A drone is not a single device. It is three distinct systems operating in concert: the aircraft itself, the ground control station, and the communications data-link connecting them. Each is a separate attack surface. Compromise any one and you can undermine the whole. That topology matters because most public discourse about drone cybersecurity still collapses the threat into a single vague category—“hacking”—when the actual vulnerability landscape is considerably more granular, and considerably more exploitable than most operators realize.

The 2025 Frontiers in Communications and Networks survey of UAS security professionals found that GPS spoofing was familiar to only 38% of respondents, command hijacking to 32%, and firmware tampering to a mere 25%. The threats are real and documented. The awareness is not.

Command Links: What Happens When the Radio Is the Weakest Link

MAVLink 2.0, the open protocol used by most autopilot firmware in research and commercial open-source drones, ships with a well-known vulnerability: heartbeat messages can be spoofed or injected without authentication unless operators explicitly enable message signing. The protocol's ubiquity in hobbyist and research platforms means its weaknesses are extensively documented—and extensively targeted. The OWASP Drone Security Cheat Sheet recommends end-to-end TLS/DTLS encryption alongside message signing as baseline mitigations; neither is on by default in most open implementations.

Wireless protocols layered beneath MAVLink create additional exposure. Bluetooth-paired controllers using “Just Works” pairing lack mutual authentication, making them vulnerable to man-in-the-middle attacks. ZigBee-based links can be passively sniffed using widely available software-defined radio tools. Wi-Fi deauthentication attacks—sending forged 802.11 deauth frames with microcontroller-based hardware—can sever the control link entirely. OWASP recommends WPA3 with 802.11w Management Frame Protection as countermeasures for Wi-Fi-controlled systems, and Bluetooth LE Secure Connections (Bluetooth 4.2 or later) with ECDH-based key establishment for paired controllers.

Researcher Samy Kamkar's Skyjack experiment illustrated where protocol-level command vulnerabilities lead at scale: a drone autonomously scanning for, hijacking, and controlling nearby consumer drones—a hacker-controlled swarm functionally comparable to a botnet. The mechanism was straightforward. The implications for multi-drone operations are not.

GPS Spoofing: The Attack That Downed a Sentinel

Signal spoofing against GPS is the drone cyberattack with the most consequential documented history. In 2011, Iran reportedly used GPS spoofing to capture an American RQ-170 Sentinel stealth drone—one of the most widely cited real-world cases of UAS signal exploitation. The mechanism: transmitting counterfeit GPS signals that progressively shift the drone's perceived position until the flight controller, trusting the falsified coordinates, lands the aircraft in the wrong location.

Consumer and commercial drones are not more resistant to this than military platforms by default. GNSS receivers process whatever signals arrive at the antenna. Defenses—signal watermarking, entropy validation of incoming position data, cross-referencing with inertial navigation—require deliberate engineering investment. Most off-the-shelf platforms do not include them. The gap between military awareness of the threat and commercial implementation of mitigations remains significant.

Firmware, Supply Chain, and the Machines That Infect Themselves

Unsigned bootloaders are a pervasive problem across drone architectures. Without cryptographic firmware signing and a secure boot chain anchored to an immutable first-stage bootloader, firmware downgrade attacks are straightforward: an adversary replaces current firmware with an older, unpatched version, stripping whatever security improvements the manufacturer has shipped. Companion computers managing payloads and peripherals often expose open SSH and FTP ports with default credentials—entry points that require no protocol exploitation at all, just a credential scan.

The supply chain risk is not theoretical. In 2012, U.S. Army drone control computers were found to be infected with malware—not through any sophisticated network intrusion but because operators used a drone computer to download and play a video game. The malware was logging keystrokes. That incident predates the current generation of UAS architecture but captures a category of threat that has not diminished: software introduced through the operator's own behavior, on hardware that was never designed to be air-gapped.

DJI's own cloud infrastructure demonstrated the manufacturer-side exposure: the company previously issued security patches after unauthorized access to its systems exposed flight logs, videos, photos, and real-time map views from users—not from the drone itself, but from data stored on the manufacturer's cloud. The aircraft was never touched. The operator's operational history was.

The Blue UAS program addresses supply chain risk structurally. Launched by the Defense Innovation Unit in 2020, it mandates that certified platforms provide a software bill of materials (SBOM) and hardware bill of materials (HBOM)—a complete inventory of every software component and hardware subassembly. Certification testing examines API security, network communication protocols and encryption, data storage mechanisms, and update integrity, with findings categorized as severe, medium, or low risk. As of its December 2025 transition to the Defense Contract Management Agency, the program covered 39 certified platforms, 165 cleared components, and 81 vetted companies.

“DIU built the prototype Blue UAS construct; DCMA is now tasked with turning it into an enterprise tool embedded in day-to-day acquisition.” — Col. Dustin Thomas, DCMA US-X Commander

The DJI Question: Market Dominance Meets Statutory Prohibition

DJI controls approximately 90% of the consumer drone market in North America and over 70% of the industrial market. That concentration made the January 17, 2024 FBI/CISA guidance consequential in a way that a warning about a marginal manufacturer would not be. The agencies identified three core vulnerability categories for Chinese-manufactured UAS: data transfer and collection practices, weaknesses in patching and firmware update mechanisms, and the expanded attack surface introduced by IoT devices—smartphones, tablets—used as ground control stations.

The legal dimension is distinct from the technical one. Chinese law gives the PRC government expanded grounds to compel data access from Chinese companies, creating a legal pathway for sensitive U.S. operational data to reach Beijing that exists regardless of whether any technical backdoor is present. A 2017 DHS assessment raised concerns that data collected by DJI drones during normal U.S. operations could be exploited to inform Chinese economic and strategic decisions.

DJI has contested both the technical characterization and the statutory designation. An independent audit of DJI Air 3S and Matrice 4E systems conducted by U.S. firm OnDefend between October 2025 and March 2026—using off-the-shelf units purchased without DJI pre-notification—found zero critical, high, or medium-risk vulnerabilities. No backdoors, no data transmission outside the U.S., no unexplained RF emissions, no supply chain tampering. DJI cited those results in an appeal of its December 2025 FCC Covered List designation, noting that over 80% of U.S. state and local law enforcement agencies operating drones use DJI platforms.

The tension is unlikely to resolve cleanly. A clean technical audit does not nullify the legal-access provisions under Chinese law, and those provisions apply to any company with Chinese ownership or operations regardless of where data physically resides. The FBI's assessment—“without mitigations in place, the widespread deployment of Chinese-manufactured UAS in our nation's key sectors is a national security concern”, per Assistant Director Bryan Vorndran—addresses the structural risk, not the specific audit findings.

Trusted Platforms and Defense-Grade Encryption Baselines

What does a genuinely hardened drone system look like in practice? Skydio's X10 enterprise platform provides a documented reference: AES-256 encryption for drone-to-controller communications via its Connect SL link, TLS 1.2/1.3 for cloud communications, AES-256 for data at rest, and Secure Boot ensuring only Skydio-signed code can execute on the device. These are not exotic capabilities—they are standard enterprise security practices applied to a domain that has historically treated them as optional.

Zero-trust architectures, which require continuous verification of every device and user rather than assuming trust after initial authentication, are beginning to appear in fleet management contexts, particularly for sensitive missions. Air-gapped operations—where the drone and ground control station never touch an external network—remain the ceiling for classified environments. Physical security of data at rest matters too: storage encryption on the aircraft itself is the only protection if a drone is downed or captured, and USB ports on companion computers represent physical entry points that policy controls alone cannot fully address.

The American Security Drone Act, incorporated into the FY2024 NDAA, extended procurement prohibitions from DoD—where they originated in the FY2020 NDAA—to all federal agencies, effective December 22, 2023, with full operational bans beginning December 22, 2025. The Green UAS program provides a parallel certification track for commercial and public safety operators aligned to the same cybersecurity standards, including SBOM/HBOM verification. Taken together, the regulatory architecture is creating a bifurcated market: platforms that have undergone structured adversarial testing, and platforms that have not. The distinction will increasingly determine what missions operators can legally—and practically—fly.

Sources