RUB-SysSec / DroneSecurity

DroneSecurity (NDSS 2023)
GNU Affero General Public License v3.0
944 stars 173 forks source link

C2 and beacon packets #22

Closed gcarmix closed 7 months ago

gcarmix commented 8 months ago

First of all congratulations for your job, I'm doing some research on drone communication and I noticed on your software that you refer also to c2 and beacon packets. I also noticed that the code part for those packets is at very early stages. I'd like to know from you, if possible, something more about c2 and beacon packets.

In my captures I often find this kind of packets that are bigger than 2 MHz in bandwidth and last for about 500us. (attached here) Are these ones the C2 packets? (if so I think we should correct the bandwidth in your code since it is slighlty smaller) unknown_pkt If not, could you provide some samples, or at least a screenshot of what should we expect (for C2 and Beacons)?

Thank you!

nschllr commented 7 months ago

Hi, thanks a lot! I named the packets that I wasn't able to identify 'beacons.' The C2 packets should be around 1.5MHz wide, but we haven't examined them in more detail. You can limit the used frequency bands in the drone's settings so that it only uses the 2.4GHz band. If you do this and capture while the remote is connected, you should be able to spot the C2 packets in inspectrum. At this stage, our code is not able to use or process these packets, and I haven't tested if it can store them correctly. However, you can try setting the live receiver to these packets, and if it finds a packet, it will be stored in a file called 'extdroneid{sample_rate}.