Security issues with Go 4 app. for Android

[wco81]

The Android version of DJI Go 4—an app that lets users control drones—has until recently been covertly collecting sensitive user data and can download and execute code of the developers’ choice, researchers said in two reports that question the security and trustworthiness of a program with more than 1 million Google Play downloads.

The app is used to control and collect near real-time video and flight data from drones made by China-based DJI, the world's biggest maker of commercial drones. The Play Store shows that it has more than 1 million downloads, but because of the way Google discloses numbers, the true number could be as high as 5 million. The app has a rating of three-and-a-half stars out of a possible total of five from more than 52,000 users.

According to the reports, the suspicious behaviors include:

• The ability to download and install any application of the developers’ choice through either a self-update feature or a dedicated installer in a software development kit provided by China-based social media platform Weibo. Both features could download code outside of Play, in violation of Google's terms.
• A recently removed component that collected a wealth of phone data including IMEI, IMSI, carrier name, SIM serial Number, SD card information, OS language, kernel version, screen size and brightness, wireless network name, address and MAC, and Bluetooth addresses. These details and more were sent to MobTech, maker of a software developer kit used until the most recent release of the app.
• Automatic restarts whenever a user swiped the app to close it. The restarts cause the app to run in the background and continue to make network requests.
• Advanced obfuscation techniques that make third-party analysis of the app time-consuming.

Chinese-made drone app in Google Play spooks security researchers

DJI Go 4, installed more than 1 million times, can execute arbitrary code.

arstechnica.com

The security researchers said they didn't find similar issues on the iOS version.

 

[THE CYBORG]

So they are going to get a lot of info off my Smart controller ?

 

[BigAl07]

This topic is already going at:

"Popular Chinese-Made Drone Is Found to Have Security Weakness"

"n two reports, the researchers contended that an app on Google’s Android operating system that powers drones made by China-based Da Jiang Innovations, or DJI, collects large amounts of personal information that could be exploited by the Beijing government. Hundreds of thousands of customers...

mavicpilots.com

Thank you for your contribution but let's try and keep it all in one thread

"Popular Chinese-Made Drone Is Found to Have Security Weakness"

Thread CLOSED