  In the 21st century, the industry of drones, also known as Unmanned Aerial
Vehicles (UAVs), has witnessed a rapid increase with its large number of
airspace users. The tremendous benefits of this technology in civilian
applications such as hostage rescue and parcel delivery will integrate smart
cities in the future. Nowadays, the affordability of commercial drones expands
its usage at a large scale. However, the development of drone technology is
associated with vulnerabilities and threats due to the lack of efficient
security implementations. Moreover, the complexity of UAVs in software and
hardware triggers potential security and privacy issues. Thus, posing
significant challenges for the industry, academia, and governments. In this
paper, we extensively survey the security and privacy issues of UAVs by
providing a systematic classification at four levels: Hardware-level,
Software-level, Communication-level, and Sensor-level. In particular, for each
level, we thoroughly investigate (1) common vulnerabilities affecting UAVs for
potential attacks from malicious actors, (2) existing threats that are
jeopardizing the civilian application of UAVs, (3) active and passive attacks
performed by the adversaries to compromise the security and privacy of UAVs,
(4) possible countermeasures and mitigation techniques to protect UAVs from
such malicious activities. In addition, we summarize the takeaways that
highlight lessons learned about UAVs' security and privacy issues. Finally, we
conclude our survey by presenting the critical pitfalls and suggesting
promising future research directions for security and privacy of UAVs.
