Erasmus exchange students of the Institute of Computer Science of the University of Tartu have demonstrated that it is possible to fully take over the control of commercial drones.
Kramer and Schmeisser first proved that it was possible to spy on the video stream sent out by a drone without getting detected. They also showed that it it possible to hijack the drone in several ways, concluding that the communication of most drones is currently insecure, making drones vulnerable.
Critics have, however, pointed out that the study only involved a very specific model controlled through WiFi and the hijacking scenarios the students used are not applicable to other types of drones.
Interesting what cryptography other drones use to protect communication between the drone and controller.