Nick Aleks
Nick Aleks is a renowned cybersecurity researcher, engineer and author of Black Hat Bash, and Black Hat GraphQL, (as well as the upcoming Drone Hacker's Handbook). Nick Aleks founded ASEC (asec.io) a full-service offensive security firm and established DEFCON Toronto (DC416). He has spent over a decade spearheading cybersecurity initiatives at major financial institutions while also devoting more than a decade to mechanical engineering, robotics and drone hacking. Nick hosts Drone Hacking Workshops at DEFCON and authored numerous drone hacking tools - including Damn Vulnerable Drone, SiKW00F, and MAVSploit.
Session
Modern drone operations have moved from one pilot, one aircraft to multi-agent autonomous fleets. Dozens and even hundreds of vehicles now fly missions while only a handful of operators supervise from the ground. More drones, fewer ground stations, and the station is where all the value is, the operator, the mission data, a full-blown OS, and even access to other drones.
For years, drone security researchers have focused on attacking the vehicle. I flip the target and show how a single infected drone becomes a beachhead, reaching up the command chain to own the very station meant to control it, and the fleet.
This research audited six popular independent ground-control and middleware projects across the MAVLink ecosystem, Mission Planner, QGroundControl, MAVSDK, MAVProxy, MAVROS, and DroneKit and found the same broken trust boundary in all of them. The result is 14 findings rooted in one systemic flaw, including two novel full remote code execution chains against the operator's own machine.