutes of him powering on the unit at the venue.
---
[16:09](https://www.youtube.com/watch?v=5CzURm7OpAA&t=969s) Wi-Fi Deauthentication and Hijacking the Parrot Bebop
Instead of simply crashing a neighbor's drone, Robinson explored complete airborne theft by exploiting the multi-client nature of the drone’s wireless network. When the legitimate pilot controlled the Bebop via an iPad using the FreeFlight application, multiple other devices could associate with the drone's open access point at the same time. While a secondary device could connect at the network layer, the mobile application itself would not take over until the primary controller was kicked off. Robinson weaponized an 802.11 deauthentication frame targeting the victim's iPad. The moment the deauth hit, the operator's tablet disconnected, triggering an intentional race condition.
```mermaid flowchart LR accTitle: Deauth Hijack Race Condition accDescr: An attacker deauths the victim, whose device reconnects to a known network, allowing the attacker to seize control. subgraph Pilot["Legitimate Pilot"] P1["iPad running FreeFlight"] -->|"Deauth Packet"| P2["Disconnected"] P2 -->|"Auto-reconnects to Home/Hotspot Wi-Fi"| P3["App Freezes / Lost Control"] end subgraph Attacker["Attacker"] A1["iPhone connected to Drone AP"] -->|"Target Deauthed"| A2["App Establishes Control"] A2 -->|"Hits Emergency or Flight Controls"| A3["Full Aircraft Takeover"] end ```
The race condition heavily favors the attacker. If the victim operates the drone indoors or near known Wi-Fi infrastructure, iOS automatically prioritizes and reconnects to known networks (such as a home router) rather than reconnecting to the ad-hoc drone network. This leaves the victim's application frozen while Robinson’s iPhone claimed control of the drone. Although the flight app initially showed an altitude reading of zero meters despite hovering three feet in the air, full manual control was established. From there, Robinson could steer the aircraft away or tap the "Emergency" button to cut the motors and drop it immediately. The vulnerability proved even wider on high-end setups: the optional Parrot SkyController range extender acts as an open wireless access point. Deauthenticating the wirelessly linked iPad resting in the SkyController cradle allowed an attacker to associate an external mobile device, effectively seizing control icons, bouncing command authority back and forth at will, and locking the legitimate pilot out entirely.
- **Simultaneous Client Connections**: The Bebop permitted roughly ten concurrent network devices on its open Wi-Fi network. - **Wi-Fi Deauthentication Race**: Striking the controller with deauth frames exploited iOS's preference for recognized home networks, stranding the pilot's app while the attacker seized control. - **Telemetry Disconnect**: Upon hijacking, the FreeFlight app assumed an altitude of zero meters despite the drone hovering a meter off the floor. - **SkyController Exposure**: The expensive standalone dock acted as another open wireless access point, leaving its control stream exposed to wireless hijacking.
---
[19:48](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1188s) GPS Jamming Experiments and Regulatory Pitfalls
Examining control vectors beyond Wi-Fi led directly to satellite navigation systems, which utilize specific civilian frequency bands across both the United States GPS constellation and the Russian GLONASS network. Disrupting these signals could theoretically force a drone to land, but federal regulations impose severe penalties. In the United States, operating, manufacturing, or marketing GPS jamming hardware is illegal under federal communications law, carrying daily fines of $16,000 up to a statutory ceiling of $112,000 per violation, with public enforcement actions posted directly on the FCC website.
When Robinson explored how to conduct legal tests, he encountered sharply contrasting advice from authorities. A Department of Homeland Security official off-handedly remarked that nobody could track down an operator running a single, fleeting test in the field. An attorney delivered the strict legal reality, warning that federal jamming prohibitions carry no scientific research exemptions. Finally, a local police officer pointed out that the spirit of the statute centers on public safety and signal disruption; testing deep in the woods, 20 miles away from civilian infrastructure under law enforcement supervision, would theoretically mitigate real-world hazards. Robinson acquired a compact test jammer online for $25 with an effective radius of approximately 20 meters, but the supervising officer immediately confiscated the device following the demonstration. As Michael Robinson recounted regarding legal warnings from counsel, “I spoke to an attorney, an attorney said yeah, it's still illegal no matter what.”
- **FCC Penalties**: Operating unauthorized radio jamming equipment risks fines of $16,000 per day, scaling up to $112,000 total alongside potential criminal liability. - **Multi-GNSS Frequencies**: Target commercial drones routinely incorporate receiver chipsets listening to both US GPS and Russian GLONASS channels. - **Hardware Availability**: The evaluation hardware was obtained online for roughly $25, outputting sufficient power to deny satellite locks across a 20-meter perimeter. - **Law Enforcement Intervention**: The participating police officer confiscated the test transmission hardware on site immediately after the experimental runs.
---
[22:23](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1343s) Bebop Jamming Behavior and Digital Forensics
When the $25 signal generator was activated against an airborne Parrot Bebop in "Return to Home" mode, the safety protocol collapsed immediately. Denied GPS positioning, the drone halted forward travel, failed to recalculate a trajectory, and froze in a stationary hover. Even when jamming ceased and satellite reception returned, the Bebop refused to resume its return flight; it remained suspended in place, entirely lost. Robinson noted that flying beneath highway bridges or through heavy tree canopies triggered the exact same failure mode. By comparison, subjecting the Bebop to intense localized magnetic fields—such as neodymium magnets harvested from disassembled computer hard drives—produced no observable deviation in flight or sensor orientation.
Robinson emphasized that taking over or tampering with another individual's drone leaves explicit digital footprints. Mobile control software records operational sessions, pairings, and device handshakes. Anyone auditing an iOS device will find property list (`.plist`) configuration and log files detailing precise timestamps, client identifiers, and the specific hardware serial numbers of both the mobile handset and the hijacked drone.
- **Return to Home (RTH) Failure**: Jamming satellite reception aborted the flight path, locking the Bebop in place in hover mode even after valid signals returned. - **Environmental Parallels**: Flying beneath bridge structures or thick foliage replicated the artificial satellite denial, causing the drone to stop and hover blindly. - **Magnetic Invariance**: Hard drive magnets positioned directly against the Bebop airframe caused zero noticeable drift or sensor confusion. - **Forensic Footprints**: Forensic extraction of iOS devices exposes files containing exact flight dates, time records, and unique hardware serial numbers tied to the drone.
---
[23:52](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1432s) Transition to the DJI Phantom 3: Hardware, Sensors, and Firmware Locks
Turning to larger consumer platforms, Robinson evaluated the DJI Phantom 3. Unlike lightweight toys, the Phantom 3 was built with serious flight capability: top horizontal speeds reaching roughly 35 miles per hour, operational ranges spanning several hundred meters, and receiver hardware binding simultaneously to GPS and GLONASS satellite constellations. Due to high-profile airspace violations earlier that year, DJI implemented strict built-in geofencing. Operating within designated exclusion zones prompts active warning banners or triggers automatic, non-negotiable descent sequences.
```mermaid flowchart TD accTitle: DJI Phantom 3 Pre-Flight Restrictions accDescr: Firmware update enforcement and magnetic interference checks preventing Phantom 3 takeoffs. subgraph Firmware["Firmware Lockout"] A["New DJI Firmware Released"] --> B{"Applied via MicroSD?"} B -- "No" --> C["Takeoff Blocked by DJI App"] B -- "Yes" --> D["Firmware Updated (No Rollback)"] end subgraph Sensors["Sensor Environment"] D --> E{"Nearby Magnetic Fields?"} E -- "Yes" --> F["Compass Calibration Failure"] E -- "No" --> G["Flight Permitted"] end ```
Unlike the Parrot Bebop, the Phantom 3 proved exquisitely sensitive to electromagnetic fields, demanding meticulous compass recalibrations whenever initialized near ferrous metal or magnetic anomalies. Robinson also highlighted DJI's heavy-handed firmware update mechanism. Contradicting claims made by other researchers, Robinson explained that whenever DJI pushed a new firmware revision, the flight application barred takeoff until the update was applied. Inquiries to DJI technical support confirmed that firmware rollbacks were impossible: users were instructed that the newest patch must be written to a MicroSD card and flashed to the drone, permanently locking out prior versions. Describing his frustrating exchange with customer support, Michael Robinson recalled, “I contacted their tech support on three different occasions to get three different guys and I said hey, what's the deal with your updates and they're like sorry man, that's the way it is.”
- **Flight Performance**: The DJI Phantom 3 features top horizontal speeds of 35 mph and flight ranges extending several hundred meters. - **Dual Positioning**: The navigation system relies on both US GPS and Russian GLONASS constellations to establish position locks. - **Geofencing Controls**: Built-in airspace restrictions trigger cockpit warning notifications or mandate immediate autonomous landing routines. - **Compass Calibration**: The Phantom 3 is highly susceptible to electromagnetic interference, requiring recurrent ground compass calibrations. - **Mandatory Firmware Upgrades**: Takeoff is blocked by software until the newest firmware image is installed via MicroSD, with zero downgrade paths supported.
[25:50](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1550s) Disrupting the Phantom 3 and Inspecting the FlySafe Database
When examining how to knock a DJI Phantom 3 out of the sky, Michael Robinson explains that trying to disrupt a Wi-Fi connection yields zero results because the Phantom 3 does not communicate over Wi-Fi. This led the investigation directly toward what happens when its GPS signal is disrupted. Looking closely into the accompanying mobile control application rather than the aircraft’s onboard firmware, Robinson discovered a SQLite database called "fly safe places." As of July 24th, that database contained exactly 10,914 entries specifying latitude and longitude coordinates for no-fly zones across the globe. Each entry recorded metadata including the country ID, city, location name, boundary shape, radius, whether an in-app warning or a full flight disablement would be triggered, and a timestamp marking when the zone was added to DJI's registry.
Robinson found it trivial to extract this database and manipulate its entries. Under normal operating conditions in an open, nondescript area, the DJI pilot interface displays a green "Safe to fly (GPS)" indicator at the top alongside a live map in the bottom right corner. However, if a GPS test signal generator is activated, the craft instantly drops its satellite lock. While diagnostics continue reporting the frequencies used to stream video downlink telemetry back to an attached tablet, losing GPS completely destabilizes the flight software.
- The mobile application's internal database contained 10,914 designated no-fly entries as of July 24th. - Database entries define geographic polygons or circular radii, alert thresholds (warning vs. disable), and location identifiers. - Robinson was able to download and modify the database entries locally on his device.
```mermaid flowchart TD accTitle: DJI Phantom 3 GPS and Database Architecture accDescr: Diagram illustrating the controller app FlySafe database and GPS signal disruption leading to loss of stability. subgraph MobileController["Mobile App & Controller"] DB["FlySafe Database<br/>(10,914 Entries)"] UI["DJI Pilot Interface<br/>Safe to Fly Indicator"] end subgraph DroneCraft["DJI Phantom 3"] GPSRecv["GPS Receiver Module"] FlightCtrl["Flight Controller"] VideoTx["Video Stream Downlink"] end DB -->|"defines no-fly coordinates"| UI GPSRecv -->|"position hold & RTH"| FlightCtrl FlightCtrl -->|"telemetry & choppiness"| VideoTx VideoTx --> UI ```
---
[27:38](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1658s) Flight Instability, Failed Return-to-Home, and Compass Sabotage
Once GPS lock is stripped away, the Phantom 3 behaves erratically. The digital video feed relayed to the pilot's iPad develops severe latency and becomes extremely choppy. More dangerously, the automated "Return to Home" (RTH) fails entirely: instead of returning to its recorded takeoff coordinates, the drone drifts aimlessly and flies straight past its home point. Robinson notes that all the refined automated stabilization that makes the Phantom 3 easy to pilot vanishes, reverting the craft to raw manual handling where even a mild downdraft near a building causes violent wobbles. During his testing, the suddenly unassisted craft nearly struck a bystander, prompting visible anger from onlookers.
Beyond GPS, Robinson targeted the craft's internal magnetic compass. During pre-flight initialization, if the Phantom 3 detects a distorted magnetic field, it locks the motors and insists on a compass recalibration. If an operator completes the calibration dance—lifting, rotating, and rolling the drone—and sets it down on an altered magnetic field, it immediately flags another error and refuses to arm. Robinson pointed out an unconventional low-tech countermeasure: simply placing a couple of discarded mechanical hard drives containing strong neodymium magnets in the takeoff area completely prevents the drone from ever getting off the ground.
Reflecting on the stark loss of flight assistance during GPS denial, Robinson remarked: “All of my finesse was completely gone.”
- GPS disruption causes the Return-to-Home failsafe to overshoot or miss the home point entirely. - Video streaming latency spikes dramatically and telemetry feeds become jumpy when satellites are lost. - Strong localized magnetic fields (such as those from computer hard drive magnets) trigger persistent compass errors that lock the flight motors.
---
[29:37](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1777s) Attack Summary, Local Regulations, and Concluding the Talk
Robinson summarized the primary attack vectors evaluated across both platforms: sending 802.11 deauthentication frames against Parrot Bebop drones instantaneously severs the connection between the controller and the quadcopter. For the DJI Phantom 3, interfering with the GPS signal disables the automated return-to-home routine, while disrupting the local magnetic field grounds the aircraft entirely. Physical measures like throwing objects remain a crude alternative, but electronic attacks exploit the core sensors the systems rely on for autonomous stabilization.
Turning toward the legal and regulatory landscape, Robinson observed a chaotic rush among local and regional jurisdictions to ban drones based on personal grievances. People complain about drones invading beach spaces, to which Robinson quipped that annoying children at the beach are just as disruptive, yet parents are not legally forced to pack them up. He stressed that frequency allowances and drone regulations vary sharply from country to country and are constantly shifting. In the end, his practical experiments proved that consumer quadcopters are vulnerable to targeted RF interference without resorting to broad, illegal jamming.
Robinson summed up the personal motive that started the entire effort: “It was a fun research project. I knocked my neighbor's kid and his drone offline.”
| Target Platform | Vulnerability / Attack Surface | Mechanism | Result | |:--- |:--- |:--- |:--- | | **Parrot Bebop** | 802.11 Wi-Fi link | Wi-Fi deauthentication frames | Immediate controller disassociation / landing | | **Parrot Bebop** | Open Telnet daemon | Unauthenticated network login via DHCP | Execution of device shutdown script mid-flight | | **DJI Phantom 3** | Unencrypted GPS signal | Low-level RF test signal / spoofing | Loss of RTH, video feed lag, drift in wind | | **DJI Phantom 3** | Internal magnetic compass | Magnetic distortion (e.g., hard drive magnets) | Refusal to arm motors; persistent recalibration loop |
---
[31:11](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1871s) Q&A: GPS Spoofing, 400-Foot Ceilings, and Extreme Altitudes
Opening the floor to questions, an attendee asked whether one could spoof GPS by transmitting forged coordinate signals rather than merely disrupting reception. Robinson confirmed that because civilian GPS signals are unencrypted, any signal generated with greater power than the satellite signals will easily trick the drone into believing it is somewhere else. The discussion then turned to recent news stories of commercial airliners encountering drones near New York airports at 4,000 feet, prompting an audience member to ask why built-in software geofencing and the FAA's 400-foot altitude ceilings failed to stop them.
Robinson explained that the DJI Phantom 3 allows pilots to disable the altitude ceiling within the application settings. While the software presents a compliance warning about the FAA's 400-foot ceiling, pilots can simply dismiss the prompt and fly up to roughly 1,500 meters. He cited an infamous incident involving a pilot in Sweden who pushed his Phantom up 1,000 meters above cloud cover to capture aerial video, lost complete control of the aircraft, and watched it crash 500 meters away after drifting during its unpowered descent. When an audience member pressed why manufacturers even allow pilots to disable safety ceilings, Robinson noted that legitimate commercial pilots who receive waivers from air traffic control need the technical ability to fly above standard recreational limits.
Regarding the lack of cryptography on civilian satellite navigation, Robinson stated: “GPS is not encrypted. You can send a signal provided your signal is stronger than that of the official signal.”
- Civilian GPS lacks encryption, making positional spoofing straightforward if transmission power overrides the satellite signal. - The DJI software allows pilots to bypass the default 400-foot ceiling up to an altitude limit around 1,500 meters. - Commercial authorizations from air traffic control and the FAA necessitate manual override capabilities in the software.
---
[33:59](https://www.youtube.com/watch?v=5CzURm7OpAA&t=2039s) Q&A: Proprietary RF Channels, Modifying No-Fly Zones, and ATTI Mode
An audience member asked whether Robinson had decoded the proprietary radio connection used by the Phantom 3 controller. Robinson stated that DJI avoids standard 2.4 GHz Wi-Fi for control and video, opting instead for dedicated RC radio channels and proprietary Lightbridge transmission, which he had not fully intercepted or decoded. Another attendee asked about altering the SQLite database to register their own backyard as a personal no-fly zone, or injecting that database onto a neighbor's device. Robinson explained that while public websites exist to register property coordinates, the database lives inside the mobile controller app rather than onboard the aircraft itself; modifying one's own app does not alter the neighbor's controller.
When asked whether the FAA enforces cryptographic authentication standards to stop GPS jamming or no-fly zone spoofing, Robinson noted that aviation authorities had not instituted any such technical mandates on consumer hardware. Furthermore, by switching the DJI Phantom 3 into attitude mode ("A-mode"), the craft completely ignores GPS-based flight restrictions, allowing the pilot to operate inside designated no-fly zones without software intervention.
Addressing the idea of injecting modified zones into a neighbor's system, Robinson clarified: “I like your thinking, but the database is stored on his controller, not on the drone itself.”
- The DJI Phantom 3 uses proprietary RF protocols (Lightbridge) rather than commercial Wi-Fi for control and HD video return. - The FlySafe database is stored client-side within the mobile app on the ground controller, not onboard the aircraft. - Selecting "A-mode" (Attitude Mode) disables GPS positioning on the Phantom 3, allowing flights inside geofenced areas.
---
[36:39](https://www.youtube.com/watch?v=5CzURm7OpAA&t=2199s) Q&A: Regulatory Lobbying and In-Flight Telnet Hijacking
A model aircraft pilot and hang glider pilot in the audience raised a comment regarding aviation advocacy, arguing that recreational drone operators need dedicated private organizations—similar to the United States Hang Gliding and Paragliding Association (USHPA) or the Academy of Model Aeronautics (AMA)—to lobby against heavy-handed FAA regulations written without community input. The attendee then asked about Robinson's earlier demonstration of hijacking the Parrot Bebop, wondering why he had not tried to pivot through the drone down into the pilot's connected phone.
Robinson replied that pivoting to the operator's smartphone was unnecessary when attacking the drone itself was so direct. While a user was actively flying the Bebop, Robinson associated his own equipment with the open Wi-Fi network, leased DHCP IP addresses for three separate devices, opened an unauthenticated Telnet session into the embedded Linux system mid-flight, and executed a shutdown script that killed the motors instantly. An attendee joked about executing `rm -rf` across the root filesystem, to which Robinson agreed that an attacker with root Telnet access could manipulate anything on the system. Finally, when another attendee attempted to reframe the GPS attack as jamming, Robinson stopped him to reiterate that outright jamming is illegal.
Describing the simplicity of grounding the Parrot drone during active operation, Robinson said: “And then with the telnet connection I just issued the shutdown script and boom, down he went.”
- Drone regulations face criticism from aviation hobbyists who advocate organized lobbying via groups like the AMA. - The Parrot Bebop assigns network leases to any joining client over open Wi-Fi, allowing multiple devices to connect simultaneously. - Robinson established an unauthenticated root Telnet connection during active flight and executed a motor-shutdown command.
[38:14](https://www.youtube.com/watch?v=5CzURm7OpAA&t=2294s) GPS Signal Recovery, the Foil Trick, and Recommendations for Regulators
Responding to an audience question about switching flight modes, Michael Robinson explains the behavioral recovery of both platforms once GPS interference ceases. When the interfering signal disappears, the Parrot Bebop drone eventually reclaims its GPS lock and its return-to-home feature becomes functional again. The DJI Phantom 3 behaves differently: the moment its interfering signal is disrupted, it reacquires its GPS lock much faster, regains its fine control ("finesse"), and flies off normally. Robinson then reveals a remarkably low-tech vulnerability on the Phantom 3: placing a simple two-inch by two-inch square of aluminum foil directly over the top of the aircraft completely knocks out all incoming GPS reception instantly.
Tucker from *Defense One* steps to the microphone, noting that while many vulnerabilities were detailed, some were already partially known, and asks whether Robinson approached the drone manufacturers or has advice for policymakers and the FAA. When asked about his advice to authorities, Robinson bluntly targets manufacturer practices and government rulemaking:
> “My recommendation quickly back to Parrot would be dude, would you please shut down the services while the damn thing is in flight. Please.”
Robinson stresses that manufacturers cannot easily fix environmental GPS interference, noting that flying under an ordinary bridge produces interference immediately. Regarding lawmakers, he adds: “With respect to policy makers, I would like to see policy makers get informed before they start making decisions.” He confirms reaching out unofficially to individuals at Parrot, who brushed off concerns by defending their ecosystem: “they're like we're designed to be open so people can do development.”
Robinson also criticizes false product advertising. Both manufacturers advertised waypoint navigation for the Phantom 3 and Bebop, but Robinson discovered upon purchasing them that waypoint programming was missing. While the older Phantom 2 supported user-programmed waypoints, Phantom 3 users were left complaining on community forums, where Parrot deflected by stating they would rely on third-party developers. Furthermore, Robinson recounts challenging another presenter an hour prior who claimed Phantom 3 firmware updates were optional, remarking that when the presenter faltered and admitted he would have to check, it was a “bad answer, dude.”
- **Phantom 3 Foil Vulnerability**: A 2" × 2" piece of standard aluminum foil placed over the top housing blocks 100% of the GPS signal. - **Recovery Speeds**: The DJI Phantom 3 re-locks GPS noticeably faster than the Parrot Bebop after interference subsides. - **Missing Waypoint Functionality**: Despite promotional promises, neither the Parrot Bebop nor the DJI Phantom 3 included user-programmable waypoint capabilities out of the box at the time of testing, unlike the Phantom 2.
---
[41:08](https://www.youtube.com/watch?v=5CzURm7OpAA&t=2468s) The Shower Peeping Scenario, Law Enforcement Realities, and Android Controllers
An attendee presents a hypothetical ethical and legal dilemma: if an investigator connects via FTP to an open drone, pulls images from it, and discovers the neighbor has captured illicit photos of someone showering, what are the legal ramifications and how do police react? Robinson cracks a joke before engaging the premise seriously:
> “Thank God I don't have a daughter.”
Robinson clarifies that he is not an attorney, but explains that peeping Tom laws and evolving state-level drone privacy legislation dictate the legal handling. In practice, the victim must report the offense to law enforcement. When asked whether the police would care or prosecute the homeowner for hacking into the drone via open FTP to retrieve those photos, Robinson shares his real-world perspective on criminal investigations:
> “I mean this in a very nice respectful way of our law enforcement brethren. Usually when I tell them something like that, they never get to that question. They're off following the kid.”
He asserts that investigators focus on the immediate privacy breach rather than questioning how the victim grabbed files from an open, unencrypted directory sitting in the air.
Another attendee asks whether Robinson looked into modern drone ground stations where the Android operating system and control software are embedded directly into the transmitter unit. Robinson explains that his scope was strictly physical-to-drone interaction rather than exploiting controller hardware or companion apps, though he briefly inspected his iPhone and iPad apps. He emphasizes that taking down the drone itself in mid-flight remains his priority, noting dryly that crashing drones repeatedly makes this a “very expensive research project.”
---
[43:08](https://www.youtube.com/watch?v=5CzURm7OpAA&t=2588s) In-Flight Hijacking, Self-Regulation vs. Congressional Overreach, and Future Research
An attendee observes that connecting to an aerial vehicle mid-flight presents severe security implications, particularly on the Bebop and open-source rigs lacking AES-encrypted radio channels. Robinson clarifies an important distinction between the test platforms: he was able to connect to the Parrot Bebop mid-air, but could not do so to the DJI Phantom 3. When asked how manufacturers should secure future aircraft, Robinson weighs the risks against excessive government legislation:
> “If we're not careful and if the community doesn't put in the appropriate self-guidance, right, you know congress is going to legislate the hell out of it. If it moves, congress will attack it.”
He compares the panic over consumer drones to recurring debates around firearm ownership, arguing that if the drone community fails to set common-sense security standards, overzealous regulation will suffocate the market and ruin the hobby.
```mermaid flowchart TD accTitle: Drone Mid-Flight Security Vulnerabilities and Countermeasures accDescr: Flowchart illustrating how Parrot Bebop and DJI Phantom 3 handle open connections and the balance between community security and regulation.
subgraph Hardware_Comparison["Aircraft Security in Flight"] P["Parrot Bebop"] -->|"Unauthenticated Wi-Fi / Open Ports"| V1["Exploitable in Flight (FTP, Telnet)"] D["DJI Phantom 3"] -->|"Proprietary Radio Protocol"| V2["Resistant to In-Flight Hijacking"] end
subgraph Regulatory_Outcomes["Policy Risk Path"] V1 --> RISK["Public Privacy & Safety Incidents"] RISK --> CHOICE{"Remediation Path"} CHOICE -->|"Community Self-Guidance"| SAFE["Balanced Security Standards"] CHOICE -->|"Inaction"| CONG["Heavy-Handed Congressional Legislation"] end ```
The session concludes with quick questions regarding defensive hardening, ADS-B (Automatic Dependent Surveillance–Broadcast), and electromagnetic interference:
- **Securing Wi-Fi Drones**: Robinson states his initial priority was attacking and grounding the platforms, but his next research phase involves auditing ways to disable non-essential network services on the drone during active flight. - **ADS-B**: An audience member asks if Robinson experimented with ADS-B tracking systems; Robinson admits he is not familiar enough with ADS-B to speak intelligently on the topic. - **Magnetic Field Disruption**: Asked what would happen if a Phantom 3 flew through a powerful magnetic field, Robinson explains that while a disruption might disorient the electronic compass, the Phantom 3 relies on multiple redundant inputs—a downward-facing camera, ultrasonic ground sensors, a barometer, and GPS—making it capable of maintaining flight unless it nears obstacles where aerodynamic wash destabilizes it. He quips that projecting a directed magnetic field into mid-air will have to wait until he gets his DeLorean up to 88 miles per hour.
Speaker operations wraps up the presentation by thanking Robinson and directing remaining questions out into the DEF CON hallway, awarding him the official speaker badge amid audience applause.
## Notable quotes > [31:11](https://www.youtube.com/watch?v=5CzURm7OpAA&t=1871s) GPS is not encrypted. You can send a signal provided your signal is stronger than that of the official signal. — Michael Robinson
> [38:14](https://www.youtube.com/watch?v=5CzURm7OpAA&t=2294s) With respect to policy makers, I would like to see policy makers get informed before they start making decisions. — Michael Robinson
## Mentioned Michael Robinson, Parrot Bebop, DJI Phantom 3, DJI, Parrot, Department of Homeland Security, Federal Aviation Administration, Federal Communications Commission, FreeFlight 3, Parrot SkyController, BusyBox, Nmap, Wi-Fi Pineapple, GLONASS, GPS, Nationals Park, White House, Grand Canyon, Amazon, Academy of Model Aeronautics, United States Hang Gliding and Paragliding Association, DEF CON
## Video description My neighbor’s kid is constantly flying his quad copter outside my windows. I see the copter has a camera and I know the little sexed crazed monster has been snooping around the neighborhood. With all of the hype around geo-fencing and drones, this got me to wondering: Would it be possible to force a commercial quad copter to land by sending a low-level pulse directly to it along the frequencies used by GPS? Of course, radio signal jamming is illegal in the U.S and, frankly, it would disrupt my electronics, too. In this presentation, we’ll look at some of the research and issues we encountered, when we attempted to force land two commercial drones (the new DJI Phantom 3 and the Parrot Bepop Drone) by sending GPS signals directly at the drones (while staying under the threshold for jamming and not disrupting anyone else).
Speaker Bio: Michael Robinson has over 15 years of computer security experience and is currently a computer and mobile device forensic examiner in the Washington, DC area, where he deals with intrusion analysis, incident response, and criminal cases. For over four years he ran IT and IA operations for a Department of Defense agency. He has conducted research on security of mobile devices and is starting to play around in the drone space. He teaches computer forensics at the graduate level at Stevenson University in Maryland.
[Source](https://www.youtube.com/watch?v=5CzURm7OpAA)