Remote ID Spoofing Attacks and Defenses

As the use of unmanned aerial vehicles (UAVs) increases, so does the importance of ensuring their cybersecurity. As new requirements and regulations for their use are introduced, new cybersecurity challenges emerge. One such recent example in the U.S. is the requirement of small UAVs to broadcast their Remote Identification, a message containing information about the UAV and its operator. This message can be used by authorities to identify suspicious UAVs and by nearby UAVs as cheap sensory information about neighboring UAVs for tasks like collision avoidance. However, this message is only useful if its contents can be trusted. In this paper, we study the potential of Remote ID to be used for cyberattacks by spoofing their Remote ID message. We simulate multiple UAVs flying in an urban area, broadcasting their Remote IDs, and receiving other UAVs' Remote IDs in the OMNeT++ network discrete event simulation that simulates the dynamics of the Remote ID signal. We demonstrate how an adversarial UAV may broadcast a spoofed Remote ID, causing another UAV to perceive it in the wrong location. Additionally, we show that by analyzing the strength of the spoofed signal, it is possible to determine that it is spoofed.