Chinese drone maker DJI left users at high risk of spying and hacking under security flaw
By Jack Kilbride and Bang Xiao November 2018 at 11:37am
EXCERPTS:
DJI has had to fix a large vulnerability in their services following a report from security firm Check Point that pointed out that an attacker could easily access a user's account and all their personal data without the user being aware.
"Spying on enterprises — not to mention hundreds of thousands of private individuals — could well have been possible," Check Point said on their website in revealing their report.
Effectively, Check Point researchers found that they were able to exploit a loophole in DJI's user identification process, which uses identification tokens and cookies to allow a user to log in seamlessly across different platforms. Check Point said that a hacker could steal a cookie by tricking a DJI user to click on a malicious link posted in a drone forum, and then replace a user's DJI identification token with their own and gain access to all areas of the user's DJI Mobile App, web account, or DJI FlightHub.
According to Oded Vanunu, head of Check Point's threat prevention team who conducted the research, the hacker would then have access to flight logs, photos, and videos taken by the drone as well as live camera video if the user was flying the drone at the time. The hacker would also have access to all personal and profile information, which could include a user's credit card details, Mr Vanunu said. A similar vulnerability with identification tokens was exploited to hack 50 million Facebook profiles in September.
In a blog outlining their report, Check Point said in the worst case scenario, the information taken from hacking an account could reveal gaps in an organisation or military base security, leaving it vulnerable to criminals and potential terrorists.
"In general, the surveillance capabilities that hacked drones — or their connected customer accounts — can offer provide a rich resource of information for threat actors," Check Point wrote. "And of course, if this data is not directly useful to one threat actor, it is not hard to find another on the Dark Web to whom it is and could be sold."
Check Point initially raised the concern in March through DJI's Bug Bounty Program — which rewards anyone who provides valuable information on security vulnerabilities — and DJI engineers investigated, deeming the issue a high security risk, but a low probability.
"This is because the vulnerability required a complicated set of preconditions to be successfully exploited," DJI said in a statement explaining their actions in patching the vulnerability. "The user would have to be logged into their DJI account while clicking on a specially-planted, malicious link in the DJI Forum."
They added that there is no evidence that the vulnerability was ever exploited, and reasserted DJI's commitment to security and privacy.
