They did it on a dare: The University of Texas at Austin team successfully nabbed the drone on a dare from the Department of Homeland Security. They managed to do it through spoofing, a technique where a signal from hackers pretends to be the same as one sent to the drones GPS.
As PopSci pointed out, Iran claimed to do the same thing last year, downing one of our drones. Wired Magazine wrote at the time it would be difficult to do, but it was possible:
Its possible to spoof unencrypted civilian GPS systems. But military GPS receivers, such as the one likely installed on the missing drone, use the encrypted P(Y)-code to communicate with satellites. The notion that Iran could have cracked through the encryption sounds like a made-for-TV movie says John Pike, a satellite expert and president of Globalsecurity.org. If they could overcome the sorts of of crypto systems that would protect this drone, they would not waste their time on surveillance drones. They would be breaking into banks.
But Iran might not have had to break the encryption on the P(Y) code in order to bring down a drone. According to Richard Langley, a GPS expert at the University of New Brunswick in Canada, its theoretically possible to take control of a drone by jamming the P(Y) code and forcing a GPS receiver to use the unencrypted, more easily spoofable C/A code to to get its directions from navigational satellites.
GPS satellites transmit on two legacy radio frequencies, Langley explains. The unencrypted C/A code used by most civilian GPS unit is transmitted only on the L1 frequency. The encrypted P code for so-called authorized military users is transmitted on both the L1 and L2 frequency.
Translated: If the Iranians could selectively jam the encrypted military code on the L1 and L2 frequencies and thats a big if the drones GPS receiver might reach out to use the less-secure C/A code in a last ditch attempt to get directions. Without the extra protection of encryption, it would be relatively simple for Iran to spoof the receiver using the C/A code and fool the drone into thinking it was back home in Afghanistan.
Its bad enough these drones are being used over US airspace, but if they cant even maintain control over them, they need to be grounded until they can.