The consumer drone market is booming. Consumer drones are predominantly used for aerial photography; however, their use has been expanding because of their autopilot technology. Unfortunately, terrorists have also begun to use consumer drones for kamikaze bombing and reconnaissance. To protect against such threats, several companies have started “anti-drone” services that primarily focus on disrupting or incapacitating drone operations. However, the approaches employed are inadequate, because they make any drone that has intruded stop and remain over the protected area. We specify this issue by introducing the concept of safe-hijacking , which enables a hijacker to expel the intruding drone from the protected area remotely. As a safe-hijacking strategy, we investigated whether consumer drones in the autopilot mode can be hijacked via adaptive GPS spoofing. Specifically, as consumer drones activate GPS fail-safe and change their flight mode whenever a GPS error occurs, we performed black- and white-box analyses of GPS fail-safe flight mode and the following behavior after GPS signal recovery of existing consumer drones. Based on our analyses results, we developed a taxonomy of consumer drones according to these fail-safe mechanisms and designed safe-hijacking strategies for each drone type. Subsequently, we applied these strategies to four popular drones: DJI Phantom 3 Standard, DJI Phantom 4, Parrot Bebop 2, and 3DR Solo. The results of field experiments and software simulations verified the efficacy of our safe-hijacking strategies against these drones and demonstrated that the strategies can force them to move in any direction with high accuracy.

Drones are widely used for various purposes such as delivery, aerial photography, and surveillance. Considering the increasing drone-related services, tracking the locations of drones can cause security threats such as escaping from drone surveillance, disturbing drone-related services, and capturing drones. For wirelessly monitoring the status of drones, telemetry is used, and this status information contains various data such as latitude and longitude, calibrated sensor outputs, and sensor offsets. Because most of the telemetry implementation supports neither authentication nor encryption, an attacker can obtain the status information of the drones by using an appropriate wireless communication device such as software-defined radio. While the attacker knows the locations of the drones from the status information, this information is not sufficient for tracking drones because the status information does not include any identity information that can bind the identity of the drone with its location. <?tight?>In this article, we propose a fingerprinting method for drones in motion for the binding of the identity of the drone with its location. Our fingerprinting method is based on the sensor outputs included in the status information, i.e., the offsets of micro-electro mechanical systems (MEMS) gyroscope, an essential sensor for maintaining the attitude of drones. We found that the offsets of MEMS gyroscopes are different from each other because of manufacturing mismatches, and the offsets of five drones obtained through their telemetry are distinguishable and constant during their flights. To evaluate the performance of our fingerprinting method on a larger scale, we collected the offsets from 70 stand-alone MEMS gyroscopes to generate fingerprints. Our experimental results show that, when using the offsets of three and two axes calculated from 128 samples of the raw outputs per axis as fingerprints, the F-scores of the proposed method reach 98.78% and 94.47%, respectively. The offsets collected after a month are also fingerprinted with F-scores of 96.58% and 78.45% under the same condition, respectively. The proposed fingerprinting method is effective, robust, and persistent. Additionally, unless the MEMS gyroscope is not replaced, our fingerprinting method can be used for drone tracking even when the target drones are flying.

In the Bitcoin system, participants are rewarded for solving cryptographic puzzles. In order to receive more consistent rewards over time, some participants organize mining pools and split the rewards from the pool in proportion to each participant's contribution. However, several attacks threaten the ability to participate in pools. The block withholding (BWH) attack makes the pool reward system unfair by letting malicious participants receive unearned wages while only pretending to contribute work. When two pools launch BWH attacks against each other, they encounter the miner's dilemma: in a Nash equilibrium, the revenue of both pools is diminished. In another attack called selfish mining, an attacker can unfairly earn extra rewards by deliberately generating forks.

IEEE 802.15.4 is widely used as lower layers for not only wellknown wireless communication standards such as ZigBee, 6LoWPAN, and WirelessHART, but also customized protocols developed by manufacturers, particularly for various Internet of Things (IoT) devices. Customized protocols are not usually publicly disclosed nor standardized. Moreover, unlike textual protocols (e.g., HTTP, SMTP, POP3.), customized protocols for IoT devices provide no clues such as strings or keywords that are useful for analysis. Instead, they use bits or bytes to represent header and body information in order to save power and bandwidth. On the other hand, they often do not employ encryption, fragmentation, or authentication to save cost and effort in implementations. In other words, their security relies only on the confidentiality of the protocol itself.

In the multicarrier transmissions such as orthogonal frequency division multiplexing (OFDM), one of the main problem is the high peak-to-average power ratio (PAPR) of transmission signals due to the superposition of many subcarriers. In this paper, we propose an approach for PAPR reduction using tone reservation (TR). The proposed approach guarantees a certain bound of PAPR reduction gain by using only one reserved subcarrier symbol. The bound depends on the ratio of the first and second peak magnitude. The proposed approach can be applied to not only one reserved subcarrier but also multiple reserved subcarriers. In the latter case, two methods are presented. To get more PAPR reduction gain, the proposed approach can be modified by adjusting the appropriate threshold.

An efficient hardware simulator for the design of a WCDMA interference cancellation repeater (ICR) is presented. The ICR, which is composed of a digital interference canceller and analog parts, is a time-varying system that reacts to a time varying input signal. The design of the digital interference canceller is time-consuming due to the need for many iteration cycles of debugging, tuning, and performance verification. Furthermore, its performance, which is represented by the error vector magnitude (EVM) and the output power spectrum, can be verified only after it is implemented on a digital board, integrated into the repeater hardware with analog parts, and hooked up with expensive test equipment. Hence, a special computerized simulator is needed for fast and efficient verification of the interference canceller's design. The simulator consists of a signal generator, which emulates a base station, the ICR with an interference canceller, a feedback channel that models wireless fading channels, and a receiver that measures the EVM of the ICR. The accuracy of the simulator is verified by showing that the EVM and the output power spectrum of a reference interference canceller measured on this simulator match well within an error range of less than 8% with the corresponding values measured on the repeater hardware. The usefulness of the simulator is also confirmed by simulating the EVM performance of the ICR under various multipath fading channel conditions.