ICACT20210119 Slide.24
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Thank you for your time and listening to our sharing on the paper Drone Forensics A Case Study on DJI Mavic Air 2. We appreciate questions or any follow up discussions. Please do drop us questions or discussion points and we will be happy to answer those and explore further possibilities. Once again, thank you and stay safe.
|
|
ICACT20210119 Slide.23
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
So far, we had an in-depth discussion on the DJI Mavic Air 2 drone and FTP service that runs on the drone.
We also discovered that we could use board serial number which can be used to identify the owner of the drone.
However, despite that, there is more work that can be done on the remote control and the application on the smart phone as there those may provide other crucial information that can be used for investigation purposes.
Similarly, more studies can be done on the encryption and decryption routines used in the Trusted Zone.
|
|
ICACT20210119 Slide.22
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Conclusion and future works
|
|
ICACT20210119 Slide.21
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
However, despite that, we can still establish a link between file found in an external storage and the drone through board serial number of the drone. When we get a file via FTP or DJI assistance (as mentioned the file will be encrypted), the file will have a header which contains various crucial information such as the board serial number and model of the drone. In addition, the header also include the data size of original file. the length of the header is 160 bytes or 0xA0 in hexadecimal. Note that the board serial number is different from the drone serial number.
|
|
ICACT20210119 Slide.20
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Whenever a file is transferred via FTP, the drone will encrypt the data using AES with a random seed. The random seed is used to generate the random seed key (RSEK). The RSEK is the “password” used as the input to the encryption. On newer DJI drones, both the seed and RSEK is generated using a Trusted Application in the Trusted Zone (TZ). This makes it exceptionally difficult to find a way to “sniff” those data out unless there is a vulnerability in the TZ.
|
|
ICACT20210119 Slide.19
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Next, we will touch on the last item for our research contribution which is on FTP service of the drone.
Users of the drone can extract out and send files via the FTP service. However, whenever files are being extracted out, the file will be encrypted. Likewise this is also the case when files are extracted using the DJI Assistant.
The tools that were used to do static binary analysis are IDA Pro and Ghidra and for dynamic analysis, we executed the application on a Raspberry Pi board. One of the things to monitor during dynamic analysis is DUML packets.
DUML stands for DJI Universal Markup Language. However, the name DUML is a misnomer as DUML is a binary protocol rather than a Markup Language. DJI drones communicate via DUML at the low level with various other devices such as the remote control
|
|
ICACT20210119 Slide.18
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Hamdi and Yousef shared their forensic examination on DJI Phantom 4 and DJI Mavic Air which they performed on the drone’s on-board SD card. The technique that we used is similar to them on SD card forensic examination.
|
|
ICACT20210119 Slide.17
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
We can also do timeline analysis of the drone usage. Based on the diagrams, we can tell that most of the activities occurred around June to July 2020. A further examination was done, and it was discovered that there were more activities carried out between 26 June and 1 July 2020.
The end goal is to narrow the window of search for identifying either the owner of the drone or flight paths logs.
|
|
ICACT20210119 Slide.16
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Once the on-bard storage has been extracted, media files such as photographs taken during the simulated flight can be viewed and examined. These files can provide leads for identification of the owners and whereabouts of the take-off site.
There are a few files and folders that may provide forensic values. Based on the diagram showed, these are the important folders and files to take note. Do note that, data at rest, the data is unencrypted and typical computer forensic techniques can be used to analyze the data.
|
|
ICACT20210119 Slide.15
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Examination results
|
|
ICACT20210119 Slide.14
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The slide shows the KLMAG1JETD-B041 model eMMC storage and 2D X-Ray image of core motherboard. Also to note, 3D x-way was also employed.
Based on our research, the memory chip that identified on the drone is KLMAG1JETD-B041 model eMMC. Armed with this crucial information, we could safely and correctly identified the relevant pins for ISP (in-system programming) method to extract data. A few points worth mentioning while performing ISP data extraction, we have to be mindful when injecting external power supply (3.3 or 1.8 volt) into the circuit board as it may power on , apart from the flash memory chip, other chips and could interfere with the ISP data extraction.
|
|
ICACT20210119 Slide.13
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Our data acquisition methodology is based on the Chip-Off and Chip-On technique.
First, we dismantle the drone to reveal motherboard, then we try locating the flash memory. Once we have found the flash memory, identify the model and type followed by reading the data sheet of identified memory chip. By referencing the correct datasheet of the flash memory is important as identify the pins on the chip, these will be discuss in the next slide.
Then we try to read the data directly from the chip by connecting to a memory chip reader. If that is not possible, we do track the circuit using 2D/3D X-Ray to identify connection points to read the memory then we connect in-system programming to the points to read data off the chip.
|
|
ICACT20210119 Slide.12
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Methodology and implementation
|
|
ICACT20210119 Slide.11
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Our research contribution, is
One, we explore the different and feasible methodologies to tackle the issue to extract data from the inoperative drone. We proposed extraction of the Data-at-Rest on the memory chip (internal storage) of the drone using the Chip-Off and Chip-On technique.
Two, as the Drone flight data logs (that are found in external storage such as in portable storage or in Cloud) are encrypted we will analyze the encryption format of DJI log file. The end in mind is to identify the original drone that generated the flight data and establishment of a relationship between encrypted flight data DAT logs found in an external storage and the Drone
Three, as previously mentioned that one of the possible channel to extract data is through FTP protocol, we provided a detailed discussion on the evaluation and results of the forensic examination on the FTP service for DJI Mavic Air 2 which could be useful for future follow-up or enhancement.
|
|
ICACT20210119 Slide.10
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
From the literature review, one of the obvious assumption is the drone in examination must be operational. The problem statement could be is it possible to conduct forensics on drone suffered physical damages, rendering it inoperative? The other is the Drone flight data logs are encrypted and the drone operator is unidentified when the drone was found in the incident scene, i.e. how could we establish the drone to possible drone owner?
In the slide, also list the proposed scenario setup for this research paper and the drone in examination is one of the recent DJI drone model known as DJI Mavic Air 2.
|
|
ICACT20210119 Slide.09
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Problem statement and research contribution
|
|
ICACT20210119 Slide.08
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Another related research paper on drone forensics is from Fadilah and team, they explored on the USB and Radio (red arrow lines on the slide) communication channel between mobile device, remote controller and drone (aircraft). The paper focused on reversing the command protocol issued by drone owner through the mobile device. By capturing the raw command protocol, they have shown a hacker could take over the drone. The other attacking surface is through radio communication between remote controller and drone, the idea is capture the raw radio signal while the drone is operational, for example, lift off, using radio signal sniffer. Thereafter, send the recorded raw radio signal to illegally request the drone to lift off, this is commonly known as replay attack. Unfortunately, replay attack does not work in DJI drone as they could be using hopping frequency such as FHSS (Frequency-hopping spread spectrum) which breaks the replay attack.
In this paper, the assumption that the drone in examination is , also, in working condition.
|
|
ICACT20210119 Slide.07
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Both the papers have the assumption that the drone in examination is in working condition. That is the drone could be power on, the Android variant operating system is running operationally and ready for data extraction through either DJI assistance or FTP commands. Now, there could be a research idea if the drone is faulty and unresponsive to DJI assistance or FTP commands. How can we overcome these limitations?
|
|
ICACT20210119 Slide.06
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The next digital forensics point on the drone eco system is commonly known as computer forensics. It is used for conducting data extraction and examination on the drone (aircraft) on-board SD card. As the file system of the SD card (FAT FAT32 exFAT) is identical as those used in computer such as in Windows operating system, thus we could applied the usual computer forensics to the SD card of drone. The forensic element are the photographs and videos taken during the flight by the drone, these media could include metadata, for example, date time and GPS of the media taken.
|
|
ICACT20210119 Slide.05
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Let us start the literature review on one of the common DJI drones namely DJI Phantom 4 and DJI Mavic Air. The team from Hamdi and Yousef have performed digital forensics examination on the mentioned drones and presented their forensic findings on, first, DJI Go Applications, and DJI Assistance software where these applications are running on the mobile device. We could generally group these forensic activities as mobile forensics. From the slide, we have categorized the tools, forensic element and technical data that summarized mobile forensics in drone context. Starting from the tools group, the common tools are cellebrite – which is famously known for the technical depth and widely covered mobile device forensics. The notably forensic elements are unencrypted flight logs which assist in determining of flight path on drone.
|
|
ICACT20210119 Slide.04
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Let's move on to literature review.
|
|
ICACT20210119 Slide.03
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
A digital forensic examination on a drone is normally done on the aircraft (sometime commonly known as drone) shown on the slide annotated as number 1. The drone also has external and internal SD card as storage. Next, number 2 is the remote control device and the application on the mobile phone (number 3) as well as the computer (number 4) for any data related to an incident. Not to forget on the radio communication channels between drone, remote controller and mobile device (number 2 5 and 6).
To add-on, the related data can be obtained from the File Transfer Protocol (FTP) channel through the USB port of the aircraft (number 1) and the data stored on the mobile phone (number 3) by the DJI flight application. These data are normally extracted through rooting the aircraft or exploiting the vulnerability of the FTP service in the older firmware.
There are numbers of research and published papers on forensic areas on any touch point along the drone eco system, these related papers will be discussed in the following slides presentation.
|
|
ICACT20210119 Slide.02
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
With the inundation of more cost effective and improved flight performance Unmanned Aerial Vehicles, there is a growing interest for individuals and companies to explore the use of this device for leisure and business purposes. In this paper, we will explore and discuss the forensic examination process on one of the more popular brands of UAV in Singapore, namely DJI. The popular consumer DJI drone models are the Mavic and Phantom series. The slide shows the lowest end of DJI drone offering – the DJI Mavic mini. The uniqueness for DJI Mavic mini is the weight is only 249 gram, i.e. lesser than the weight for drone registration. The hobbyist favorite drones also include the Mavic 2 and Mavic Air 2. The other series are the DJI Phantom 3 and Phantom 4, both are common drone models. With the improved capabilities and performance, these drones have been exploited by people with ill intent to commit offensive acts like trespassing the No-Flight Zone and trafficking of forbidden goods or items. The advanced features of the drone help to conceal their notorious acts and make identification of the flight operator challenging.
|
|
ICACT20210119 Slide.01
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Good day everyone, I am James Lan from Home Team Science and Technology HTX of Singapore. Together with me is Frankie Lee, and he is also from the same agency. In this session, we will share the findings our paper on Drone Forensics A Case Study on DJI Mavic Air 2.
|
