EIT Digital Master student becomes worldwide expert on drone security
He spoke at worldwide security conferences in San Francisco, Singapore and other places. Media all over the world wrote stories about how a German student discovered security issues with professional drones. Nils Rodday who graduated from the EIT Digital Master School in July 2015, stirred up the global drone scene with his master thesis ‘Exploring security vulnerabilities of unmanned aerial vehicles’ and is seen as a worldwide expert on the matter.
In his master thesis, Rodday discovered security-issues with a professional drone, the kind that big companies, police forces, or fire departments use. He succeeded in taking over the steering of the drone of one manufacturer who lent him one for his research, and let it fly as he commanded. The issues he discovered also apply to other unmanned aerial vehicles as many manufacturers are using similar technologies. Besides detecting the security-problem(s), he also has made several suggestions to improve drones. “The most important one is to use proper encryption”, Rodday says.
Rodday’s research was conducted during his internship at KPMG under supervision of Prof. dr. ir. Aiko Pras and Dr. Ricardo de Oliveira Schmidt from the University of Twente and Matthieu Paques and Ruud Verbij of KPMG. “This was an upcoming topic where I had to work on. Very interesting. And risky for a thesis project. I didn’t know if the penetration test was about to fail or succeed.”
The internship was part of his two year course of study at the EIT Digital Master School – Security & Privacy. He studied the first year at the University of Trento (Italy) and the second year at the University of Twente (The Netherlands). In between, he participated in the Summer School in Stockholm. “To me learning at EIT Digital was a great experience. I met so many people, made so many new friends and was astonished by the technical content. Being able to study in three European cities is absolutely an added value.”
New version of drone
Rodday only used one model of a drone from one manufacturer for his research. He won’t say which manufacturer. “It doesn’t matter, many drone-manufacturers use similar technologies.” In the meanwhile, the concerning manufacturer is producing a new version of the drone. He doesn’t know if the manufacturer followed up on all of his suggestions for improvement. “Even if this manufacturer fixed the issues, I guess there are many more that didn´t.”
The EIT Digital’s student felt the results of his research would be worth sharing with the security scene. So he applied to talk at the RSA Conference 2016, acting on a call for speakers and also to Black Hat Asia 2016 in Singapore. Amazingly enough, he got invited to both conferences. “These are huge conferences and you don’t get to speak there just like that.” But there was a tiny problem. He needed money to actually give a presentation in San Francisco. “The travel and hotel expenses are quite expensive, and as a student I couldn’t pay for that.” He asked around and found EIT Digital willing to cover these expenses. “I am very glad they helped out here.”
Since then he is seen as an expert in the field of drone security. His story on stage created a stir amongst the audience of professionals in security. He is still getting offers to speak on conferences. And important media like Forbes in the USA, the BBC in England, the NOS in the Netherlands, local magazines in different countries and of course the specialized magazines on drones reported on his findings. In the eyes of journalists, Rodday is an expert on drones and security.
He nuances this phrase. “I just started my career, so you cannot expect that I am an expert on IT Security. Though I do know about IT and security and of course about drones. But I am careful about calling myself an expert.” But he loves going to the conferences he says. “As a student you don’t get to attend a lot of conferences, especially not the big ones. They are too expensive. Now as a speaker I got the chance to see and meet very interesting people.”
Rodday was very surprised by all the media-attention. “I never thought this would happen.” But then again he can find an explanation. “Not a lot of people thought about researching drone security. The subject is new and appeals to people. This is the first kind of research ever done about the security of professional drones.” Also his research includes the disclosure of vulnerabilities and the fact that professional drones are used by police forces and fire departments in different countries could have contributed to the stir his research created in the field.
Also unexpected is the amount of times that his thesis is downloaded. “It is not usual that people other than your professors read your thesis. Now my thesis is shared by many more.” His research is source of inspiration for other students. Rodday says that he got a lot of questions about his thesis from PHD students and Drone companies. He is certain that his thesis will be used for more research. “Either as a follow-up on my research or as a blueprint in other areas.”
Lessons to learn
His security study reveals an important issue in general with the development of new technologies. New technologies should be more focussing on security, he states. “Often with new technologies, the features come first. Security is hardly ever a first priority and therefore new technologies often miss some crucial security parts or security is not implemented at all.” Security is quite important, Rodday underlines. “Especially for products with a professional focus and for products working with sensitive data.”
Rodday now works as a security consultant at IBM in Germany. Drones may be a specialty to Rodday, at IBM he works on several fields of IT Security. Now he is working on the areas Space & Defence and Insurance. Also projects where security is “quite important”.
The story of Nils has had a lot of media coverage in Germany, Holland, Italy, Great-Britain and the USA as well. Here is a selection:
- BBC (GB) http://www.bbc.com/news/technology-35709676
- Securityaffairs (IT, english) http://securityaffairs.co/wordpress/45039/hacking/hacking-professional-drones.html
- Cnet (USA) http://www.cnet.com/news/high-flying-hack-researcher-shows-how-to-seize-control-of-a-drone/
- Dday (IT) http://www.dday.it/redazione/19273/basta-un-chip-da-40-dollari-per-controllare-un-drone-della-polizia
- Dronewatch (NL) http://www.dronewatch.nl/2016/03/02/beveiligingsexpert-claimt-controle-over-politiedrones-te-kunnen-overnemen/
- Exchange Wire (GB) https://www.exchangewire.com/blog/2016/04/21/drones-over-hollywood-an-aerial-view-of-video-security/
- Forbes (USA) http://www.forbes.com/sites/thomasbrewster/2016/03/02/surveillance-drone-hacked/#23aaf3f8752f
- Heise (DE) http://www.heise.de/security/meldung/30-000-Euro-Drohne-mit-45-Euro-Hardware-gehackt-3126838.html
- NOS (NL) http://nos.nl/artikel/2090281-hacker-zegt-politiedrones-te-kunnen-overnemen.html
- Officer.com (USA) http://www.officer.com/blog/12178532/hacker-says-police-drone-uav-uas-can-be-hacked
- UT Nieuws (NL) http://www.utnieuws.nl/nieuws/61792/Student_hackt_professionele_drone
- The Register (GB) (http://www.theregister.co.uk/2016/04/01/hacker_reveals_40_attack_to_steal_28000_drones_from_2km_away/
- Wired (USA) https://www.wired.com/2016/03/hacker-says-can-hijack-35k-police-drone-mile-away/
- WZ (DE) http://www.wz.de/lokales/kreis-viersen/kempen/kempener-student-hackt-polizei-drohne-1.2181289
- ZDnet (BE) http://www.zdnet.be/nieuws/177761/onderzoeker-hackt-drone-tijdens-vlucht/
and so on, and so on….