[论文解读] Consumer UAV Cybersecurity Vulnerability Assessment Using Fuzzing Tests

David N Rudo, Kai Zeng|arXiv (Cornell University)|Aug 9, 2020

UAV Applications and Optimization参考文献 12被引用 11

一句话总结

本文通过针对Parrot Bebop 2的FTP和弱端口安全性的模糊测试，识别出消费级无人机中关键的GPS干扰漏洞。通过向特定端口发送畸形数据流，研究人员导致GPS信号丢失和系统不稳定，表明基本的网络加固和输入验证对无人机网络安全至关重要。

ABSTRACT

Unmanned Aerial Vehicles (UAVs) are remote-controlled vehicles capable of flight and are present in a variety of environments from military operations to domestic enjoyment. These vehicles are great assets, but just as their pilot can control them remotely, cyberattacks can be executed in a similar manner. Cyber attacks on UAVs can bring a plethora of issues to physical and virtual systems. Such malfunctions are capable of giving an attacker the ability to steal data, incapacitate the UAV, or hijack the UAV. To mitigate such attacks, it is necessary to identify and patch vulnerabilities that may be maliciously exploited. In this paper, a new UAV vulnerability is explored with related UAV security practices identified for possible exploitation using large streams of data sent at specific ports. The more in-depth model involves strings of data involving FTP-specific keywords sent to the UAV's FTP port in the form of a fuzzing test and launching thousands of packets at other ports on the UAV as well. During these tests, virtual and physical systems are monitored extensively to identify specific patterns and vulnerabilities. This model is applied to a Parrot Bebop 2, which accurately portrays a UAV that had their network compromised by an attacker and portrays many lower-end UAV models for domestic use. During testings, the Parrot Bebop 2 is monitored for degradation in GPS performance, video speed, the UAV's reactivity to the pilot, motor function, and the accuracy of the UAV's sensor data. All these points of monitoring give a comprehensive view of the UAV's reaction to each individual test. In this paper, countermeasures to combat the exploitation of this vulnerability will be discussed as well as possible attacks that can branch from the fuzzing tests.

研究动机与目标

• 评估消费级无人机的网络安全漏洞，尤其关注基于网络的远程利用攻击。
• 研究针对FTP和弱端口配置的模糊测试如何干扰GPS功能和无人机系统稳定性。
• 识别广泛使用的消费级无人机（如Parrot Bebop 2）中存在的可利用弱点，这些无人机缺乏WPA2加密和强大的输入验证机制。
• 提出实用且可实施的对策，如动态端口安全、软限制和自适应安全机制，以减轻模糊测试和洪水攻击的影响。

提出的方法

• 通过向Parrot Bebop 2的网络端口发送大量畸形数据（包括FTP特定关键词）进行模糊测试。
• 在攻击期间监控无人机在GPS精度、视频传输速度、电机响应性和传感器数据完整性方面的表现。
• 通过动态更改通信端口实施动态端口安全，以降低可预测性并阻碍大规模洪水攻击。
• 实施软限制，以限制数据包大小并验证命令关键词在完整处理前的合法性，防止缓冲区溢出和无效命令执行。
• 引入自适应安全机制，检测异常流量模式，并在检测到可疑活动时触发警报或阻断。
• 评估WPA2加密和静态IP访问控制作为基础安全措施的有效性，以防止未授权访问。

实验结果

研究问题

• RQ1 针对FTP端口和开放端口的模糊测试攻击如何影响消费级无人机的GPS性能和整体系统稳定性？
• RQ2 端口配置和输入验证中的哪些具体弱点使得无人机操作可被远程干扰？
• RQ3 动态端口安全和软限制在多大程度上能减轻模糊测试和洪水攻击的成功率？
• RQ4 自适应安全机制在实时检测和响应异常网络流量模式方面有多有效？
• RQ5 基本的网络加固实践（如WPA2和IP白名单）在防御此类网络攻击中起到什么作用？

主要发现

• 针对Parrot Bebop 2的FTP端口及其他弱保护端口的模糊测试攻击，成功干扰了GPS信号接收，导致导航失败。
• 在高容量数据注入期间，无人机在视频传输速度、电机响应性和传感器数据准确性方面表现出可测量的性能下降。
• 由于缺乏WPA2加密和输入验证，攻击者可轻易利用该系统，证实其极易遭受远程网络攻击。
• 实施软限制（如数据包大小限制和基于关键词的命令过滤）显著降低了系统对畸形输入的暴露风险。
• 动态端口安全和自适应流量监控被证明能有效降低大规模模糊测试和洪水攻击的成功率。
• 本研究确认，WPA2加密和基于IP的访问控制等基础安全实践是防止未授权访问和利用的关键，且极为有效。