Consumer drones enjoy great popularity due to their high versatility and great camera. While drones can be a fun toy, they also carry the potential for misuse in illicit and hazardous situations, where security and privacy matters to the drone operators. To prevent their deployment in such scenarios, drone manufacturers, such as DJI, routinely incorporate countermeasures that restrict flight in designated areas and impose limits on parameters like speed or altitude.

In our talk, we will guide you through our security analysis of these drones, beginning with an examination of the signals they emit, as well as a brief discussion on DJI's DroneID—a signal that continuously transmits the location of both the drone and its operator. Subsequently, we dive into our reverse engineering of DJI drones, illustrating how we scrutinized these devices, from their wireless physical layer and hardware components to their firmware.

To complement our manual reverse engineering efforts, we showcase how hardware-in-the-loop fuzzing can be used to reveal vulnerabilities across various drone firmware components. Throughout our talk, we will unveil a series of security weaknesses that enable an attacker to circumvent signed firmware updates and upload custom code, obtain root privileges on the drone, or even cause the drone to plummet mid-flight through the operator's smartphone.