"Popular Chinese-Made Drone Is Found to Have Security Weakness"

[Blume TMS]

First time I heard about this my state's attorney general and the head of the state police were afraid the dji drones that had been donated to them were sending the information they were collecting from the drones back to China.... my first question about the news article was... so, no one is worried about the 'information' the state police are collecting in the first place?

 

[MavicFlyer]

What we really need to be concerned about is the larger picture - the proliferation of seemingly inconsequential information that can be aggregated and analyzed to reveal things that are not immediately apparent when looking at the individual items.

We need to crack down on all the collection of data that is not legitimately needed to conduct a transaction, and for that which is collected, what is done with that data after the transaction is complete. That is going to take a change in attitude on the the part of the public, and that will require education of the public , in general; this NYT article is a good place to start. Your personal information needs to be considered as more than just a "business record", which it is.

In the military it's called operational security (OPSEC), which, generally, is control of distribution of information pieces which individually are not classified, but when connected with other information, reveal something that -IS- classified. Need to know must be established in any case of data sharing.

 

[GB1Yorkshire1]

You didn't read the article, did you?
There was no mention of the ridiculous idea that your drone is spying and China wants to see your photos.

Yes I did, however i didn’t say “spying” simply that if the drone is sending data back it doesn’t take a genius to figure out what could be done with a very extensive data base. China is not exactly an innocent bystander, look at Hong Kong, the new islands in the South China Sea, technology theft etc.
Do I trust the Chinese leadership..........probably not, do I trust the “media” only to a limited extent.

 

[Paul Uttermohlen]

But it is from the NYT, so the story is questionable.

Really? Really? It is from the New York Times so the story is much less questionable. As a former journalist I must point out that we highly value the integrity of our work and our publications. There is NO secret society that sits around and decides how to write fake stories to favor some political viewpoint. The credibility of any publication is of the utmost importance. Journalist who write fake stories (and I can only think of 3 times since 1980) get fired! America's newspapers are of the greatest importance to our free society.

 

[Dale D]

"n two reports, the researchers contended that an app on Google’s Android operating system that powers drones made by China-based Da Jiang Innovations, or DJI, collects large amounts of personal information that could be exploited by the Beijing government. Hundreds of thousands of customers across the world use the app to pilot their rotor-powered, camera-mounted aircraft."
"
The security research firms that documented it, Synacktiv, based in France, and GRIMM, located outside Washington, found that the app not only collected information from phones but that DJI can also update it without Google reviewing the changes before they are passed on to consumers. That could violate Google’s Android developer terms of service.

The changes are also difficult for users to review, the researchers said, and even when the app appears to be closed, it awaits instructions from afar, they found.

“The phone has access to everything the drone is doing, but the information we are talking about is phone information,” said Tiphaine Romand-Latapie, a Synacktiv engineer. “We don’t see why DJI would need that data.”"

NY Times Article

Another reason for me to use my iPad which is dedicated to the drone alone.

It would not surprise me at all to find out that the Chinese, whose goal is to be the globally dominated country is stealing any information they can get a hold of. This includes the recent attempt to steal Covid vaccine research information to become the first county to have a vaccine.. That's why we just closed down their Houston Embassy and they retaliated by closing down their Chengdu US Embassy. This is now a growing cold war.

Moral- use a device dedicated to the drone only.

 

[Meta4]

if the drone is sending data back it doesn’t take a genius to figure out what could be done with a very extensive data base.

The article was about your personal data on your device, not about sending back images of sunsets and beaches.
But since you brought it up ... the idea of some evil spymaster going through mountains of amateur drone imagery looking for valuable espionage information is laughable.
For a very long time, Chinese citizens have been able to visit or live in the USA and go wherever they want to,
They can drive or walk around, take all the photos they want of exactly what they might be interested in.
They could even fly their own drones or small planes.
No-one is scanning your drone imagery looking in the background for anything of espionage value.

The idea is even more unlikely when you realise that DJI doesn't get to see your image files and only sees your flight data (which is also of no value) if you choose to upload it.
It's not the smartest of spy plans.

 

[BigAl07]

Ok folks... this is a topic that can EASILY go down into the ditches. Let's stay civil here and do NOT make this a political rant one way or the other. This is the ONLY warning we'll give about this.

Allen

 

[E90RAW]

And we are "acting surprised"??
Still on the "factory burn" of firmare from 3 years ago, never updated/or "hobbled".
Dedicated tablet, Andryroids OS, Go4 app and Go4 app by NLD is the only thing my drone tabby has on it, krap gmail account, and it only "sees" the interwebs when I need to update a google map...
Period...

Ditto on the factory burn. Never updated since I got the drone. No issues.

 

[kingsnake11]

I got a bit singed on another thread (Ban on DJI) after talking about theoretical and hypothetical spying issues by DJI. I guess that I'm not the only one who has these concerns and indeed, I would venture to say that there is likely a high probability that the research by the firms mentioned in the above article have merit. Let's face it, you have to question any app that gathers users info for no apparent reason. So why would an app to fly your drone do that? Raises concerns for sure. No...not paranoia, but as a consumer, I would like to know if an app is gathering info WITHOUT my permission. I would be ok if it asks and let me decide whether to allow it or not....not the other way around.

 

[pross]

Doesnt android prompt you during install to allow the app to see your user info? Same reason farmtown and all the other crappy apps do, they want to know your location, name and email to target you with their spamvertising and here you are on a forum that is loaded with the same spamvertising. 99% of websites have the same tracking if you don't want to be tracked you need to unplug from the internet entirely and go live in a cave.

 

[Ukung]

"n two reports, the researchers contended that an app on Google’s Android operating system that powers drones made by China-based Da Jiang Innovations, or DJI, collects large amounts of personal information that could be exploited by the Beijing government. Hundreds of thousands of customers across the world use the app to pilot their rotor-powered, camera-mounted aircraft."
"
The security research firms that documented it, Synacktiv, based in France, and GRIMM, located outside Washington, found that the app not only collected information from phones but that DJI can also update it without Google reviewing the changes before they are passed on to consumers. That could violate Google’s Android developer terms of service.

The changes are also difficult for users to review, the researchers said, and even when the app appears to be closed, it awaits instructions from afar, they found.

“The phone has access to everything the drone is doing, but the information we are talking about is phone information,” said Tiphaine Romand-Latapie, a Synacktiv engineer. “We don’t see why DJI would need that data.”"

NY Times Article

You don't have to wait for the Chinese to have a look at what is going on, on your smart phone ! If it worries you, as far as drone flying is concerned, use a tablet without sim card or a smart controller !
And by the way, uncle Sam and many others looking at you in many ways anyway !

 

[GB1Yorkshire1]

The article was about your personal data on your device, not about sending back images of sunsets and beaches.
But since you brought it up ... the idea of some evil spymaster going through mountains of amateur drone imagery looking for valuable espionage information is laughable.
For a very long time, Chinese citizens have been able to visit or live in the USA and go wherever they want to,
They can drive or walk around, take all the photos they want of exactly what they might be interested in.
They could even fly their own drones or small planes.
No-one is scanning your drone imagery looking in the background for anything of espionage value.

The idea is even more unlikely when you realise that DJI doesn't get to see your image files and only sees your flight data (which is also of no value) if you choose to upload it.
It's not the smartest of spy plans.

In this time of paranoia it’s not surprising that a story like this makes us all twitch a little. We are surrounded by challenges “When your up to your neck in alligators it’s difficult to remember the task was to drain the lake”.
Lets all sit back, smell the roses and enjoy our drones,

 

[Deleted member 114292]

Security researchers are off the hook right now with totally ridiculous things.
So you can hack my LG microwave and remotely burn my dinner.
And yet you have a cell phone, a facebook account and a smart speaker.
Did you know that for a price anyone can buy your cell phone location records?
While this data is supposedly anonymized, guess what - where you were for the past 5 nights is almost for sure your address, so they know your name.
Privacy is this context is gone forever - too much money to made made from it to stop it now.

All I want to to stop ads from following me - quite annoying.

 

[Hollywud]

Everything you download into your phone, computer etc gathers something. Many phones are made in China, so why would they bother with another app? Just have your phone collect data.

 

[Drone Views Media]

NYT or not, the fact is, that apparently 2 agencies have found security issues!
You may only fly in your “boring “ area but multiply this over all users you end up with a very detailed map and possibly areas of greater interest, bridges, motorways, industry etc. The technology that makes great drones also is capable of “other” technologies!

TBH, this is nothing that China couldn't obtain through its high resolution satellite imagery; I'm not in the slightest bit concerned. This is just more China bashing from the MSM; it seems like it's the season for it

 

[Ol' Sparky]

Use my old Moto e4 for flying. Pared down to the essentials...no contacts, no calendar, no phone, no games, no creditcards, payment or personal info other than what is need to fly. Even has it's own email address for updating logs. If chairman Xi wnats any of what's on my phone...just ask....he can have it all. Maybe he'll blackmail me and turn me into a spy because I flew beyond VLOS a few times. ???????

 

[wco81]

An article about the technical aspects of what the app. could do.

Chinese-made drone app in Google Play spooks security researchers

DJI Go 4, installed more than 1 million times, can execute arbitrary code.

arstechnica.com

 

[Coco 60]

What if we are using iPad that has no connectivity with the out side world ??

 

[Kamau54]

I believe the big issue was that the updates our controllers and drones receive don't go through Google. I'm guessing that since Google can't examine it, an update could contain just about anything.

 

[sar104]

TBH, this is nothing that China couldn't obtain through its high resolution satellite imagery; I'm not in the slightest bit concerned. This is just more China bashing from the MSM; it seems like it's the season for it

Well to play devil's advocate here, I doubt that they are going to be able to get your credit card details and other PI from satellite imagery - at least not unless they have significantly overtaken us in that technology.