Drone detection smartphone app

[sar104]

I'm having a difficult time understanding the technology behind this proposed app:

Amid privacy backlash, China's DJI unveils drone-to-phone tracking

China's DJI, the world's largest commercial drone maker, said on Wednesday it is developing technology that would allow the public to track the registrations of drones in flight using just a smartphone, amid a broader industry push to make such data available.

www.reuters.com

Apps don't generally have access to raw wifi radio data, at least under iOS.

 

[DanMan32]

Me too. I get that WiFi Aware can provide shared location data, but it can't force the app to give up its information. That's the whole point about app permission and privacy.

 

[JS1600]

Maybe using ADS-B on newer drones like aircraft have, then using an app like flightrader24.
ADS-B will be required for aircraft in 2020.

 

[sar104]

Maybe using ADS-B on newer drones like aircraft have, then using an app like flightrader24.
ADS-B will be required for aircraft in 2020.

That would be one way to do it, but not the method proposed here, which appears to be using the smartphone wifi radio to listen to the drone–RC communications.

 

[JS1600]

That would be one way to do it, but not the method proposed here, which appears to be using the smartphone wifi radio to listen to the drone–RC communications.

Oh sorry I didn't read the article.

 

[gnirtS]

Perfectly possible on android, easier if rooted but far from impossible even on non rooted devices.

Most drones use WiFi or a subset of which can be easily detected by existing diagnostic tools.

Failing that, just buying a $15 dongle and using it as an SDR will be able to detect everything.

 

[sar104]

Perfectly possible on android, easier if rooted but far from impossible even on non rooted devices.

Most drones use WiFi or a subset of which can be easily detected by existing diagnostic tools.

Failing that, just buying a $15 dongle and using it as an SDR will be able to detect everything.

I figured that it might work under Android. I don't see a pathway under iOS though.

 

[RayOZ]

Perhaps when you are using DJI Go 4, it's somehow broadcasting the information on wifi that can be picked up by their other app.
Or that it uses the drone's wifi to transmit its telemetry... it does seem to say 1km from the drone. Guess people won't be updating their firmware.

 

[gnirtS]

FWIW i forgot to add just using bog standard wifi-analyzer tools on a non rooted pixel device ive been able to clearly see a Spark and MA in flight on the waveforms.
Im sure if someone wanted to actually write software to customise the whole thing could be completely automated.
There are already modules for Kismet and other linux based systems to detect and display signals from wifi based drones (including telemetry). Occusync is possible with a cheap hardware SDR plugged in.

 

[sar104]

Perhaps when you are using DJI Go 4, it's somehow broadcasting the information on wifi that can be picked up by their other app.
Or that it uses the drone's wifi to transmit its telemetry... it does seem to say 1km from the drone. Guess people won't be updating their firmware.

It's not going to depend on a firmware update if the smartphone is simply receiving the control link transmissions.

 

[gnirtS]

Perhaps when you are using DJI Go 4, it's somehow broadcasting the information on wifi that can be picked up by their other app.
Or that it uses the drone's wifi to transmit its telemetry... it does seem to say 1km from the drone. Guess people won't be updating their firmware.

Its nothing more complicated than the phone detecting the wifi broadcasting from the drone. No need for a firmware update. Anything that can receive wifi can do the same thing.
1km range is about what you'd expect to get a useful SNR the software can process.
FWIW DJI despite initial claims do not use end-end encryption on the telemetry, even on occusync (which is how aeroscope can work for example - with true encryption, it couldnt).

 

[DanMan32]

And yet the transmission is supposed to be secure. Make up their minds! Are we secure for privacy or aren't we?

 

[gnirtS]

And yet the transmission is supposed to be secure. Make up their minds! Are we secure for privacy or aren't we?

"Secure" against basic levels of eavesdropping.
However, they don't appear to use end to end encryption with device combination specific keys. If they did, it would be secure and aeroscope wouldn't work.
It seems they use standard, and known keys for everything which means they can "break" it. They can also claim its encrypted because technically it is. Its the same as a locked door is secure but of no use if you give the keys to lots of complete strangers.

From memory, last time i read up on people reverse engineering occusync there were a few layers, some telemetry had no encryption at all so data could be obtained by anyone.

IT security isnt exactly DJIs forte - remember this is the same company that accidentally left some of its main private keys shared on GitHub.....

 

[RayOZ]

Its nothing more complicated than the phone detecting the wifi broadcasting from the drone. No need for a firmware update. Anything that can receive wifi can do the same thing.
1km range is about what you'd expect to get a useful SNR the software can process.
FWIW DJI despite initial claims do not use end-end encryption on the telemetry, even on occusync (which is how aeroscope can work for example - with true encryption, it couldnt).

But right now, MP and M2 are using OcuSync, and not standard Wifi. And with Spark, MA and MM, it would be a large set of telemetry data (motor speed, current, battery temp, etc that you can find in the flight logs) that gets transmitted to the RC. Sound like they need to enable a select subset of data to be transmitted over normal Wifi that any smartphone with DJI's app can pick up.
I still think they need a firmware update to enable the broadcast, otherwise our drones are already broadcasting these telemetry data and we don't know it.

 

[gnirtS]

The drones are broadcasting the data already. Thats how Aeroscope works.

Smart phone software is just a way of implementing the same thing in more limited reception hardware.

 

[RayOZ]

They probably bypass the privacy issue, since it's transmitting info of the drone, not the owner. Your privacy is not being violated... in a way.

 

[gnirtS]

https://department13.com/dev/wp-content/uploads/2018/02/Anatomy-of-DJI-Drone-ID-Implementation1.pdf

There are a lot more details on the various slack and github sites dealing with Occusync.

 

[sar104]

The drones are broadcasting the data already. Thats how Aeroscope works.

And also how the DJI GO 4 app creates its flight data txt and DAT logs.

 

[dirkclod]

Amid privacy backlash...

theverge.com Edit; be aware, be very WiFi Aware

mavicpilots.com

 

[gnirtS]

And also how the DJI GO 4 app creates its flight data txt and DAT logs.

Well that would be possible even if there was proper end to end encryption because the process of pairing would generate private, unique keys between the devices for data exchange.

The main issue is 3rd party unpaired devices are also able to get a lot (but seemingly not all) the information as well and they're outside this secure protocol.