Headline

CVE-2022-38161: BIRDWATCH program: Ghost in the Orlan: demystifying a military drone platform

The Gumstix Overo SBC on the VSKS board through 2022-08-09, as used on the Orlan-10 and other platforms, allows unrestricted remapping of the NOR flash memory containing the bitstream for the FPGA.

2 years ago

CVE

Open in Source

#vulnerability #linux #js #git #java #pdf #ibm

Background

Subreption’s research and development team, for the past few months, has been dedicating manpower and resources to investigate and analyze military and paramilitary drone platforms operating in Asia and Europe. Our background is primarily vulnerability research and reverse engineering, enabling us to understand these platforms for both offensive and defensive purposes, including but not limited to detection, forensics data acquisition and active countermeasures.

Demystifying the Orlan: a technical report

As part of the announcement, we are releasing our first public report from the program, related to the Orlan (primarily Orlan-10) platforms in use by the armed forces of the Russian Federation. The Orlan-10 has been a center piece in the Russo-Ukrainian war of 2022, with sensational coverage from the press. Very little factual or in-depth information has been published, and most of the journalism involved has been heavily connected to counter-drone (CUAS) commercial vendors making claims without third-party verification.

We are taking the opportunity to release the first documented exploit against a military drone platform (in this case, one targeting the FPGA used in the Orlan-10 communications system), while providing in-depth analysis of the hardware and software internals, detailing the reverse engineering efforts involved. Hopefully, this invites and motivates others (including academia and industry peers) to publish factual, technically verifiable research instead of “marketing in disguise”. While the topic is sensitive, we have carefully assessed the information published, withholding details that might not be ready for public disclosure yet.

For the better and the worse, information related to the Orlan platform has been circulating in a mostly uncontrolled and unsupervised fashion with third-parties for the last few months.

In many cases, this was directly connected with for-profit organizations attempting to develop products for the Ukrainian market, and more often than not, security practices left much to be desired (admittedly, many of the organizations involved with CUAS products are not qualified as software security vendors, and typically radiofrequency engineers and hardware development vendors do not have a spotless security posture, most of them being wildly unaware of the state of the art in offensive security).

Contrary to propaganda, the Orlan platform, contains sophisticated original research and development, especially in its communications system. We are dedicated to providing truthful, unbiased information to our customers and the general public, as part of our principles and values, beyond any commercial, personal or political agenda.

The report can be downloaded here:

https://subreption.com/downloads/reports/demystifying-the-orlan-10_opt.pdf (optimized PDF)
https://github.com/subreption/birdwatch-report-1-repo (including source code and additional files, mirror/fork freely)

What does the exploit do?

The exploit abuses a vulnerability in the FPGA application and Linux kernel driver, to remap access to the NOR flash memory containing the actual “application” or bitstream the FPGA boots from.
This allows rendering the drone inoperable and/or trojanizing the FPGA software.
Remote (over the network) vectors exist to abuse the vulnerability, allowing a full remote exploit chain to exist when paired with a traffic injection attack.

Take-aways

The technical report is the first of its kind, with no technical resources of reverse engineering or in-depth analysis of the Orlan-10. Every news piece to date merely focused on unverified claims or marketing attempts for products sold by CUAS vendors.
This is the first publicly documented military drone vulnerability published or disclosed openly.
The code to the FPGA NOR remapping exploit has been publicly released at https://github.com/subreption/birdwatch-report-1-repo/tree/master/src
The report and tools developed are the result of the BIRDWATCH program, a months-long initiative to collaborate with groups interested in independent, unbiased investigation of (mostly military) drone security.

The BIRDWATCH program

Subreption recently opened up the BIRDWATCH program to be more accessible and transparent, focusing on a non-commercial approach. Our intentions with the program are fairly straightforward: to provide reverse engineering and accurate analysis of drone platforms used for defensive and offensive purposes. We have successfully collaborated with multiple groups internationally, including groups based out of Ukraine.

The nature and motivations of the program are not political. We strive to remain impartial, focused on the technical details and unbiased analysis. We will consider cooperation with any organizations and individuals, with no discrimination, so as long as it is permitted by law, including any applicable restrictions due to sanctions.

How to participate

At the moment, there are two distinct venues for collaboration, for commercial and non-commercial engagements.

If you are a non-government not-for-profit organization or institution, not presently taking bribes or commissions in any shape or form from commercial vendors, we can offer pro bono services including research and forensics data analysis.
- This service requires transparency and accountability, as we will independently take the appropriate measures to identify and validate partners and their affiliations.
- We do not offer pro bono services to individuals, business entities or governments, with no exceptions.
- Any form of profit (direct or indirect) is an instant disqualifier from our “pro bono” work. This includes, but is not limited to, employment or income sources directly related or benefiting from activities related to cooperation with the program.
- Organizations engaging in procurement or contracting of foreign vendors and their products are typically excluded as well.
If you are a for profit organization (including but not limited to charities receiving financial aid and at the same time purchasing or engaging in the trade of high value products and services), we can offer competitive pricing on our consulting and research and development services.

While we might occasionally make exceptions, we do not engage with pseudonymous individuals or organizations without adequate accountability. We are also not interested in the illegal or illegitimate trade of hardware or captured systems. In order to protect both the work and the interests of all parties involved, Subreption will require both a Mutual Non-disclosure Agreement and a Non-compete Agreement signed by all the recipients of the information and hardware exchanged.

Sending applications

If you meet the criteria, feel absolutely welcome to contact us at including as much detail as possible in your application. We will consider all applicants carefully on a case-by-case basis.

Conflicts of interest

Subreption is not currently involved in the sale or procurement of counter drone-related products for Ukraine. All research related to military drone platforms until August 2022 has been provided free of charge, as part of the BIRDWATCH program.

Our staff has no assets or financial instruments associated in any way to any consumer or industrial drone (or counter-drone) vendor.

Subreption is providing pro bono consulting and research to multiple institutions in Europe and Asia, as well as volunteer organizations, in the context of information security (defensive and offensive).

References