BIRDWATCH program: Ghost in the Orlan: demystifying a military drone platform

Published on:
2022-08-09 06:43:36 +0000 UTC
Last modified:
2022-08-09 00:00:00 +0000 UTC

Background

Subreption’s research and development team, for the past few months, has been dedicating manpower and resources to investigate and analyze military and paramilitary drone platforms operating in Asia and Europe. Our background is primarily vulnerability research and reverse engineering, enabling us to understand these platforms for both offensive and defensive purposes, including but not limited to detection, forensics data acquisition and active countermeasures.

Demystifying the Orlan: a technical report

As part of the announcement, we are releasing our first public report from the program, related to the Orlan (primarily Orlan-10) platforms in use by the armed forces of the Russian Federation. The Orlan-10 has been a center piece in the Russo-Ukrainian war of 2022, with sensational coverage from the press. Very little factual or in-depth information has been published, and most of the journalism involved has been heavily connected to counter-drone (CUAS) commercial vendors making claims without third-party verification.

We are taking the opportunity to release the first documented exploit against a military drone platform (in this case, one targeting the FPGA used in the Orlan-10 communications system), while providing in-depth analysis of the hardware and software internals, detailing the reverse engineering efforts involved. Hopefully, this invites and motivates others (including academia and industry peers) to publish factual, technically verifiable research instead of “marketing in disguise”. While the topic is sensitive, we have carefully assessed the information published, withholding details that might not be ready for public disclosure yet.

For the better and the worse, information related to the Orlan platform has been circulating in a mostly uncontrolled and unsupervised fashion with third-parties for the last few months.

In many cases, this was directly connected with for-profit organizations attempting to develop products for the Ukrainian market, and more often than not, security practices left much to be desired (admittedly, many of the organizations involved with CUAS products are not qualified as software security vendors, and typically radiofrequency engineers and hardware development vendors do not have a spotless security posture, most of them being wildly unaware of the state of the art in offensive security).

Contrary to propaganda, the Orlan platform, contains sophisticated original research and development, especially in its communications system. We are dedicated to providing truthful, unbiased information to our customers and the general public, as part of our principles and values, beyond any commercial, personal or political agenda.

The report can be downloaded here:

What does the exploit do?

  • The exploit abuses a vulnerability in the FPGA application and Linux kernel driver, to remap access to the NOR flash memory containing the actual “application” or bitstream the FPGA boots from.
  • This allows rendering the drone inoperable and/or trojanizing the FPGA software.
    • We have previously heard claims that the UHF modem can independently operate from the FPGA, but this is at best a half-truth or the result of poor reverse engineering of the platform.
      • While certain functions of the UHF C2 and telemetry module (KTR) can work semi-autonomously, KTR has its access arbitrated and multiplexed by the ktrmultiplex tool, which every other component relies on.
      • A bricked NOR will prevent ktrmultiplex from starting (including the rest of the processes that rely on it), as well as the entire networking layer (also very poorly understood by at least one group involved with Orlan research).
      • In other words, the FPGA is the broker and gatekeeper to much more than just a video downlink, and it is permanently operating, permanently required to be in a functional state.
      • Any counterclaims to this reality should be substantiated with hard evidence, otherwise they can be considered little more than personally motivated attempts to discredit our work.
  • Remote (over the network) vectors exist to abuse the vulnerability, allowing a full remote exploit chain to exist when paired with a traffic injection attack.
  • The vulnerability presents an enormous challenge for mitigation, and disclosure hardly presents a danger:
    • This is not a classic client-side or server-side component vulnerability in an easily patched computer architecture, that a vendor can fix within hours or days, barring gross incompetence.
    • The Gumstix SBC must be flashed manually with a completely updated set of user-land components. This cannot be done “over the air” or with the GCU as-is.
    • The FPGA driver would need to have a significant amount of code rewritten, and the user-land components would need to be updated to completely alter the way they interact with the driver.
    • In case the FPGA is abused, the only way to fix it is by servicing the board with a JTAG.
    • Redesigning the architecture to leverage encrypted bitstreams, authenticated updates, etc, is not a trivial exercise by any stretch of the word “trivial”. It would require significant research and development efforts to do it right, and then successfully deploy the changes.
    • All these steps must be organized and executed in the context of an armed conflict, disrupting the use of the drones, recalling or transporting them to a location prepared to perform the steps with qualified personnel at hand. This, on its own, is a significant problem of logistics.

Take-aways

  • The technical report is the first of its kind, with no technical resources of reverse engineering or in-depth analysis of the Orlan-10. Every news piece to date merely focused on unverified claims or marketing attempts for products sold by CUAS vendors.
  • This is the first publicly documented military drone vulnerability published or disclosed openly.
  • The code to the FPGA NOR remapping exploit has been publicly released at https://github.com/subreption/birdwatch-report-1-repo/tree/master/src
  • The report and tools developed are the result of the BIRDWATCH program, a months-long initiative to collaborate with groups interested in independent, unbiased investigation of (mostly military) drone security.

The BIRDWATCH program

Subreption recently opened up the BIRDWATCH program to be more accessible and transparent, focusing on a non-commercial approach. Our intentions with the program are fairly straightforward: to provide reverse engineering and accurate analysis of drone platforms used for defensive and offensive purposes. We have successfully collaborated with multiple groups internationally, including groups based out of Ukraine.

The nature and motivations of the program are not political. We strive to remain impartial, focused on the technical details and unbiased analysis. We will consider cooperation with any organizations and individuals, with no discrimination, so as long as it is permitted by law, including any applicable restrictions due to sanctions.

How to participate

At the moment, there are two distinct venues for collaboration, for commercial and non-commercial engagements.

  • If you are a non-government not-for-profit organization or institution, not presently taking bribes or commissions in any shape or form from commercial vendors, we can offer pro bono services including research and forensics data analysis.
    • This service requires transparency and accountability, as we will independently take the appropriate measures to identify and validate partners and their affiliations.
    • We do not offer pro bono services to individuals, business entities or governments, with no exceptions.
    • Any form of profit (direct or indirect) is an instant dis-qualifier from our “pro bono” work. This includes, but is not limited to, employment or income sources directly related or benefiting from activities related to cooperation with the program.
    • Organizations engaging in procurement or contracting of foreign vendors and their products are typically excluded as well.
  • If you are a for profit organization (including but not limited to charities receiving financial aid and at the same time purchasing or engaging in the trade of high value products and services), we can offer competitive pricing on our consulting and research and development services.

While we might occasionally make exceptions, we do not engage with pseudonymous individuals or organizations without adequate accountability. We are also not interested in the illegal or illegitimate trade of hardware or captured systems. In order to protect both the work and the interests of all parties involved, Subreption will require both a Mutual Non-disclosure Agreement and a Non-compete Agreement signed by all the recipients of the information and hardware exchanged.

Sending applications

If you meet the criteria, feel absolutely welcome to contact us at including as much detail as possible in your application. We will consider all applicants carefully on a case-by-case basis.

Conflicts of interest

Subreption is not currently involved in the sale or procurement of counter drone-related products for Ukraine. All research related to military drone platforms until August 2022 has been provided free of charge, as part of the BIRDWATCH program.

Our staff has no assets or financial instruments associated in any way to any consumer or industrial drone (or counter-drone) vendor.

Subreption is providing pro bono consulting and research to multiple institutions in Europe and Asia, as well as volunteer organizations, in the context of information security (defensive and offensive).

References

Updates

Any updates and amendments to this press release will be listed in this section.

  • Clarifications about the importance of the FPGA and unsubstantiated claims to the contrary have been added.
  • The actual, non-speculative impact of disclosure has been clarified, per requests from a member of the press, as a prophylactic measure to avoid any sort of confusion or manipulation of the facts (such as implying that disclosure of the vulnerability might be harmful in the short-term for counter-drone efforts). The difficulty in remediating the vulnerability cannot be overstated, and any claims to the contrary imply a deep lack of awareness and understanding of both the technical and logistics aspects involved, or an intentional attempt to divert attention from the technical facts and merits of report, as well as slandering and misrepresenting our work ethic and motivations.

Contact

Press and media can reach us at regarding this announcement or any other inquiries.

Feel welcome to use PGP if you have sensitive information or special confidentiality needs.

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQGNBGLyeDQBDACk0Q63sgSuwrT0ovQO2hyYFW5fzSZD+8BeXbINNlJawnuv3FHR
IQgeaG37sRWzVtsIrczFfpCz/MVeJ5HqzCLallnzQ4RBpFQifEA7TeQQTkF7iKCy
2knpD3MpQ5RS2u9karo09sKf22yc43EJEuiD8I4LHlkHUHdzinFIr31206xyh7vM
9hIC383lLf5+C8jJm6dnGepgKOiCh+MGAhgs42ahwkEjvYqRveX7OOTRf3JlUGqI
ezTtk7+dDPpBQDC9feW5VctNrK4HJSUFzO/MOWezmr5J2dUZzt0Zr5R6N3neMNpu
wV2QfGx41Jq+NytNVnTj7VdLPApICI7MLWu+r3y+qV2yvyvN0ZYVp7utAEm3a87S
rXaRROTOdJwTQrS0dTgad5a2yGE4Z2r0sPGgmLZQQAzy+xh2T6Wf1MT7LwELLAyq
PYEf/kYsQ6WTDnETJe976lnKcgM2ljTab9Nl2IHyEUg8i5uFEV8hLsHJH5UzH9oZ
6cCSeHGopI8I5JkAEQEAAbQzU3VicmVwdGlvbiBMTEMgKFByZXNzL01lZGlhKSA8
cHJlc3NAc3VicmVwdGlvbi5jb20+iQHUBBMBCgA+FiEEAeK3eZRmSGeYNCqsPyQj
i1sneYgFAmLyeDQCGwMFCQPCZwAFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ
PyQji1sneYjXfQwAj9V7l9cDKjQ8BzURR18I7H/3MqeuBDON+xMONHYiuOQVImaF
L3t89+W2OFCGu3vHQB93lvL3htc/2QdUGmtwrVfUNVn/BGkEWa1vE8JyQfeWbvIi
5CtG1XtEvSCifGyE5tgCG4lNVYp+37By6+UMfMHOgRPtP2YCQebCylujlln08xxA
NC7DMbdpommk0oVc1glcyKnkyBh2r9Nqp8t/RccbA2K7n4GE4VOpcaetyujpH+gK
zhvPk9e4NZDVMS6cIlKGvgooKkUMyS3ilhQVpwn6pSW/QWDhkle4Hkhi+srFzxGt
tSmAUOFfZx9tOxQJcF5FvZm055mkG0hy+htYHr+DH0nMDlR3SWfNdJw81ar6W92X
F1ub8gBJaChUFAAUSq2wQMTEwfCIdEhzBLj1tbW6jqknRkATWCGp9mGwTHR5p8A5
puRQR/aPT8mkvGP2XbPW0vh5vyigHzHFp9F271mDtI75vMA6MRdT+7eGgef0Ag7+
IjulZhJt45eANo6/uQGNBGLyeDQBDAC/SoQLyjSLAlka+i9NqdvKgRPW8sA8qZS+
farFhJ1z6cyGryVDi6pNfoWud2QjcdnZED+WlvwVBC62d6SBCiUt7Oor+/LjMbFf
Y09jkWNAS7HO5kTTP48Cuil6kPzUAaz9DFA8vywqsUD0rY9xhTP0DbGSYqhGOQUh
sgQ/pfqmD/oEeEaEEp+lj2wngXngUEl+MQ36JgYL02Hby+zZtdOrtkqYZ0f+3wHc
am2VfRM+kD83WiX5rNnM5JBDEV80wPSdASNrhzjGfw7U2XZpFbi1i+BdBz0KZjs3
sIxEtXWZBERvaVFUqdPL/rRYCLzG477mjtyf3AIfhfGYxcYJM+flpoMwoWbbfAj9
RuSyFGmDIBmOAlcorFvo4jfzJIS2SvtZqg5bUqE9LBFBTtj69XKnD79uNkNd6Enm
SYqfLBnzhWzCV8LKncDMomhrwIhXtVXFcoqfAFpsp/Tvaey2nZv5yKRmMbs1+k18
xnU+UA0ZWnCy38Fo2592ga7CEWur9I8AEQEAAYkBvAQYAQoAJhYhBAHit3mUZkhn
mDQqrD8kI4tbJ3mIBQJi8ng0AhsMBQkDwmcAAAoJED8kI4tbJ3mItqwL/2suKQuA
jKsC8smjwgM3phxZ1W2Oc/Pz6zGn1XrinO9xsezpUiflL/FZMKKH1E0hcxUboF5R
VfJCFI3Oj6L8hayeSQqPYU5iayq5DPBcO5a4gxi8YmjyuG/NeGJW+u/uhnkvH6JQ
XQ/BvzDqGOgFTv6WDcBfParA5VxUye1565flFiwg/pKYRiBa2SgB9F9Nw0hNJ/8u
Xu2Zk7VB/6Je6A4klZQLnZMolYwNDpfqwdgbKS4M02EYk1M/6p1fiq5jjcrDI7id
jDRC6OZIWWzWaQi2GaTfN0LW0fsoRHFTbV+cVHJRElTyS234ceyigyjlJ7twsf/D
UmREdtboKx2O+026/OLmW+04BovXE6xzzM1yfBWEyfia3fahQuywqoVxqpNXi1ZO
z1iwS/hcjEIe/6rhPgnAgsMMbO/dbZzVsZlJLtUN+LiUEC8WWFjn88FZB3d+kyP/
khZAs7qBm41vruJH4mcmzI2VITT0m+7ree7yFagYPyZ2eywU60X4zMrFzg==
=D+RF
-----END PGP PUBLIC KEY BLOCK-----