BSides Munich 2026

Modern drone operations have moved from one pilot, one aircraft to multi-agent autonomous fleets. Dozens and even hundreds of vehicles now fly missions while only a handful of operators supervise from the ground. More drones, fewer ground stations, and the station is where all the value is, the operator, the mission data, a full-blown OS, and even access to other drones.

For years, drone security researchers have focused on attacking the vehicle. I flip the target and show how a single infected drone becomes a beachhead, reaching up the command chain to own the very station meant to control it, and the fleet.

This research audited six popular independent ground-control and middleware projects across the MAVLink ecosystem, Mission Planner, QGroundControl, MAVSDK, MAVProxy, MAVROS, and DroneKit and found the same broken trust boundary in all of them. The result is 14 findings rooted in one systemic flaw, including two novel full remote code execution chains against the operator's own machine.

Audience Takeaways
Novel drone-to-ground control station attack techniques attendees can validate and audit themselves in a simulated environment.
That ground control stations and their middleware are a large, under-examined attack surface reached from the vehicle, a whole class of targets the field has overlooked.
A recurring trust-boundary pattern (vehicle-supplied data into GCS) that attendees can go look for across other GCS, middlewares and autonomous-system tooling.

Problem Statements
The GCS is the trusted controller of an autonomous system, yet the prevailing threat model assumes the vehicle is the only attack surface worth defending. Ground-control software and middleware consume telemetry, parameters, camera metadata, and file-transfer data from the vehicle and route it into sensitive operations, plugin loading, process spawning, deserialization, file writes, without treating it as untrusted input. Because an attacker who controls the link (or the vehicle) controls that data, the most trusted component in the stack is also the most exposed, and nobody is looking at it.

Research Novelty
Prior drone-security work targets the vehicle: firmware, sensors, GPS/RF spoofing, autopilot bugs. This research inverts the direction of attack and shows the operator falling. The novelty is twofold:
the systemic finding, the same trust-boundary inversion reproduced across six independent ground-control/middleware projects, demonstrating an ecosystem-level architectural flaw rather than a single vendor bug; and
the access-tier escalation model, two distinct RCE chains keyed to flight-controller vs companion-computer access, with additional vulnerabilities that can also work on just the radio link. For the offensive UAS, red team, and integrator audience, this reframes where the real risk lives in autonomous systems.
This talk contains CVEs that have yet to be disclosed soon. They will also be references in my new book The Drone Hacker's Handbook with No Starch Press (ETA: Spring 2027)