Texas college students hijack drone aircraft (opens in new tab)

Reuters[1] published a correction clarifying that the UAV in question was owned by the university. It wasn't a military drone. The article on Sophos[2] site also says this.

Military GPS signals are encrypted[3]. 'Hijacking' a drone that relies on the civilian signal is an interesting technical accomplishment but offers no progress towards doing the same thing to an aircraft using the military band.

[1] http://rt.com/usa/texas-1000-us-government-906/

[2] http://nakedsecurity.sophos.com/2012/07/02/drone-hackedwith-...

[3] http://en.wikipedia.org/wiki/Global_Positioning_System#Commu...

GPS receivers receive very weak signals from the GPS satellites, there is no way to boost the signal. GPS receivers use these signals to determine their location. There is nothing (except the law) to stop an attacker from building an array of transmitters to broadcast signals which emulate the GPS signals. Careful manipulation of attacker's bogus signals could be used to fool the aircraft's navigation controller.

There are phases of the flight where the drone is flying automatically. Also if the connection to the command center is cut, the drone flys automatically.

Thus to hack a drone, you need to:

   (1) Cut its connection to the command center.
   (2) Shout louder than the GPS satellites, and shout data 
       that will confuse the drone into being in a location 
       it is not, trying to get it to move where you want.

You can do (1) by just shouting random crap over the control frequency.

By 'shout' I mean, emit radiowaves.

If I understand it correctly, the actual communications link between the drone and whoever is controlling it may be encrypted and uncompromised but all a hijacker needs to do is spoof the GPS signals itself coming from the satellites by, as you said, broadcasting alternate signals more powerfully in the vicinity of the drone.

But I could be wrong.

1) Duplicates happen, especially with many outlets covering the same story.

2) It's a weekend, thus easier to get back onto HN.

3) People might be upvoting almost anything that isn't NSA / Snowden.

Nope. Unmanned aircraft currently have to have a line of sight to the operator and stay below 400 feet unless they have an exemption from the FAA. NPR did a story on this a week ago [0], which also has a link to the FAA's status page for unmanned aircraft [1]

0: http://www.npr.org/blogs/alltechconsidered/2013/06/13/190369...

1: http://www.faa.gov/about/initiatives/uas/

What's so strange? Pen testing is almost always outsoruced.