12 Feb Game of drones
Joe Charlaff finds out more about a new technique that claims to be able to detect whether a drone camera has you under surveillance
The use of drones for surveillance is no longer in the realms of science fiction. We are now in an era in which anyone with a drone equipped with a video camera can use it to invade a subject’s privacy by streaming the subject in his/her private space over an encrypted first person view (FPV) channel.
Although many methods have been suggested to detect nearby drones, they all suffer from the same shortcoming: they cannot identify exactly what is being captured.
Drones have been used for photographing sensitive locations. One of the most notable concerns about UAS platforms stems from their potential to silently monitor and record their surroundings.
The first technique to detect a drone camera illicitly capturing video is revealed in a new study published by Ben-Gurion University of the Negev (BGU) and Weizmann Institute of Science cyber security researchers. The study addresses increasing concerns about the proliferation of drone use for personal and business applications and how it is impinging on privacy and safety.
“Game of Drones – Detecting Captured Target from an Encrypted Video Stream,” the researchers demonstrate techniques for detecting if a targeted subject or house is being recorded by a drone camera.
“Our findings may help thwart privacy invasion attacks that are becoming more common with increasing drone use,” said Ben Nassi, a Ph.D. student in the BGU Department of Software and Information Systems Engineering and a researcher at the BGU Cyber Security Research Center (CSRC).
“This could have significant impact for the military and for consumers because a victim can now legally prove that a neighbor was invading their privacy.”
He explained that his research is about methods to detect whether a drone is being used by its operator to stream a specific target which can be either a building or a person. By analyzing the radio signals that are sent from the drone to the controller they found ways to detect if a specific target is being streamed or not.
“The beauty of this research is that someone using only a laptop and an object that flickers can detect if someone is using a drone to spy on them,” he said. While it has been possible to detect a drone, now someone can also tell if it is recording a video of your location or something else.”
In the first demonstration, researchers showed how a privacy invasion against a house can be detected. They used smart film placed on a window and entered a few software commands on a laptop to access the encrypted video the drone operator sees, called the FPV channel. This enabled the researchers to demonstrate how they detect that a neighbor is using a DJI Mavic drone to capture images of his own home and then illicitly stream video of his neighbor’s house, as well.
In a second outdoor test, researchers demonstrated how an LED strip attached to a person wearing a white shirt can be used to detect targeted drone activity. When researchers flickered the LED lights on the cyber-shirt, it caused the FPV channel to send an “SOS” by modulating changes in data sent by the flickering lights.
“This research shatters the commonly held belief that using encryption to secure the FPV channel prevents someone from knowing they are being tracked,” Nassi says. “The secret behind our method is to force controlled physical changes to the captured target that influence the bitrate (data) transmitted on the FPV channel.”
This method can be used on any laptop that runs Linux OS and does not require any sophisticated hacking or cryptographic breaking skills.
Professor Yuval Elovici, Head of the Department of Software and Information Systems Engineering at Ben-Gurion University of the Negev, reviewed the system with Security Middle East, and explained the reason for its development.
“We were concerned about the fact that someone is allowed to fly a drone above a private property. It happened in my village where a drone was flying above a neighbour’s property. The main issue is that today the drones are so small and their cameras are of such high quality that they can fly above a property and literally invade your privacy by pointing the camera towards you”.
He explained that we are lucky that the drone is transmitting the data encrypted to its operator as this data is public. The data can be observed, but cannot be encrypted, but it can be tested.
Elovici pointed out that what they developed is a mechanism that allows the adding of a covert channel to the communication between the drone and its operator, which is the physical stimulus that was done on the window in the demonstration, and if traces of the physical stimulus are seen in the communication, it is clear that the drone is observing the target and that the drone invaded the privacy of that person.
At this stage there are solid grounds for approaching the legal authorities and complain.
In Elovici’s opinion, what is good about this method, is that without compromising the operator’s privacy, it can be proven that he invaded the other party’s privacy. Even if the drone is not visible the physical stimulus will immediately indicate that there is a drone in the area. “Our method can even tell us that there is a drone that is observing us” said Elovici.
He emphasised that drones are a huge security risk, and gave industrial espionage as an example. Today drones are being used for delivery resulting in an enormous number of drones in the sky multiplying the risk of being photographed from a drone, as almost every drone has a camera.
While most people don’t yet equate drones with security risks, they pose an array of threats. Implications for security industry include sensitive locations (clients’ residences, private properties, offices, stadiums, public venues, etc) can be scouted by drones and intelligence can be gathered, which could reveal weaknesses in the security arrangement and leave a site vulnerable to attacks.