Drone Security Cheat Sheet — and the attack surface is bigger than you’d expect.

Drones aren’t just flying cameras anymore. They’re networked IoT devices with GPS modules, companion computers, Wi-Fi links, and open ports. That means: GPS spoofing, deauth attacks, firmware tampering, and sensor manipulation are all real threats.
The key vulnerable endpoints:
• Communication links — unencrypted MAVLink or Wi-Fi traffic can be intercepted or replayed
• Companion computers — open SSH/FTP ports are low-hanging fruit for attackers
• Sensors — GPS, cameras, and altimeters can all be fed false data (think Stuxnet, but airborne)
• Physical access — if a drone is captured, unencrypted storage = game over
The mitigations read like an IoT security playbook: secure boot chains, firmware signing, encrypted storage (LUKS, gocryptfs), MAVLink 2.0 message signing, WPA3, and 802.11w to block deauth attacks.
One interesting note: researchers are exploring watermarked sensor signals — using entropy analysis to detect if sensor values have been tampered with.

Full cheat sheet: cheatsheetseries.owasp.org/cheatsheets/Drone_Security_Cheat_Sheet