Hackers can steal your Amazon order – before it even lands

Delivery drones are zooming toward the future — but can hackers take them down mid-flight?

In the city of Phoenix, Arizona, tech giant Amazon is rolling out drone delivery for over 50,000 everyday items as part of the company's nationwide expansion. According to Amazon, the state-of-the-art MK30 drone is 50% quieter to the human ear – though that hasn’t stopped some people from freaking out when one suddenly appears overhead.

With Amazon, Walmart, and Google investing heavily in drone delivery, the future seems increasingly drone-centric. More broadly, drones already play a role in energy, agriculture, construction, and powerline monitoring.

We spoke with experts to get a better understanding of drone security in terms of hacking and whether or not it makes palpable sense to be afraid of them.

Are drones secure?

When asking what the most likely way that a drone could be hacked, James McDanolds, Program Chair at the School of Uncrewed Technology, Sonoran Desert Institute, Arizona, explained technically that it could be possible:

“If the drone is controlled over the internet and it has a static IP address with no transport layer security or encryption, then an attacker could potentially SSH into it (secure shell access.)"

So, it seems unlikely, but not implausible that this could happen. But the unsettling curiosity surrounding drones might not equate to the reality of whether they’re a bigger threat to public safety than they actually are. McDanolds helped put a reality check on that.

“Since drones are built using existing computer technologies – companion computers like Raspberry Pis, Intel NUCs, or Nvidia Jetsons – any cybersecurity advancements in other industries naturally extend to the drone sector as well" he told Cybernews.

It seems that humans simply don’t like flying objects, whether identified or unidentified, and while not operating systems are equal, big tech companies are actually putting stringent measures in place to try and mitigate risk and uncertainty.

As Amazon scales up its drone delivery fleet, it seems current security measures are largely effective. While a hack is possible, it isn’t exactly low-hanging fruit. Still, as in any industry, staying ahead of security threats is a constant challenge.

The case for public concern

Even if drones possess similar operating systems to most other infrastructural architectures, isn’t it still an ethical responsibility of big-tech companies to abate public fears about delivery drones, regardless of whether they’re rational or not?

Martin Lowry, product manager for GlobalSign’s IoT Identity Solutions team, points to a past case study that still holds relevance.

"Public concerns are valid, given that some drones likely rely on outdated encryption standards. There have been documented cases of drone hijacking. The SkyJack project, for example, showed how drones could be taken over through Wi-Fi exploitation. That was over a decade ago, but it demonstrated the risks. While such incidents remain rare, they highlight the need for ongoing security improvements."

SkyJack was a 2013 project by hacker Samy Kamkar that used a drone to hijack other unsecured drones mid-flight via Wi-Fi exploits. It targeted consumer drones, demonstrating vulnerabilities in consumer drone security.

It doesn’t really matter that it was a while ago, as it still stands as the barometer for what could get messy.

Of course, public paranoia about flying drones is a separate issue altogether. For all the talk of convenience – 50,000 drone deliveries daily in the US – it’s easy to imagine more people "going apeshit," much like they do with UFO sightings. Even dogs have been known to bark furiously at electric scooters, let alone buzzing aerial machines.

The global drone expansion

One thing is certain – this is not just a US phenomenon. Amazon recently announced plans to launch delivery drones in the UK, where unpredictable weather could pose additional challenges. How the British public will react remains to be seen.

A podcast episode, Drones: From Public Fear to Industry Necessity, on Spotify highlights a different perspective. Companies like Zipline have made over one million medical deliveries in Rwanda and Ghana, where drones offer a life-saving advantage in areas difficult for humans to reach.

For now, companies like Amazon have more immediate issues to address – software glitches, system shutdowns, and hardware failures – rather than worrying about Uncle Billy Ray reaching for his single-shot 12-gauge.