Back to Press Releases and Announcements

BIRDWATCH program: Ghost in the Orlan: demystifying a military drone platform (CVE-2022-38161)

Published on:: 2022-08-09 06:43:36 +0000 UTC
Last modified:: 2022-08-09 00:00:00 +0000 UTC

Background

Subreption’s research and development team, for the past few months, has been dedicating manpower and resources to investigate and analyze military and paramilitary drone platforms operating in Asia and Europe. Our background is primarily vulnerability research and reverse engineering, enabling us to understand these platforms for both offensive and defensive purposes, including but not limited to detection, forensics data acquisition and active countermeasures.

Demystifying the Orlan: a technical report

As part of the announcement, we are releasing our first public report from the program, related to the Orlan (primarily Orlan-10) platforms in use by the armed forces of the Russian Federation. The Orlan-10 has been a center piece in the Russo-Ukrainian war of 2022, with sensational coverage from the press. Very little factual or in-depth information has been published, and most of the journalism involved has been heavily connected to counter-drone (CUAS) commercial vendors making claims without third-party verification.

We are taking the opportunity to release the first documented exploit against a military drone platform (in this case, one targeting the FPGA used in the Orlan-10 communications system), while providing in-depth analysis of the hardware and software internals, detailing the reverse engineering efforts involved. Hopefully, this invites and motivates others (including academia and industry peers) to publish factual, technically verifiable research instead of “marketing in disguise”. While the topic is sensitive, we have carefully assessed the information published, withholding details that might not be ready for public disclosure yet.

For the better and the worse, information related to the Orlan platform has been circulating in a mostly uncontrolled and unsupervised fashion with third-parties for the last few months.

In many cases, this was directly connected with for-profit organizations attempting to develop products for the Ukrainian market, and more often than not, security practices left much to be desired (admittedly, many of the organizations involved with CUAS products are not qualified as software security vendors, and typically radiofrequency engineers and hardware development vendors do not have a spotless security posture, most of them being wildly unaware of the state of the art in offensive security).

Contrary to propaganda, the Orlan platform, contains sophisticated original research and development, especially in its communications system. We are dedicated to providing truthful, unbiased information to our customers and the general public, as part of our principles and values, beyond any commercial, personal or political agenda.

The report can be downloaded here:

https://subreption.com/downloads/reports/demystifying-the-orlan-10_opt.pdf (optimized PDF)

What does the exploit do?

The exploit abuses a vulnerability (CVE-2022-38161) in the FPGA application and Linux kernel driver, to remap access to the NOR flash memory containing the actual “application” or bitstream the FPGA boots from.
This allows rendering the drone inoperable and/or trojanizing the FPGA software.
- We have previously heard claims that the UHF modem can independently operate from the FPGA, but this is at best a half-truth or the result of poor reverse engineering of the platform.
Remote (over the network) vectors exist to abuse the vulnerability, allowing a full remote exploit chain to exist when paired with a traffic injection attack.
The vulnerability presents an enormous challenge for mitigation, and disclosure hardly presents a danger:
- This is not a classic client-side or server-side component vulnerability in an easily patched computer architecture, that a vendor can fix within hours or days, barring gross incompetence.
- The Gumstix SBC must be flashed manually with a completely updated set of user-land components. This cannot be done “over the air” or with the GCU as-is.
- The FPGA driver would need to have a significant amount of code rewritten, and the user-land components would need to be updated to completely alter the way they interact with the driver.
- In case the FPGA is abused, the only way to fix it is by servicing the board with a JTAG.
- Redesigning the architecture to leverage encrypted bitstreams, authenticated updates, etc, is not a trivial exercise by any stretch of the word “trivial”. It would require significant research and development efforts to do it right, and then successfully deploy the changes.
- All these steps must be organized and executed in the context of an armed conflict, disrupting the use of the drones, recalling or transporting them to a location prepared to perform the steps with qualified personnel at hand. This, on its own, is a significant problem of logistics.

Take-aways

The technical report is the first of its kind, with no technical resources of reverse engineering or in-depth analysis of the Orlan-10. Every news piece to date merely focused on unverified claims or marketing attempts for products sold by CUAS vendors.
This is the first publicly documented military drone vulnerability published or disclosed openly.
The report and tools developed are the result of the BIRDWATCH program, a months-long initiative to collaborate with groups interested in independent, unbiased investigation of drone security.

The BIRDWATCH program

Subreption recently opened up the BIRDWATCH program to be more accessible and transparent, focusing on a non-commercial approach. Our intentions with the program are fairly straightforward: to provide reverse engineering and accurate analysis of drone platforms used for defensive and offensive purposes. We have successfully collaborated with multiple groups internationally, including groups based out of Ukraine.

The nature and motivations of the program are not political. We strive to remain impartial, focused on the technical details and unbiased analysis. We will consider cooperation with any organizations and individuals, with no discrimination, so as long as it is permitted by law, including any applicable restrictions due to sanctions.

How to participate

At the moment, there are two distinct venues for collaboration, for commercial and non-commercial engagements.

If you are a non-government not-for-profit organization or institution, not presently taking bribes or commissions in any shape or form from commercial vendors, we can offer pro bono services including research and forensics data analysis.
- This service requires transparency and accountability, as we will independently take the appropriate measures to identify and validate partners and their affiliations.
- We do not offer pro bono services to individuals, business entities or governments, with no exceptions.
- Any form of profit (direct or indirect) is an instant dis-qualifier from our “pro bono” work. This includes, but is not limited to, employment or income sources directly related or benefiting from activities related to cooperation with the program.
- Organizations engaging in procurement or contracting of foreign vendors and their products are typically excluded as well.
If you are a for profit organization (including but not limited to charities receiving financial aid and at the same time purchasing or engaging in the trade of high value products and services), we can offer competitive pricing on our consulting and research and development services.

While we might occasionally make exceptions, we do not engage with pseudonymous individuals or organizations without adequate accountability. We are also not interested in the illegal or illegitimate trade of hardware or captured systems. In order to protect both the work and the interests of all parties involved, Subreption will require both a Mutual Non-disclosure Agreement and a Non-compete Agreement signed by all the recipients of the information and hardware exchanged.

Sending applications

If you meet the criteria, feel absolutely welcome to contact us using our SecureDrop instance (https://subreption.com/about/securedrop/), including as much detail as possible in your application.

We will consider all applicants carefully on a case-by-case basis.

Conflicts of interest

Subreption is not currently involved in the sale or procurement of counter drone-related products for Ukraine. All research related to military drone platforms until August 2022 has been provided free of charge, as part of the BIRDWATCH program.

Our staff has no assets or financial instruments associated in any way to any consumer or industrial drone (or counter-drone) vendor.

Subreption is providing pro bono consulting and research to multiple institutions in Europe and Asia, as well as volunteer organizations, in the context of information security (defensive and offensive).

References

US Army OE Data Integration Network (ODIN) resources on Orlan systems
Orlan-10 (Wikipedia)
Russia’s Deadly Artillery Drones Have A Strange Secret (Forbes)

Updates

Any updates and amendments to this press release will be listed in this section.

Clarifications about the importance of the FPGA and unsubstantiated claims to the contrary have been added.
The actual, non-speculative impact of disclosure has been clarified, per requests from a member of the press, as a prophylactic measure to avoid any sort of confusion or manipulation of the facts (such as implying that disclosure of the vulnerability might be harmful in the short-term for counter-drone efforts). The difficulty in remediating the vulnerability cannot be overstated, and any claims to the contrary imply a deep lack of awareness and understanding of both the technical and logistics aspects involved, or an intentional attempt to divert attention from the technical facts and merits of report, as well as slandering and misrepresenting our work ethic and motivations.

Contact

Press and media can reach us at regarding this announcement or any other inquiries.

Feel welcome to use PGP if you have sensitive information or special confidentiality needs.