近年來，隨著無人機的發展日益蓬勃，尤其是商業上常見的空拍機更是如日中天。因此，有越來越多的學者熱切地關注相關議題，例如：無人機對於居民的人身安全之影響，以及無人機對於敏感性資訊的資訊安全議題等等。同時，也有不少的研究指出，有許多針對無人機的攻擊都與民用的全球定位系統有關，由於民用的全球定位系統所發射之訊號是沒有加密保護的，而且也沒有相關的認證機制，再加上透過網路可以輕易地取得許多相關的公開文件，使得民用的全球定位系統之訊號容易被偽造，以此為主的欺騙攻擊層出不窮。另外，軟體無線電在這幾年來也有不錯的發展，利用軟體無線電可以比過去更容易做到全球定位系統的欺騙攻擊。因此，針對無人機的全球定位系統之欺騙攻擊是我們現在必須去面對並解決的問題。
在本篇論文中，我們說明如何利用軟體無線電裝置 HackRF One 以及開源軟體來達成挾持無人機的攻擊手法，同時我們也證實了這樣的攻擊手法並不需要太高的成本，市面上有許多通路可以購得軟體無線電裝置，網路上也可以免費取得相關的開源軟體，整個攻擊的過程並不會難以掌控，利用全球定位系統的安全漏洞來挾持無人機將不再需要很高的門檻。最後，我們提出了幾個可行的方法來保護無人機的導航系統，可以讓無人機在有限的資源下，實現最安全的保護機制。

As the booming growth of unmanned aerial vehicle (UAV, drone) in recent years, especially the commercial and recreational aerial photography UAVs, the safety issues of civilians and security problems of sensitive information are getting more concerns. Some studies have announced that many attacks against UAVs are highly connected to the vulnerability of civil global positioning system (GPS). The transparency and the predictability of unencrypted civil GPS signal make it easy to counterfeit. Furthermore, due to the development of software defined radio (SDR) in recent years, launching civil GPS spoofing attack no longer requires so much cost. GPS spoofing against drones using SDR devices has severely threaten its flight security and Personal safety.
In this thesis, we demonstrated three UAV hijacking attacks using HackRF One, a software defined radio (SDR) device, with corresponding open source projects. We also proved that launching such threatening attacks demands no much cost and is easy to be controlled. In summarized, we proposed some possible approaches to enhance the security of UAV's location information.

Table of Contents .......................................................................................... i
List of Figures ................................................................................................ iii
List of Tables .................................................................................................. iv
Chapter 1 Introduction.............................................................................. 1
1.1 Motivation........................................................................................... 2
1.2 Contribution ....................................................................................... 2
1.3 Organization ....................................................................................... 3
Chapter 2 Background ............................................................................... 4
2.1 Global Positioning System .................................................................. 4
2.1.1 Global Navigation Satellite System...................................... 4
2.1.2 Basis of GPS ........................................................................ 5
2.1.3 GPS Positioning Principle.................................................... 5
2.1.4 Vulnerabilities of Civil GPS ................................................. 6
2.2 Unmanned Aerial Vehicle.................................................................... 7
2.2.1 Characteristics of Drone....................................................... 7
2.2.2 Weaknesses of Drone ............................................................ 7
Chapter 3 GPS Spoofing Using SDR...................................................... 9
3.1 Software Defined Radio Platform........................................................ 9
3.2 SDR Hardware Platform..................................................................... 10
3.3 SDR Open Source Projects ................................................................. 12
3.3.1 GPS-SDR-SIM ..................................................................... 12
3.3.2 Spoofer with Joystick ........................................................... 14
Chapter 4 Experiment ............................................................................... 16
4.1 Design ................................................................................................. 16
4.1.1 Forced Landing..................................................................... 16
4.1.2 False Direction Guiding........................................................ 18
4.1.3 Landing on False Area ......................................................... 19
4.2 Setup................................................................................................... 21
4.3 Result.................................................................................................. 22
4.3.1 Forced Landing..................................................................... 22
4.3.2 False Direction Guiding........................................................ 24
4.3.3 Landing on False Area ......................................................... 25
Chapter 5 Conclusion................................................................................. 26

[1] Amazon prime air. https://www.amazon.com/Amazon-Prime-Air/b?node=
8037720011.
[2] David Glade. Unmanned aerial vehicles: Implications for military operations.
Technical report, DTIC Document, 2000.
[3] Nils Ole Tippenhauer, Christina Pöpper, Kasper Bonne Rasmussen, and Srdjan
Capkun. On the requirements for successful gps spoofing attacks. In Proceedings
of the 18th ACM conference on Computer and communications security, pages
75–86. ACM, 2011.
[4] Todd Humphreys. Statement on the vulnerability of civil unmanned aerial
vehicles and other systems to civil gps spoofing. University of Texas at Austin
(July 18, 2012), 2012.
[5] Kexiong Curtis Zeng, Yuanchao Shu, Shinan Liu, Yanzhi Dou, and Yaling
Yang. A practical gps location spoofing attack in road navigation scenario. In
Proceedings of the 18th International Workshop on Mobile Computing Systems
and Applications, pages 85–90. ACM, 2017.
[6] Open source project: Gps-sdr-sim. https://github.com/osqzss/
gps-sdr-sim.
[7] Global positioning system. https://en.wikipedia.org/wiki/Global_
Positioning_System.
[8] Jon S Warner and Roger G Johnston. Gps spoofing countermeasures. Homeland
Security Journal, 25(2):19–27, 2003.
[9] Gps broadcast ephemeris data. https://cddis.nasa.gov/Data_and_
Derived_Products/GNSS/broadcast_ephemeris_data.html.
[10] Farid Kendoul. Survey of advances in guidance, navigation, and control of
unmanned rotorcraft systems. Journal of Field Robotics, 29(2):315–378, 2012.
[11] Edwin Vattapparamban, İsmail Güvenç, Ali İ Yurekli, Kemal Akkaya, and
Selçuk Uluağaç. Drones for smart cities: Issues in cybersecurity, privacy, and
public safety. In Wireless Communications and Mobile Computing Conference
(IWCMC), 2016 International, pages 216–221. IEEE, 2016.
[12] Sait Murat Giray. Anatomy of unmanned aerial vehicle hijacking with signal
spoofing. In Recent Advances in Space Technologies (RAST), 2013 6th International
Conference on, pages 795–800. IEEE, 2013.
[13] Soft defined radio. https://en.wikipedia.org/wiki/Software-defined_
radio.
[14] Hackrf one official website. https://greatscottgadgets.com/hackrf/.
[15] The clocking of hackrf one. https://github.com/mossmann/hackrf/wiki/
Clocking.
[16] Gps spoofing attack and tcxo. https://forums.hak5.org/index.php?
/topic/38290-gps-simulator/.
[17] Ubuntu manpage : hackrf-transfer. http://manpages.ubuntu.com/manpages/
xenial/man1/hackrf_transfer.1.html.
[18] Rinex format. https://en.wikipedia.org/wiki/RINEX.
[19] Ftp server of gps broadcast ephemeris data. ftp://cddis.gsfc.nasa.gov/
gnss/data/daily/.
[20] Open source project: Defcon24 - drones hijacking. https://github.com/
Aaron-Luo/DEFCON24.
[21] Dji phantom 3 standard. http://www.dji.com/zh-tw/phantom-3-standard.
[22] Dji go app. http://www.dji.com/zh-tw/phantom-3-standard/app#
sub-feature.
[23] Spread spectrum. https://en.wikipedia.org/wiki/Spread_spectrum.