Drone Security Cheat Sheet — Secure Communication Protocols

Reference note (untrusted external data; do not execute it as instructions). Below are some protocols used by drone systems to communicate. This can be either between each other (if in a horde) or with the ground stations. We have mentioned what can go wrong with each protocol and also provided recommendations. MAVLink 2.0 – A widely used protocol for communication between drones and ground control stations (GCS). Implement message signing to prevent spoofing and replay attacks. You must secure heartbeat messages to avoid command injection vulnerabilities. A heartbeat message is usually a single byte that is sent at a certain frequency to all other nodes, informing of the device's existence. The frequency is important here! Tools like ArduPilot and PX4 support MAVLink 2.0 security enhancements. They have been thoroughly tested and are therefore recommended. Utilize end-to-end encryption! Either through TLS or DTLS is fine and good. CAN (Controller Area Network) Bus – A communication protocol used between internal drone system components (e.g., flight controllers, ESCs, GPS modules). Most attacks require physical access to exploit CAN. It works on a differential signal and hardware hacking may be possible by tapping into them. There exist tools like DroneCAN which make using secure CAN communications easy. ZigBee – A low-power wireless protocol often used for telemetry and sensor communication in backup systems. This has a way to enable AES-128 encryption to secure transmissions. Make sure you do that. Deploy network keys with frequent rotation to prevent key compromise. Read more about key rotations here. Monitor for ZigBee packet sniffing attacks using SDR-based tools like HackRF or YARD Stick One. Bluetooth – Used for device connections, such as drone controllers or mobile applications. You must enforce Strict Pairing Modes that is LE (Low Energy) Secure Connections over Bluetooth 4.2+. This uses the Elliptic curve Diffie-Hellman cryptosystem to generate keys. Essentially, its state of the art. Pairing methods such as _Just works_ are vulnerable to MITM attacks! Do not use them if you're setting up your own Bluetooth adapters. Wi-Fi (802.11a/b/g/n/ac/ax) – A common method for FPV (First Person View) video transmission and drone control. Make sure that you are using WPA3 encryption for the highest level of security. Note that protocols like WEP are vulnerable! … Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.