Photo: Screenshot from WeChat account of Ministry of State Security

Internet-connected drones, which rely on mobile communication networks for long-range remote control, are widely used in logistics, inspections, urban management and agricultural operations. China’s Ministry of State Security (MSS) warned on Thursday of infiltration and attacks targeting such drones by foreign spy agencies. 

According to the MSS, cellular connectivity-based networked drones use mobile communication networks, such as 4G and 5G, to enable long-distance remote control, reliably transmit control signals and provide real-time image transmission, offering ultra-high-definition video transmission, low-latency remote control and coordinated multi-drone operations. 

As a key driver of the low-altitude economy, networked drones are widely used in logistics and transportation, surveillance and inspection, urban governance, agricultural crop protection, and other fields, the MSS said. 

However, the new risks posed by networked drones cannot be ignored. State security authorities have recently detected and dealt with multiple cases involving security risks associated with networked drones, exposing a range of potential security vulnerabilities in their production and use. 

The authorities have found that foreign intelligence agencies have continued to target networked drone inspection platforms with infiltration attacks. 

Recently, an inspection platform of networked drones deployed by a large domestic company experienced abnormal cross-border traffic. Multiple overseas IP addresses exploited technical vulnerabilities in the platform to bypass authentication, illegally access its backend and view sensitive data, including inspection records, flight logs and equipment inventories, posing a potential threat to China’s national security. 

After detecting the threat, state security authorities promptly helped the affected company block the attacks and have continued efforts to tackle the threat at its source. 

The investigation found that common security weaknesses in compromised networked drone inspection platforms include unpatched vulnerabilities and weak passwords. Once exploited, these weaknesses can allow attackers to breach backends and gain control over critical functions, such as issuing flight-control commands and accessing device-status data.

Some inspection platforms have poorly defined user roles and access controls, allowing attackers who breach the front end to use low-privilege accounts to gain unauthorized access to higher-level functions and resources.

In addition, inspection images and flight data sent over 4G/5G networks may be vulnerable when links are unencrypted or use outdated protocols, allowing attackers to intercept high-resolution aerial images and flight paths through man-in-the-middle attacks.

Foreign spy agencies could also exploit supply chains to implant malicious code in drone systems, turning deployed equipment into covert “data sentinels” capable of continuously transmitting sensitive information abroad. 

In response, state security authorities urged networked drone operators and users to strengthen cybersecurity by adopting multi-factor authentication, strictly controlling access and high-risk operations, encrypting drone-platform communications, and conducting regular security assessments and penetration tests to promptly fix vulnerabilities. 

Global Times