Overview

We propose a novel anti-drone technique that effectively distorts the communication channel between the IMU and control unit of the drone by using an electromagnetic interference (EMI) signal injection. Experimentally, for a given control unit board, regardless of the sensor used, we discovered a distinct susceptible frequency at which an EMI signal greatly distorted the sensor data. Compared to a general EM pulse (EMP) attack, our work requires considerably less power since it targets the specific susceptible frequency. It can also reduce collateral damage from the EMP attack. For practical evaluations, we demonstrated the feasibility of the attack using real drones.

Attack Principle

The control unit retrieves the IMU data based on the interpretation of the communication signals. If the communication between the sensor and control unit is disrupted, the control unit would not retrieve the correct IMU data. Then, incorrect IMU data causes the state estimator to return the current attitude away from the actual measurement, thereby resulting in an incorrect target angle (① in Fig. 2). Additionally, the internal

PID loop yields the wrong force required to reach the target angle based on the distorted x, y, and z-axis angular velocities (② in Fig. 2). Consequently, the rotors generate torque, thereby causing the drone’s attitude to deviate considerably from stable flight (③ in Fig. 2). Since the aforementioned problems are fed into the closed-feedback loop, creating an increasingly unstable attitude, the drone eventually crashes to the ground.

Experiment setup

IMU-6 EM injection experiments on a hovering drone at 0.44m.

IMU-7-2 EM injection experiments on a hovering drone at 2.4m.

IMU-8 Targeted EM Injection Experiments with NANO and Pixhawk4 Boards

Additional Attack Demo Videos

IMU-1 Disturbing original signal on I2C communication channel between IMU and Control unit.

IMU-2 An experiment showing that the drone rotor command signal became irregular due to EM injection.

IMU-2 -1 Shielding the wire and the IMU sensor

IMU-2 -2 Shielding only part of the control unit board

IMU-3 Attack simulation with PX4 SITL (Software In The Loop).

IMU-4 An experiment showing that the drone rotor command signal became irregular due to EM injection.

IMU-5 EM injection experiments on a stationary drone.

• We confirmed the irregular change and irregular stop of the drone rotor speed with this experiment.

IMU-7-1 Attack Distance Experiment

Post Mortem Analysis of Our Attack

Fig.3.: llustrations of the IMU sensor values and rotor commands when the EMI signal is injected. All IMU sensor values significantly fluctuate right after the attack (517th sample). Additionally, all rotor commands are significantly affected right after the corruption of the IMU sensor values (517th sample). For example, rotor 4’s command immediately drops to 1100, lowering its speed to its minimum (stop). It indicates that our attack corrupted IMU values, affecting rotor commands immediately.

Attacking Other Sensors : CMOS Image Sesnor

CMOS-1 Disturbing original signal on SPI communication channel between CMOS image sensor and Control unit.

CMOS-2 EM injection experiment on a CMOS image sensor.

CMOS-3 EM injection experiment on another CMOS image sensor.

Similar attacks: Thor (The tactical high power operational responder)

Restrictions on EMI attacks on commercial drones

In order to evaluate more practical points in addition to the promised experiments, we tried to perform remote EMI attacks on DJI drones and Pixhawk drones.

At this time, we radiated an EMI output of over 100W. For reference, this output has no choice but to be done in a shielded chamber due to electromagnetic wave radiation regulations. Also, for safety, the position and radius of the drone must be fixed. (high-voltage equipment)

In this process, we found the following limitations:

1. The shielded chamber blocks all electromagnetic waves, including GPS signals.

2. Without a GPS signal, the Pixhawk drone could not hover.

3. DJI can hover without a GPS signal, but it requires a height of at least 15 meters, and its radius is very large both horizontally and vertically, so it is very dangerous because it can damage high-voltage devices. [https://www.dji.com/mini-2/specs]

4. As mentioned in 3, when the DJI is tied to a payload and forced to take off, only the maximum rotor output is repeated for takeoff flight, so drone do pendlam movement and cannot hover.

Contact

If you have any questions or comments, please don't hesitate to contact the first author JoonHa Jang (cyber040946@kaist.ac.kr), a PhD student at System Security Lab at KAIST, Korea.