skyjack

🛩️ SkyJack - Parrot AR.Drone Takeover

Reimplementation of the original SkyJack attack by Samy Kamkar.
Demonstrates Wi-Fi control takeover of legacy Parrot AR.Drone platforms.

---

📜 Historical Context

In 2013, security researcher Samy Kamkar released SkyJack, a proof-of-concept attack demonstrating how Parrot AR.Drone devices could be taken over wirelessly.

The drones exposed an open Wi-Fi access point with no authentication and accepted plaintext control commands over UDP/TCP.

SkyJack showed that:

• Drones could be forcibly disconnected from their controller
• An attacker could reconnect faster than the legitimate pilot
• Flight control commands could be injected remotely

This module is a modern ESP32-based educational reimplementation of that concept.

---

🎯 Target Devices

• Parrot AR.Drone 1.0
• Parrot AR.Drone 2.0

These models expose:

• Open Wi-Fi network (no encryption)
• Static IP gateway (192.168.1.1)
• AT command interface on port 5556

---

🚀 Attack Workflow

[1] Channel-by-channel Wi-Fi scan
           │
           ▼
[2] Detect Parrot AR.Drone SSID/BSSID
           │
           ▼
[3] Send targeted 802.11 deauthentication frames
           │
           ▼
[4] Force disconnect of legitimate controller
           │
           ▼
[5] Connect to drone open Wi-Fi
           │
           ▼
[6] Send AT commands (EMERGENCY / LAND)
           │
           ▼
[7] Release control and exit

---

🧠 Technical Overview (High-Level)

• Wi-Fi scanning: brute-force scan across channels 1–13
• Vendor detection: BSSID prefix matching (Parrot OUIs)
• Deauthentication: raw 802.11 management frames
• Fast reconnection: ESP32 STA connects before pilot
• AT commands: plaintext flight control protocol

The goal is not long-term hijacking but demonstrating loss of control on insecure wireless systems.

---

🖥️ User Interface

The Cardputer displays a live scrolling console:

• Channel scan progress
• Drone detection (SSID / BSSID / channel)
• Deauthentication status
• Connection attempts
• Command injection feedback

All actions are also logged to the serial console.

---

📡 Commands Sent

Once connected, the module sends:

• EMERGENCY: immediately stops motors
• LAND: forces landing sequence

These commands are sent multiple times to ensure reception.

---

❓ FAQ

❔ Is this still exploitable today?

No. Modern drones use encrypted links, authentication, and signed firmware. This attack applies only to legacy Parrot AR.Drone models.

❔ Does this permanently hijack the drone?

No. Control is temporary and ends when the module disconnects.

❔ Is this exploiting a vulnerability?

Yes — a design-level vulnerability: lack of authentication and trust in Wi-Fi connectivity.

❔ Why include this module?

This feature is included for:

• Security education
• Historical research
• Demonstrating why authentication matters
• Wireless attack surface awareness

---

⚠️ Legal & Safety Warning

⚠️ WARNING

This module interacts with airborne devices.

Do NOT use near people, animals, or property.

Use this feature only on devices you own or have explicit written authorization to test.

Unauthorized interference with drones may be illegal and dangerous.

---

📚 References

• Samy Kamkar — SkyJack: Autonomous Drone Hijacking
  https://samy.pl/skyjack/
• DEF CON 21 — SkyJack Presentation
• Parrot AR.Drone Developer Documentation (legacy)

---

SkyJack remains a landmark demonstration of how convenience-first design can completely undermine security.