Comprehensive Security Assessment of Holy Stone Drones: Examining Attack Vectors

In an era where unmanned aerial vehicles (UAVs) are becoming indispensable across various sectors, from agriculture and logistics to emergency response and warfare, the security of these devices has never been more critical. However, the very features that make drones indispensable also expose them to significant security risks. As UAVs become more pervasive, their vulnerabilities, particularly in commercial off-the-shelf (COTS) models, present escalating threats to privacy, safety, and national security. This study offers a meticulous security analysis of four Holy Stone drone models HS175D, HS430, HS360S, and HS720 chosen for their relevance across varying regulatory frameworks and user bases. Our research uncovers critical vulnerabilities within these UAVs, including exposed Telnet services and unsecured RTSP links, which are particularly concerning due to their potential for unauthorized access and control. Through a combination of rigorous attack simulations and forensic analyses, we demonstrate how these weaknesses can be exploited to intercept sensitive data and disrupt drone operations. The forensic component of our study involved extracting and visualizing flight logs using advanced techniques, revealing how easily attackers can access and manipulate crucial information, raising alarm about the security of drone operations. In addition to identifying these vulnerabilities, we conducted comprehensive reliability testing on the tools and techniques employed in our analysis. This testing was performed across all drone models, utilizing multiple commands and time-based evaluations to ensure the consistency and accuracy of our findings. Our study concludes with the identification of two critical vulnerabilities, which were reported to the manufacturer, underscoring the urgent need for enhanced security measures in UAV design and operation. By highlighting these vulnerabilities and proposing targeted mitigation strategies, this research contributes to the ongoing discourse on UAV security, advocating for robust industry-wide standards to safeguard against evolving cyber threats.