Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2631 Thanks!
[Music]
day four on the mway stage we will have
now a talk about uh hacking commercial
drones I want to introduce to you Felix
Storer with his talk WTF DJI UAV CTF a
heckers view at commercial drone
[Applause]
security yeah cool thanks for coming I'm
Felix dka you may know me before here
from here uh I talked about gaming
console security about reversing uh
digital emission sheets a while ago uh
today I'm talking about something else
today I talk about drones uh
specifically DJI
drones
um drones are cool Tech I guess uh
relatively Advanced Tech consumer things
you can easily buy them they're I think
cool um but I'm not good at flying and I
really prefer a nice game of CTF so why
not have both
um looking at DJI drones um DJI is kind
of the 70% market share leader so if you
buy a random drone in a shop then chance
are pretty good it's a DJI drone there
are a few other vendors but uh DJI kind
of has the highest market
share I I looked at them and figured out
they are really cool Hardware ctfs if
you look at them this way uh they look
like a drone but there is really a lot
of fun to be
had hacking them right um talking with
ordinary people you tell them hey I like
to hack drones and what they ask is
typically why would you hack a drone and
that's not a question I need to explain
to you right but um other people need a
reason to something so I collected a few
reasons why people may be interested in
hacking
drones uh it gives a good overview
actually of why there is any security at
all in these devices because you can
think well like why do they need any
security it's about the hardware and uh
they don't need security but that's
that's actually wrong and the reason is
that drones are not like ordinary
consumer Tech a drone easily allows a
consumer to commit crimes right if you
fly over the wrong areas if you fly over
a prison
uh if you fly into something there's a
lot of stupid stupid things you can do
and there are a lot of stupid stupid
consumer so that's not a great
mix and security is that's the idea here
to help you um what what drones need to
do these days commercial drones that
like customers can buy that that that's
that that are not rules if you build
your own quadcopter by the way you can
still do that and nobody stops you from
doing it but if you want to sell a drone
um it better gets certified because you
get certain advantages from being
certified and if you want to get
certified it means you have to implement
several safety
measures and as we see s these safety
measures essentially require security
measures to not get easily
circumvented one of these safety
measures are called no fly zones it's
kind of obvious what they are um it's a
Geo database it's Bas basically a huge
list of polygones that ship with the
drones uh if the Drone detects your
getting near such a polygon let's say
over a prison over an airport over other
areas the Drone will prevent you from
going there and you can kind of opt out
of that mechanism by applying for an
unlock on the DJI website and they need
you to fill out all kind of stuff uh
give you like put in documentation that
you're allowed there um and then you can
ask for
unlocking such a nolight Zone
essentially what happens is that DJI
throws all your documentation away and
approves it
anyway but the the idea is that there is
a paper trail of when you want to fly in
these areas and that so that's one
reason why drones need
security go going more into the
certification and I won't bore you with
the details but
basically the European Union and it's
very similar in different other parts of
the world I have a certification program
and you C can get a drone certified for
a certain class and one example is the
C1 class and um there are several rules
for C1 basically you have to have a
maximum takeoff weight you need to uh
have a maximum uh flight speed and you
need to have Collision avoid and sensors
and and several stuff like that and if
you can prove you have all of that you
get certified you get a certified to a
certain drone class and that gives you
benefits as the user because it allows
you to fly under slide L different rules
than if a drone would be unclassified it
also depends a lot of other stuff that I
won't go into so there's a huge
incentive here for the vendors of these
drones to get the drones certified
because they can sell more right and
there are fewer restrictions and also
like drone manufacturers really don't
like bad news so if there's news again
how how someone flew over an airport or
something that's bad for the Drone
manufacturer so they want to avoid that
by enforcing these
limitations one interesting aspect here
is that to get certified these days you
also need a um there's a requirement for
transmitting an ID and there are several
Technologies here that have converged to
something that's either Bluetooth or
Wi-Fi based um there are however also
Legacy standards specifically from DJI
and one of them I will talk about later
which is called drone ID the other
official Cent called remote ID it's
basically same kind of data that is
transmitted just over different
interf different RF Technologies and you
need to implement this in your drone
otherwise you don't get certified so all
of these things would be useless if
someone can just flash an unlocked
firmware to it and that's the reason why
there's actually a pretty good deal of
security in these drones and if there's
a pretty good deal of security then it
makes a pretty good CTF right so that
was kind of my Approach
here there are also different aspects
here so as I said broadcasting the
location is mandatory for drones but
that has created a lot of problem in the
Ukrainian War when they flew with
commercial drones to um Ju Just to like
get pictures
and they they were easily trackable with
their pilot location and they um get
attacked by just using drones so that
that is obviously the downside of of
this
technology in this case if the
ukrainians are using these drones so
there's a large demand to circumvent
these
Technologies but either way
let's make this a CTF int 100 is
unboxing what's in the package uh and
the package is this basically it's the
DJI Mini 2 in this case internal code
name is W m161 that's how they name
their devices uh if we open it up of
course then we look at this um it's the
unders inside of the Drone there's the
controller board there's also different
controller board the power board on the
top that has the the motor controllers
and battery connection and there's the
on the camera the gimbal on the left
that is basically a 3 AIS movable camera
to uh by isolate from uh vibrations
during the flight and then Like These
Arms unfold and then there are the
motors on the on these arms uh taking a
closer look at the PCB this is the PCB
um we can see uh there's a big chip here
it's an amberella H 22 amberella is a
chip that's used in many action cams
it's a camera chip so it has a few
cortex a cores runs Linux uh runs some
Arts where they do the image processing
side by side to Linux it it's well known
from other action cams actually um it
it's used here in a drone to process the
video input from the main camera which
can be up to 4K and then the amberella
chip has also the video encode coders
and writes it to SD card and sends the
encoded stream over the RF link there's
also Dam to it so the thing has uh a lot
of dam to to run Linux and do all the
image processing
there there's few headers here on the
left uh um that that connect to other
stuff uh in in the middle we see the RF
portion uh there is the so called DJI S1
chip that's actually a custom silicon
that DJI has built for their drones has
started using commodity silicon and
starting in 2017 or something they
replace more and more of their chips
with actual custom as6 they have the
unit number so this makes a lot of sense
for them and they Implement an RF
protocol that's proprietary to DJI
that's called ocusync there are
different versions of it but they all
are relatively similar I'll talk about
this later a bit but it's essentially
kind of Lte based or has similarities
with LTE so they basically took took an
LTE standard removed everything they
didn't like and then added their own
stuff to
it uh there's a debug header unpopulated
debug header on the top right that we
will also talk about uh there are two uh
time of flight sensors or one time of
flight LED and a sensor to measure the
distance to the ground and there's also
in the middle there's a sorry in in the
middle there's a a qvga so 160 to 120 uh
small image sensor that they used to
detect drifting so they can stabilize
even if the GPS position isn't
great so that there's some Machine
Vision involved here as
well looking at this at the other side
uh we see that uh there is another big
chip at the IMX RT 1064 it's a micro
controller a pretty heavy
microcontroller from from the imix RT
series RT stands for real time so this
is where the realtime stuff happens this
is where the flight controller runs that
controls the motors that sends us the
IMU inputs um basically the Linux can
crash you can reboot the Linux in flight
and it will not crash because the flight
controller keeps the thing flying so
that that's the idea here uh so it runs
a lot of high rate realtime task at 1 KZ
sometimes more than 1 khz to process the
IMU input uh but also does a lot of
other stuff uh specifically as we will
see Al some part of the security here
the nolight zones for example are
implemented as a mix in the flight
controller and the Linux sites the
flight controller basically tracks uh
keeps track of the position and then
eventually streams the noof flight zone
database which is relatively large uh
several 10 megabytes to the flight
controller so the flight controller can
do the uh decisions on if flying is
allowed or
not what we also see here is um well the
Wi-Fi chip Wi-Fi in this drone is mostly
used for transferring pictures and
videos of the Drone it's not used on
this drone for
control and there is the more DRM and
the N flash for the amberella Linux chip
and N flash what do we do with n flashes
we diser them and dump them uh so that's
what I did I bought a like water damaged
board from eBay for couple of Euro and
disordered the N flash uh dumped the N
Flash and we look at an end flash
surprisingly we see something that does
not look totally encrypted which is
surprising maybe uh if we disassemble it
yay it's arm code so definitely
um there is at least the bootloader here
is not
encrypted but there's more we can find
in the N flash so let's do a forensic
challenge uh there's a file called blame
image and I will show you what it means
um first thing if we look at the data
that's on a drone even if you buy a
drone on eBay if you find a broken drone
in the woods or something they flight
locks on them they store the locks of
the last 10 20 depending on the duration
flights it's several hundred megabytes
per flight it's a lot of data where all
the sensor data is all the position data
everything and allows you to reconstruct
the flight so I bought a random water
damage drone on eBay and this is what I
extracted so someone made a photos in
some public space here keep that in mind
when buying or selling drones
uh but there are also some images stored
here there are no images stored from the
main cameras and this is maybe hard to
see here but those are images from the
down Vision sensor from the uh it's 160
by 120 so pretty low resolution it's uh
just black and white uh but you can see
how someone flew over some house or
something and interestingly if you get a
factory fresh drone uh you can find
images from the factory in
it
so you see some kind of a testing
machine or something and probably
someone holding it
upwards uh but but let's go back to the
code uh to the secure boot thing and if
we look at it closer we see some
standard umbrella stuff so we see this
small boot strap loader 800 bytes that
just does the minimum to fetch the next
stage which is a boot loader stage
called M boot which is comes with the
umberella chip from the company it
builds the chip uh in theory it has a
console but on the DJI drone it the
console parf is not reachable instead
what they jump to is ldl1 and ldl1 is
the first code that's written by DJI and
uh if we look at that code which is
still plain text uh we see that there's
a u need it receives some keys over the
uard and then it loads a compressed and
encrypted kernel so if we look at a
little bit more details we see that the
uard is initialized at 1.5 megabit
standard stuff otherwise uh we see that
there are packets sent over that looks
somehow like this there's a 55 in the
beginning there's some Fields that's
basically what we get from disassembling
that
loader and in the end there's a cc and
there are some some magic numbers here
that are commands and those we would
expect to see on that art and then if we
look at the thing that loads the
compressed kernel actually that this is
where kind of the secure boot really
starts because now everything is
encrypted and signed uh this is also the
how updates are delivered to these
drones they are encrypted and signed um
that plain teex stuff is just written on
it in the factory and never Rewritten
everything that's getting that's updated
is signed so the idea is it's kind of a
ROM except it's not really a ROM and
then um all the volatile stuff or all
the the stuff that can be changed uh is
actually properly encrypted and signed
and of course we're a interested in
decrypting these things so let's see
where that key comes from because um the
key that they use there is something
that they received over the U in
encrypted form so if we look at um
further down in the Flash and the N
flash we see these encrypted packages
basically we see this header that we
expected from the parer code we see
there's an OS partition we see that
there's a key used called TB whatever
that means and there's a signature on on
the bottom and there's a other another
key identifier for the the key that's
used to verify the signature so this
looks relatively sane at this point but
we want the key we want to decrypt this
um so what we do is we can sniff the U
where they receive the encrypted Keys
there's an additional encryption layer
so the keys don't go plain text over
this layer uh we remember there was uh 1
12 megabit we remember there was
something like 55 something so if we
probe at random portions on the board we
expect to eventually see that uh I
removed the flight controller Here track
down the pins from the package and
eventually found um some promising pin a
y and a um receive and transmit pins
there are multiple ords on that one of
them indeed if we sniff there
uh we see some data and the data if we
look closer uh has exactly what we're
looking for it has this o1 C3 which I
guess is the identification of where
this goes um we see 40 2228 which is the
command set and ID so some some
identifier and we see the encrypted key
and unfortunately it's encrypted but at
least we know the same data that goes
into this boot loader AR with that
knowledge let's take a look at how this
is actually encrypted um we can see from
disassembling it it's a symmetric CMAC
yeah so the key to decrypt this U packet
must be in the ldr1 which we know is
plain text which we can disassemble so
we should have all the information to
decrypt this get the key and then take a
look at the next firmware stages so the
question is where does that key come
from further disassembly shows oh
it's it's a white box as implementation
so there's a lot of officiation going on
they try to hide this key by making it
difficult to extract it using something
called white box scheme where basically
you obfuscate your code enough to hope
that the hacker can't undo that I'm not
in the mood to undo that so I just wrote
a few lines of unicorn code to emulate
that code and eventually extract that
key so it's just arm code so the
officiation doesn't really matter as
long as we get the key in the
end armed with that knowledge we can now
extract the keys that are used for the
software down uh for the software
updates we get this TB key we get also
the UF key which is the key to encrypt
software updates that you can download
from the internet if you download
firmware for the mini 2 it's all
encrypted with this key so with this key
we can now now take a look at our uh
encrypted Aros again and yay we can
decrypt it so we got the Aros the Aros
is in charge for
doing the the Machine Vision it does the
drift camera thing the OS also does the
the main camera U video encoding it it
runs on this umbrella core in a kind of
am setup so there's Linux running and
there's the Aros running side by side
they both have dedicated memory and
dedicated peripherals so for example
there are two USB controller one belongs
to Linux One belongs to the Aros and
they can both do their thing on
different USB ports and not interfere
with each other uh we can go further and
we see a different blob and I know this
is hard to read but there's a blob that
says Linux um so can Linux fly um we
decrypt it and so we see yeah there's
the Nook um some older version obviously
built with an old toolchain built uh
well at least in a CI build it's not an
build on a develop machine so
yay Linux I mean is GPL so let's
download the source code so there's open
source. dji.com and there is a section
for open source software and amberella
platform so let's download it and we
download it and it's zero bytes and it
hasn't been updated in ages and they
don't respond to emails
so GPL violation yeah they also don't
put anything about the GPL in the the
the package no written offer no nothing
they don't acknowledge that they're
using Linux and that's by the way true
for all their devices they are all Linux
based and um they knowingly do nothing
which is kind of unfortunate and they
still sell their stuff all around the
world including Germany so I would
really like them to see them to be more
compliant um if someone wants to work on
that please let me
know okay so we're back to disassembly
um one interesting thing we saw in these
initial messages where we saw the keys
being downloaded from the flight
controller we also see a final message
that we didn't know what it was but if
we trace it down further we see that the
result of that encrypted message is
eventually fed into the Kent command
line as an argument to secure debug so
if that value is zero then secure debug
will be set to zero and if it's one then
well it's one and then there are some
scripts in the root file system that
would open up ADB so the Android debug
Bridge so you can execute shell commands
as root um if that secure debug would be
one but it's zero in our case uh so
let's take a look where this comes from
and whether we can do something about
it so next stop is we look into the
flight controller again the flight
controller does all the flying um it
does not need Linux to boot even so you
can fly the Drone without Linux but then
you don't get the camera working and
things like that but you still get a
flying it's an IMX RT 1064 which is a
somewhat new IMX series cortex M7
relatively quick uh that comes with
either external or internal flash on the
mini one they used external flash a wind
Bond 2 megab chip on the mini 2 they use
the uh another variant of IMX RT that
has the flash integrated it's l
literally the same flash die just
integrated into the package but uh for
for hacking purposes I wanted to look at
the mini one because I can easily dump
the Flash and then maybe apply that to
the mini
2 and if we look at the flash uh we can
see that it's encrypted and the but but
we can also see that it executes
directly from it and this is possible
because the the imix RT has a Mode
called be bus encryption engine where
basically on the fly when the CPU is
reading from the address space that
resembl the flash it will pull that in
over spy flash it will decrypt it with
an integrated key that comes from OTP
euses and will present the decrypted
version to the CPU and this is how they
can do execute in place out of an
encrypted flash obviously we want the
plain text one interesting observation
here is while yeah it's all encrypted we
also see that repeated blocks encrypt to
the same
thing and that kind of makes sense
because the problem you have for a bus
cryption and inline bus decryptions
always that it's random access the CPU
can jump anywhere and you need to be
able to decrypt that block with really
low latency because the CPU is stalled
while you do this so you can't really
use like CBC with a large block size or
something because it we would require
you to read a lot of data before you can
actually decrypt what the CPU is looking
for so they circumvented all of that
they could use like maybe counter mode
or other things but counter mode plus
authentication or something but they
didn't uh it's plain a s ECB
and uh well so I I guess you all know
the false colored penguin this is a
crocodile and uh we're afraid of
crocodile so we encrypt the crocodile
with ECB so there's no crocodile anymore
right it's
encrypted I I mean what what happens
here that each 16 bytes are encrypted on
their own so essentially it's just a it
just creates false colors with basically
the same data that that's the core
problem with cting ECB datas that you
can still infer a lot of
structure but it worse you like there's
no authentication we can mix and match
stuff so if when the flight controller
boots we can see that it does some
serial output like it outputs some in
something it at some point stops then
but there's some serial output and we
can take a look at what happens on the
Spy fles while that is executing and
what we expect to happen here is that
there is some CPU code fetched from The
Flash that is the the print F and
then we we expect the string to be
fetched from Spy Flash and getting
decrypted and then exposed to the CPU so
if we just randomly mess with different
portions of The Flash and we can be a
bit more clever than random but random
works as well eventually what we observe
is if we patch at a certain location
just like put zeros in there or
something we see that string change and
what it changes to is the decrypted
version of what we put into because
originally it was the string now it's
whatever we put in there so we have an
oracle we can put anything we want to
decrypt at that location and the print F
will happily output that it will read
from flash it will read our manipulated
data it will decrypt our manipulated
data and we can take it from everywhere
course it's ECB like the address is not
included in the encryption the
encryption is the same for every address
and we can put it there and we get it
while until the first zero byte actually
which is a bit annoying but still better
than
nothing and so that gives us an ability
to Peak into the encrypted space
there's uh if you look closer the the
way it works on this IMX RTC which by
the way has a perfectly working secure
boot architecture that just isn't used
here you see that there is actually a
table that defines which region of flash
are encrypted and that is that region is
encrypted not with the flash encryption
key but with a different key and that
key is stored in Flash encrypted so it's
a double encryption um but we can use
our Oracle to decrypt that so at the
flash header we have this unknown
encrypted key we put it in the location
that we know was the string we make it
boot it outputs that thing and it would
output the key and we see it outputs
nothing because the first bite is a zero
and like just trying all the other bytes
are zero
so that means they put an all zero key
there so to be clear this is not the key
that encrypts the flashh this is just
the key that encrypts this table at the
beginning of the flesh but it's all zero
so we can take that data we decrypt it
with the all zero key and we see this
data and this data actually has two
important things in it because it stores
the start and the end of the encrypted
area everything outside that area is not
encrypted on the Fly everything in that
are area is decrypted on the fly with
this unknown key so we can patch that we
make it from 2,000 to 3,000 and then um
we put some unencrypted dumper code that
we can just write that reads from the
encrypted area and puts it on the serial
Port where we can read it so we have a
much better article now we can dump the
complete firmware are not limited by
zero bytes anymore and we can basically
circumvent this be dis bust on the
flight uh decryption the
be I I'm not sure if you can use it
really securely it's a silicon feature
obviously that someone put a lot of
thought into I think
um if you use it together with secure
boot
and you use that mode where it reads the
the program from The Flash into the RAM
and decrypts it on the Fly and then
verifies the signature with the secure
boot then you may be able to use this
but the way how DJI used it is
definitely not secure and just
stupid okay we now have the flight
controller code we can disassemble it uh
we can look at how they Implement all
things like no fly zones and whatever
but in this case we're interested in
getting roote on the Linux device or
whatever but we want to get root right
so we look at this uh secure debug mode
and to make it short what happens is
that they use CMAC and they use a mem
compare and the idea with CMAC is that
the it's a secret value that gets
compared with a Prov value provided from
the outside so if you just use mem
compare there's a huge timing leak in
there you can try bite by bite and look
at the timing and every time it compares
it stops comparing after the first wrong
bite so if you measure the time and the
time gets longer you know that you
guessed one bite correctly and then you
can guess one bite at a time so one
thing but it gets much easier because
the key is just in there and the key is
just hardcoded in the firmware so with
that key we can talk with the flight
controller and convince the flight
controller to enable secure debug and on
the next boot then when when Linux boots
it observes that and enables ADB and
then you get a root shell which is
nice but it gets even easier
um there's this is the debug header that
I previously shown and uh I I mean it's
unpopulated there's no header on it but
it's apparently it's used in internal
development or maybe recovery of drones
or something and there's one pin that
directly goes to the umbrella chip and I
don't know what the proper name is but I
call it USB boot because if you pull
that PIN to 3.3 volt uh What You observe
is that the next time you plug in USB to
the Drone you're not getting the typical
like DJI USB Gadget that gives you um
well most mess storage mostly and ADB uh
instead you get this thing which uh is
the amberella boot loader uh it's a very
basic boot loader you can dump the boot
ROM if you have root on Linux you can
just dump it and it's a 512 bytes boot
loader and they Implement USB so they
Implement a very bare minimum USB thing
where basically all you can do is read
the scriptors and do control transfer to
read write or call an
address and there's some umbrella
Windows tool that allows you to refesh
devices with that it doesn't work for us
because the N is different the dram is
different and so on but we can write our
own code we can use this scheme we can
upload uh some USB Handler that
initializes DRM n flash has a USB stack
and then we can use this to read and
write n Flash and we can rewrite ld1
remove the signature checks or and we
can rewrite the kernel rout aest we get
full control over the Linux portion of
it um Linux portion is great but what
about the flight controller we got you
covered there as well imrt um has like
all other uh imix chips U some method of
booting or over USB it's called sdp
seral download protocol which these days
is USB and not serial anymore you can
also run over a Serial port and there
are uh nxp tools to do that it's what
you use in development all the time and
typically you would configure your chip
to use secure Boot and disable that and
not make this available and it's
perfectly supported from nxp but D
didn't do it so we can use sdp um turns
out there are the two boot pins are
Exposed on this deback header as well if
you pull them into the right direction
it will go to this USB boot mode it's an
different USB header so the main USB
port goes to the Ember Rel chip so you
actually have to wire up uh D+ and D
minus here as well but then you can use
the uh official tools to reflash the
flight controller it still does not give
you the encryption key so you need to
flash an encrypted image so it doesn't
you cannot flash anything you want but
uh combined with the previous exploits
with the Oracle um you can re-encrypt
your favorite code and run it so we can
also use this to write arbitary code to
fight control which means we now control
all the code that's in charge of uh
flying the Drone making pictures and and
so on and we could put cool stuff there
I I don't know what but that was the
goal right
so uh we can see a lot of other funny
things so this is how DJI does stuff
they love to use poop in system and uh
here they try to remove some files and
they literally if you can't read this do
this by doing a p open busy box f/
blackbox reading it line by line and
then calling system RM person s with the
file name uh which is obviously cool
because it gives you a lot of shell
injection uh methods they uh I I think
this is fixed and the way this they
fixed it is by adding a regular
expression that tries to filter the file
names before sending it to RM
persones and they typically forget some
special characters because honestly
filtering shell input with a regular
expression is really hard and you
shouldn't do
that um that's all I have on the Drone
but let's take a look at the RF layer a
little bit again it's called OS oos
exists in multiple versions that are
basically similarish and only different
parameters if we look at an RF spectrum
of a drone flying then we see this
pattern and again hard to see but you
see like these big fat bars at the at
the top that's the down link um left to
right is is time up to down is frequency
so we see a 20 megaherz downlink Channel
and we see a 1.4 mahz Uplink channel
that is frequency
hopping and um we can put this into a
nice framing where every 10 milliseconds
this pattern repeats every 10
milliseconds there is a new hopping
frequency for the Uplink um so this is
similarish to LTE if we look
closer um we we look at a 10 millisecond
frame we can see that there are Subs
slots and each 1 Mill slot is either
occupied by a downlink signal or by
nothing or by an Uplink
signal um and then um some of these up
down link symbols are spe uh frames are
special because they allow you to
synchronize with it that's why they look
so funny in the Spectrum in the
middle but one interesting thing is that
every 600 40
milliseconds uh we see and this is again
very hard to see we see some one more
thing in an otherwise unus slot this is
this 10 MHz thing at the bottom that
happens to be before one of the Uplink
slots and again every 640 milliseconds
on a different frequency the Drone
transmits this 10 MHz
signal if we look at this closer um we
can see that this is U ofdm symbols
there are and in this case nine ofdm
symbols the two symbols look funny so
they are special synchronization
symbols uh the other are data symbols
and if we do some magic that we where we
roughly know how to do it where we have
a proof of concept but we hope to get
this fully automated and running in real
time uh then you get uh qpsk
constellation where you can see the
individual Bits And if you assemble the
bits together and then then run it
through uh some some error correction
that is all and scrambling that is also
LTE like but not quite LTE then um what
we see a frame that looks like this this
and it includes the Drone serial number
it includes the pilot location as a GPS
position and the Drone location and
attitude and speed so this is the how
they built this drone ID which again is
this Legacy standard not the new one
that uses Wi-Fi or Bluetooth they're
converting to that but all DJI drones
since 2017 or something transmit this
signal regardless way you fly and it can
be picked up in up to well DJI sells a
device called aeroscope that allows you
to pick up these beacons they initially
claimed it was encrypted but as we've
seen it's not encrypted um and they
basically sell you this device for quite
a lot of money and can be used by
airport operators or other people to
identify drones that are flying around
and apparently with the right antennas
it gets you like 30 km of range or
something that that's all I had for now
um this is a small small part of the
whole DJI ecosystem DJI builds a lot of
drones with other Technologies like
their own silicon they build other
devices it's a huge company uh they
built EV they they also build non- drone
stuff they build action cameras they
build
commercial video tools that also use
video transmission using the same ocus
sying standard so they try to use their
technology in all kind different ways uh
they there's a branch of DJI that does
car integration there's a they built a
cleaning robot like a room bar or
something uh they built all kind of
stuff I think in here
in Europe we only see a fraction of that
but they expand more and more and uh
keep reusing the Technologies their
custom silicon for example is used in
many of these other devices
deves we out of time for now I can
hopefully still take some
questions if I'm
a
yeah we still have 10 minutes so if you
have questions please line up at the
microphone Felix will answer your
questions
now
hi yeah thanks um what do you think
about remote ID uh in general and um
what do you think I mean what do you
think um remote ID related to non drone
drones so basically air airplanes or
helicopters um I I mean the the standard
collision avoidance scheme for drones
and airplanes is a phys like limit uh
Separation by enforcing maximum he and
so on and then for the larger drones
they need to observe adsb traffic so
basically the beacons from the the
planes and then do avoidance Maneuvers
remote ID I think um is less useful for
planes avoiding drones also for the fact
that planes can't really do a lot to
avoid a drone because a drone is so much
quicker to navigate so it should always
be on the burden of the Drone to uh to
to do evasive action
I think remote the idea of remote ID is
more that air is a shared space even if
you own the ground air is still a shared
space so it comes with responsibilities
to use it uh it's kind of a non-s saying
answer because I it's a obviously hugely
political thing um I believe for
non-conflict areas it is a good thing if
there's responsibility by people who fly
drones um if and responsibility
unfortunately these days means that you
can see what people are doing if we find
a different solution to that that would
be great but currently the only feasible
solution I see is making people aware of
where drones are simply to keep the
pilots responsible but I would be happy
to see a better
solution uh do you think other
manufacturers doing same stuff like the
DJ y Dr yeah there so I um
they are not that far off uh both in
what they do in terms of using Linux and
then using some realtime stuff also and
kind of what security hes they have um I
think I mean obviously there's a whole
world of non-consumer drones and uh
military drones that I haven't looked
into at all and don't plan to so things
may be different there but for Consumer
drones it's roughly similar in how they
do things and what quality they do
things
uh you talked about the Drone ID and
there was one thing I couldn't quite
pick up uh you said something about 2017
and was it is this drone ID used since
2017 or is it not used since 2017 so has
there be a new version if there is a new
version did anybody peek into it how is
this secured because just seeing the
Pilot's location can lead to some
security implications as the YouTube
video you showed is has shown yeah
absolutely so um talks about manator
remote ID have been there since
basically consumer drones exist um D
tried to get ahead of the game by
implementing their own proprietary
scheme kind of voluntarily doing this
since 2017 they had some different
schemes before um but basically they
consistently implemented this since
roughly that time frame and this is also
when they started selling this device
that picks them up but this was all
because there was no official standard
based on propriatary
DJI things back then you could flip a
switch in your app to disable that that
doesn't work anymore but back then it
was voluntary so that's how this got
implemented during these times uh
standardization has happened and there
are now X+1 standards so there's now a
Japanese standard there's a European
Standard there's a US Standard they
differ in some things they are similar
in some things but what they have all
common is that they're not built on
proprietary Technologies like ocus but
using Bluetooth uh and Wi-Fi
frames thereby heavily restricting the
range of these things so it doesn't work
well or the go the design goal for these
official remote ID implementations was
several kilometers of range the design
goal for ocusync is 30 km of range with
which is a huge difference DJI I guess
well currently they added remote ID the
official one to all their drones even
old drones I'm not sure if they will do
this eventually instead of what the OA
syn version but currently they do
both thank you Felix yeah thank
[Music]
you