Wireless security · research

Hijacking a Wi-Fi‑based drone with MITRE ATT&CK

Consumer drones increasingly replace the radio controller with an ordinary Wi-Fi link to a phone. That one design choice puts the flight-control channel on a medium with decades of well-understood attacks. This is a hands-on test of how far that goes — against a real drone, with a laptop.

By Oreoluwa Fagbamiye Research 2023 ~12 min read

UAV security 802.11 deauthentication WPA2 / WPA3 Wi-Fi Pineapple Hashcat MITRE ATT&CK Ryze Tello

Abstract

Many consumer drones talk to a smartphone app over their own Wi-Fi access point instead of a dedicated radio. It removes a controller — and exposes the aircraft to the full catalogue of wireless attacks. This study tests that exposure end to end against the Ryze Tello, a small programmable drone sold for education, using only a laptop running Kali Linux, a USB Wi-Fi adapter, and a Wi-Fi Pineapple. Every step is mapped to the MITRE ATT&CK framework, so the work doubles as an adversary-emulation reference. The result: a single deauthentication command takes a Tello away from its operator, and any network password — where one is set at all — falls to an offline dictionary attack. The study closes with concrete recommendations for manufacturers and operators.

01Why Wi-Fi drones are exposed

Civilian drone use has grown from a hobby into a mass market, with annual sales in the millions and applications spanning delivery, inspection, journalism, activism, and surveillance. With that growth comes a corresponding rise in privacy and security concerns — most studies of which stop at what could go wrong and rarely test how easily.

More expensive drones use a dedicated radio controller. Cheaper ones skip it: the drone raises its own Wi-Fi access point and a smartphone app connects to it. That is cheaper to build and convenient to use — but it moves the flight-control channel onto 802.11, a medium whose attacks have been studied and tooled for twenty years. The research question here is deliberately blunt:

Could someone with a laptop and a Wi-Fi antenna take a commercial drone out of the sky?

02The test platform: Ryze Tello

The Tello is a small, inexpensive programmable drone marketed for education. Powered on, it immediately broadcasts an open access point named TELLO-xxxx. No password is required to connect. The phone app joins that network and sends flight commands as UDP multicast — connectionless and fast, and tolerant of the occasional dropped packet because control data is transmitted continuously and a lost frame is quickly superseded.

The drone carries a camera and an Intel Movidius Myriad 2 vision processor for stabilisation, obstacle response, and gesture recognition; video streams back to the connected phone. Two properties matter for what follows: the Tello accepts multiple clients on its network, and every client has the same level of access as the operator. There is no notion of a privileged controller.

03Method and setup

Target

Ryze Tello — open AP, no default password, UDP control channel

Attacker

Kali Linux VM on a desktop, with a USB Wi-Fi adapter

Tooling

Wi-Fi Pineapple (Recon, PineAP, handshake capture); Hashcat; rockyou.txt wordlist

Framework

MITRE ATT&CK, with ATT&CK Navigator for the layer mapping

The Wi-Fi Pineapple is used as an accessible front end for standard 802.11 attacks — comparable in capability to Aircrack-ng, but with one-click modules for reconnaissance, deauthentication, and handshake capture, plus a documented API for community modules. Preparation is routine: update the Kali VM, install the Pineapple's drivers, and connect through the vendor's helper script to reach its web interface.

Scope was limited to the Wi-Fi link between the drone and the connected phone. All work was carried out on the author's own equipment on a private network.

04The attack, mapped to ATT&CK

MITRE ATT&CK organises adversary behaviour into tactics (the goals, ordered from reconnaissance through to impact) and techniques (how each goal is achieved). It came out of MITRE's 2013 Fort Meade Experiment, where researchers emulated attacker and defender behaviour to improve post-compromise detection. Mapping an engagement to the matrix turns it into a reusable adversary-emulation scenario; the layer below was built in ATT&CK Navigator.

Tactic	Technique	Against the Tello
Reconnaissance	Gather victim network information; active scanning	Identify the wireless interface, then enumerate the `TELLO-xxxx` SSID and the drone and phone MAC addresses with the Pineapple recon module
Resource Development	Stage capabilities	Position the attacker phone as a competing client and the Pineapple as a monitor
Initial Access	Wireless compromise via deauthentication	Flood the operator's phone with spoofed deauth frames; it drops off and cannot reconnect
Execution	Operator command interface	The attacker connects to the open AP and issues flight commands from the app
Persistence / Priv-Esc	Modify configuration	Enable WPA2 and reset the SSID and password from the app to lock the original operator out — no privilege boundary to cross, since all clients are equal
Defense Evasion	Traffic impersonation	Control traffic is indistinguishable from a legitimate operator's; nothing is installed on the drone
Credential Access	Brute force: password cracking	Capture the WPA/WPA2 four-way handshake during the deauth; crack it offline with Hashcat and `rockyou.txt`
Discovery	System information discovery	Read and change flight speed, IMU and centre-of-gravity calibration, low-battery behaviour, photo quality, firmware version, and Wi-Fi settings via the app
Lateral Movement	—	Not applicable; the drone is the only target and there is no wider network
Collection	Video capture	The live camera feed is available to the attacker's phone
Command & Control	Direct connection	The attacker's phone connects straight to the drone; no C2 infrastructure needed
Exfiltration	Transfer over the control channel	Photos and video pull to the attacker's device
Impact	Denial of service; physical effect	A power-off command sent mid-flight ends the mission — the drone falls or force-lands

Reconnaissance and initial access

The open, passwordless access point is the first finding — it is what makes everything after it possible. With the SSID and the phone's MAC known, the operator's phone is flooded with deauthentication frames spoofed to look as though the phone itself sent them. It drops off the network and cannot re-establish the connection. The drone, now without a client, hovers in place; in poor light it may drift and strike something, and on a hard impact it cuts power and falls. With the operator locked out, the attacker's phone connects and takes the controls.

Holding and extending access

From the app, the attacker can rewrite the drone's Wi-Fi configuration: enable WPA2, set a new SSID and password, and lock the original operator out permanently. Because every client is equal, there is nothing to escalate to — being on the network already means full control, including injecting flight and configuration commands through the manufacturer's SDK and redirecting the video stream to the attacker.

Impact

The exercise stops at a demonstrated power-off in flight. The intent is to establish that the exposure is real and trivial to reach — not to damage equipment. All testing used the author's own drone.

05Cracking the Wi-Fi password

If the operator has set a WPA2 password, it can still be recovered offline. The deauthentication in the previous step does double duty: when the phone reconnects, it performs the WPA/WPA2 four-way handshake with the access point, and that handshake alone is enough to test password guesses without ever touching the network again.

The Pineapple's recon module can capture handshakes automatically during a scan and export them in Hashcat's 22000 format. Hashcat then runs a dictionary attack:

hashcat -m 22000 hash.hc22000 rockyou.txt

-m 22000 selects the WPA mode; rockyou.txt is the standard leaked-password wordlist. In testing, the network password was recovered. Because the attacker is never connected while guessing, the only real defences are a long, unpredictable passphrase or a move to WPA3-Personal, whose SAE handshake is not vulnerable to this offline dictionary attack.

06Findings

The Tello ships with an open access point and no password. That single default makes every later step possible.
A one-click deauthentication attack removes the legitimate operator; the drone then hovers, drifts, or crashes.
Any WPA2 passphrase the operator sets is recoverable offline from a captured handshake unless it is long and random.
Every device on the drone's network holds the same privileges as the operator, so network access is total control — including SDK-level flight and configuration commands and the video feed.
None of this requires skill or custom code: stock Kali utilities and Pineapple modules do the work, often from a single command.
An attack proven against one Wi-Fi drone transfers directly to any other built on the same wireless stack.

07Recommendations

For manufacturers

Ship with WPA2 enabled and a unique, printed, per-device password — never an open AP.
Support 802.11w (protected management frames) to blunt deauthentication attacks.
Move to WPA3-Personal (SAE) to eliminate offline handshake cracking.
Separate operator privileges from ordinary network clients.

For operators

Set a long, random passphrase before the first flight.
Assume anyone within Wi-Fi range can see the drone and attempt to disrupt it.
Keep firmware current; prefer models that document their security posture.

08Conclusion

A buyer should be able to assume a retail drone is reasonably secure. For the Wi-Fi class, this study finds the opposite: the attack surface is almost entirely 802.11, the vulnerabilities are old and well documented, and an attack proven against one device carries over to the next. Small drones cannot carry the defences of military systems — but an open access point and a weak default password are choices, not constraints. Privacy and security have to be designed in from the start, not bolted on after the incident reports.

Authorisation and intent. All testing was carried out on the author's own drone and equipment, on a private network, for research and education. No third-party systems or aircraft were involved. The techniques are standard 802.11 attacks documented in the public literature; they are presented here to argue for better defaults — not as an operational guide. Do not use them against equipment or networks you do not own.

Adapted and edited from a 2023 research paper by Oreoluwa Fagbamiye, “Drone Hacking: Hijacking a Wi-Fi-Based Drone Applying the MITRE ATT&CK Framework.”

Code and full reference list: github.com/ocfagb/wifi-drone-hijacking-mitre-attack · Licensed CC BY 4.0.