Researchers at three universities hacked a 3D printer and sabotaged design files, causing a drone crash by modifying a 3D printed propeller.

University researchers successfully sabotaged a drone by hacking the computer controlling the 3D printer that made its parts. The experiment highlights concerns about the security vulnerabilities of additive manufacturing.

The paper is titled dr0wned – a portmanteau word combining “drone” and “owned” — and was a joint effort from researchers at Ben-Gurion University of the Negev (BGU), the University of South Alabama, and Singapore University of Technology and Design.

According to their research paper, by changing the design of the propeller before fabrication they caused the $1,000 drone to smash into the ground shortly after take off.

How did they commit the cyber-attack? They gained access to the PC that was connected to the 3D printer using a phishing attack.

Next they located the design files for the propeller of the DJI drone they used. They replaced the file with an modified version that, after being printed and installed, failed and caused the drone to crash.

Here’s a video documenting the process (but turn down the volume because of the irritating soundtrack).

3D Printed Propeller is the Fatal Flaw

In the original field trial, the team was able to fly the drone for about two minutes before the propeller failed.

The really sneaky part was how the researchers made a change to the design that wasn’t detectable in a casual visual inspection. After gaining backdoor access, they augmented the attachment surface joints of the 3D printed propeller with gaps. This weakened the attachment and sped up the rate of fatigue it would experience.

And While the attack was performed on a commercially-available consumer drone, the experiment clearly illustrates how a cyber-attack and malicious meddling of blueprints could ruin the production of a device or machine.

The paper specifies that the attack took place on a private computer connected to a personal 3D printer. But it argues that a similar type of attack is possible on an industrial system, even one producing metal parts for critical applications.

Hopefully, manufacturers will recognize the severity of this threat to additive manufacturing. Before adding 3D printing to their production processes, they must have proper safeguards against industrial espionage.