ADX Security.
We interfere professionally.
Ground to Zenith.
About
ADX Security is an aerospace cybersecurity practice from India.
We test how drones fail when their radio links, navigation, software and hardware are attacked, and we tell their makers and operators what to fix.
The focus is drones, together with GNSS interference and resilience.
Engagements
An engagement is a defined piece of work on a drone system.
Command path
Whether a drone obeys commands it should refuse. Forged, replayed and unauthenticated messages are put to the flight controller and its ground station.
Navigation and links
How a drone behaves as its satellite navigation and radio links degrade or come under attack, measured from the first loss of signal to the effect on the mission.
System review
A drone system examined whole, across its radios, software, hardware and operators, with the attacks that matter ranked by consequence.
Simulation assessment
A drone and its attackers modelled in software, so that failures can be provoked and repeated at length without risk to an aircraft or to anyone near it.
Resilience design
Recommendations for building the software, the hardware and the positioning, navigation and timing of a drone so that it keeps its bearings when its signals are attacked or lost.
Retest
The same tests run again once the fixes are made, to confirm that each finding is closed and that nothing new has opened.
Retainer
Continuing work on a drone system as it changes, with a retest at each release, review of new components, and questions answered as they arise, for an agreed term and scope set down in writing.
Each is run in simulation, or on the client's own equipment under a written test plan.
- Written scope and authorisation before any work begins.
- A report that ranks findings by consequence, with the evidence and the recommended fix.
- Findings stay confidential until they are fixed.
- Vulnerabilities in third-party products go to the vendor first, and are published once fixed or after ninety days, whichever comes first.
Programmes
Work done in the open, within rules that others have published.
Bug bounty programmes
Research within the published scope of an organisation's bounty programme, with every finding reported through that programme and nowhere else.
Vulnerability disclosure programmes
Reports made under an organisation's disclosure policy, in step with its terms, and coordinated disclosure through the vendor where no policy exists.
Capture the flag
Competitions entered to keep the craft sharp, on targets built to be attacked and nowhere else.
A drone is a radio, a computer and a set of sensors that believe what they are told. Each belief is a way in.
Angles
Where those beliefs are held.
Communication
Control link
Commands that can be forged, replayed or drowned out.
Telemetry and video
Streams that reveal what the aircraft is doing, or can be made to say something else.
Protocols
Messages accepted as orders without proof of who sent them.
Navigation
Satellite navigation
Positions that can be spoofed, or silenced by jamming.
Onboard sensors
Inertial, barometric, magnetic and optical readings trusted without being cross-checked.
Software
Flight controller firmware
Parsing flaws, memory faults and unsafe defaults.
Ground control and companion computers
The laptops, phones and onboard computers around the aircraft, and everything they connect to.
Hardware
Debug interfaces and storage
Ports left open and secrets left readable.
Radio hardware
Transceivers with little or no protection of their own.
Update paths
Firmware and components that nobody has verified.
The work is centred on the first two groups.
Research
In progress, and in simulation.
Command injection
On a simulated flight controller, unauthenticated commands changed the flight mode, armed the vehicle, ordered take-off and redirected it. Every one was accepted. A monitor raised an alert on the command path.
A simulation environment
A simulated formation has its satellite navigation and radio links degraded by measured amounts, and its behaviour is recorded from the first loss of signal to the effect on the mission.
No live aircraft and no radio transmission are involved.
Detail
The detail is shared in conversation.
The research on this page is unpublished, and findings are held until they are fixed, so what is here is the outline. Anything further is discussed directly.
Boundaries
Drones carry relief, find people and fight fires. They are tested here so that they keep doing so.
- No testing without written authorisation.
- No radio transmission beyond what the law and the licence allow.
- No work that helps to harm people.
- No weapons, payloads or targeting.
Beyond
From finding what breaks to building what holds.
Testing is where the work begins. Its direction is toward more resilient software and hardware, and above all resilient positioning, navigation and timing, so that an aircraft keeps its bearings when its signals are attacked or lost.
Resilient software
Flight and ground software that refuses what it cannot verify, and fails safely when it must fail.
Resilient hardware
Radios, sensors and interfaces built so that one fault, or one hostile signal, does not decide the outcome.
Resilient positioning, navigation and timing
Position and time that check one another, and carry on when satellite signals are denied or false.
The surface is larger than drones, and satellites and aircraft are the next priority. The work moves that way only where the law, the licence and the owner's written permission allow.