Popular Chinese-Made Drone Is Found To Have Security Weakness (nytimes.com) 60
Cybersecurity researchers revealed on Thursday a newfound vulnerability in an app that controls the world's most popular consumer drones, threatening to intensify the growing tensions between China and the United States. From a report: In two reports, the researchers contended that an app on Google's Android operating system that powers drones made by China-based Da Jiang Innovations, or DJI, collects large amounts of personal information that could be exploited by the Beijing government. Hundreds of thousands of customers across the world use the app to pilot their rotor-powered, camera-mounted aircraft. The world's largest maker of commercial drones, DJI has found itself increasingly in the cross hairs of the United States government, as have other successful Chinese companies. The Pentagon has banned the use of its drones, and in January the Interior Department decided to continue grounding its fleet of the company's drones over security fears. DJI said the decision was about politics, not software vulnerabilities.
For months, U.S. government officials have stepped up warnings about the Chinese government's potentially exploiting weaknesses in tech products to force companies there to give up information about American users. Chinese companies must comply with any government request to turn over data, according to American officials. "Every Chinese technology company is required by Chinese law to provide information they obtain, or information stored on their networks, to Chinese authorities if requested to do so," said William R. Evanina, director of the National Counterintelligence and Security Center. "All Americans should be concerned that their images, biometrics, locational and other data stored on Chinese apps must be turned over to China's state security apparatus." The drone vulnerability, said American officials, is the kind of security hole that worries Washington.
For months, U.S. government officials have stepped up warnings about the Chinese government's potentially exploiting weaknesses in tech products to force companies there to give up information about American users. Chinese companies must comply with any government request to turn over data, according to American officials. "Every Chinese technology company is required by Chinese law to provide information they obtain, or information stored on their networks, to Chinese authorities if requested to do so," said William R. Evanina, director of the National Counterintelligence and Security Center. "All Americans should be concerned that their images, biometrics, locational and other data stored on Chinese apps must be turned over to China's state security apparatus." The drone vulnerability, said American officials, is the kind of security hole that worries Washington.
I am SHOCKED... (Score:2, Interesting)
...absolutely shocked, that a Chinese product would send personal info back to Party HQ in Peking!!!
Re: (Score:3, Insightful)
Re: (Score:2)
Correction that is Not how i suppose to work.
Comment removed (Score:5, Informative)
Re: (Score:1)
Re: (Score:3)
The GPs assertion was seriously suggested as a new role for US intelligence agencies after the cold war. A couple of presidents and directors of the CIA opposed it. The idea *seems* to have died....
On the other hand, American intelligence agencies have directly used American companies and their products to assist in foreign (and domestic) intelligence efforts, precisely what they're accusing Chinese companies of maybe doing, indirectly.
https://www.reuters.com/articl... [reuters.com]
Re:This is bad, but is it worse than US access to (Score:5, Informative)
$50 drone? DJI drones start at $399. Their most expensive model is a whopping $5,699. These are not cheap toys.
Re: (Score:3, Informative)
Many local law enforcement agencies in the US use them too.
Re:This is bad, but is it worse than US access to (Score:5, Insightful)
However if you've ever watched tear-downs of Chinese manufactured consumer goods and the utter horror of the people doing it at how much of a fire hazard or other disaster these things are it doesn't take much imagination to believe this is just the same corner cutting and cost saving applied to other areas.
Re: (Score:3)
I've seen teardowns of iPhones, they didn't seem that bad. Huawei phones looked very high end and well made too.
Re: (Score:3)
this is just the same corner cutting and cost saving applied to other areas.
If you want to start a fire without suspicion, the best way is to make it look like an accident.
"Poor design" is forgivable; "arson" isn't.
Re: (Score:2)
Re: (Score:2)
Factually false. Actually the opposite (Score:5, Interesting)
That's factually false.
There is no such requirement in law and I'll eat my shorts if you can cite such a statute - because there isn't one.
In fact, there are multiple laws that intelligence agencies monitoring foreign activities, such as the CIA and NSA, are NOT ALLOWED to share their information even with other agencies of government. That's where the whole "parallel construction" thing comes into play - because the CIA isn't allowed to tell the FBI what they know, to separate our spying agencies from law enforcement. So that we don't end up with the KGB.
That separation was weakened, but not eliminated after 9/11 when it was noticed that the intelligence agencies had some bits of information, law enforcement had other information, and they weren't allowed to talk to each other to figure out what was going on.
There is a cost to not allowing the intelligence community to talk to law enforcement; there is also a cost to allowing it. You can end up with the KGB.
So no, the intelligence agencies are very much not required to reveal information to private parties. They aren't even allowed to reveal much to domestic government agencies.
Re: (Score:2)
Which country's law are you talking about? I think TFA is about Chinese laws:
https://en.wikipedia.org/wiki/... [wikipedia.org]
Here's more details.
https://www.lawfareblog.com/be... [lawfareblog.com]
Re: (Score:2)
> Which country's law are you talking about
I'm talking about the post I replied to, which claimed "US intelligence agencies are required ..."
In fact they are required to do exactly the opposite - to keep their damn mouth shut.
Re:This is bad, but is it worse than US access to (Score:4, Interesting)
"Every Chinese technology company is required by Chinese law to provide information they obtain, or information stored on their networks, to Chinese authorities if requested to do so"
And every US technology company is required by US law to provide information they obtain, or information stored on their networks, to US authorities if requested to do so. Often by secret warrants issued by secret courts.
America's moral high ground is pretty shaky.
Re: (Score:3)
Your claim is false.
In fact, if the intelligence source of the data can be inferred just by looking at the data, it is generally illegal to disclose the data.
Even if it could be done legally, disclosure is unlikely unless it would serve a legitimate national security interest.
Re: (Score:1)
Can Confirm (Score:2)
The DJI software is very phone homie and is getting worse with every iteration.
Why does the battery firmware need to talk to DJI servers?
Re:Can Confirm (Score:4, Interesting)
Why does the battery firmware need to talk to DJI servers?
I am no conspiracy nut, but it would seem to me that a foreign entity being able to cause battery fires because the firmware could be easily updated or triggered to do so when a toy phones home could be a national security problem.
Wasn't there just a story about poor firmware in fast chargers allowing it to destroy and possibly cause fire to connected devices?
Re:Can Confirm (Score:5, Insightful)
Yeah that's to keep the drone legal in your country. They download things like databases of no-fly zones and firmware updates enforcing them, because people can't be trusted not to go buzz an airport.
Re:Can Confirm (Score:4, Informative)
I'll let everyone in on a little secret. The no fly database is a file kept on your device. If you have write access you can edit the file yourself.
Re: (Score:2)
Which is why open-source Android can't have this... iPhone forever!
Re:Can Confirm (Score:5, Insightful)
If you have write access you can edit the file yourself.
I'll let you in on a secret. This is to stop morons not terrorists.
Re: (Score:2)
Re: (Score:2)
Don't make that dumb mistake. If anything actual people attempting to insight terror have shown to go a long way to circumvent basic systems. Encryption, burner devices, very much the kind of people who won't be foiled by a piece of DJI software.
Quite a different breed from some mouth-breather who thinks it would be cool to get an aerial shot at an airport.
Re: (Score:2)
Don't make that dumb mistake. If anything actual people attempting to insight terror have shown to go a long way to circumvent basic systems. Encryption, burner devices, very much the kind of people who won't be foiled by a piece of DJI software.
Quite a different breed from some mouth-breather who thinks it would be cool to get an aerial shot at an airport.
While there is some truth to this, there is also a huge overlap between the "moron" class and the "terrorist" class (which has a lot of overlap with the "criminal" class for that matter). Putting barriers in front of the morons who endanger us because they are morons and didn't think what they were doing was dangerous also makes it a lot harder for the morons who are actively trying to do damaging things.
Re: (Score:1)
I have a DJI drone. It's amazing. I am very sick and tired of made-in-china scare stories which are obviously drummed up by the half-wits in the US who can't keep up. Tell me which company in the US makes a great drone. No. Body.
The US is turning into a losing team that will lie and cheat and steal to win, instead of actually, you know, doing the work and being the best.
Re: (Score:2)
It's certainly true in the drone market, the Chinese are completely dominant.
Re:Can Confirm (Score:5, Informative)
Are the open source options better? (Score:3)
Genuine question to folks with drone experience on here, I have been interested in building a drone since there seems to be a pretty vibrant open source community around it with Pixhawk, Ardupilot, Mavlink etc but how does it math up feature-wise to something like DJI which seems to be abundantly popular due to it being so easy to buy and operate (too easy it could be said). It seems inevitable with every large Chinese manufacturer (and probably US/EU ones perhaps as well) that these concerns of data collection will appear.
Re:Are the open source options better? (Score:5, Informative)
Re: Are the open source options better? (Score:4, Informative)
Re:Are the open source options better? (Score:4, Informative)
DJI is basically the Apple of drones, a walled garden where they get to say what you can do (down to refusing to fly without a firmware update or if it thinks the area is restricted airspace). But if you want to make great videos, that's the way to go. It'll keep you and your drone safe, the video stable, and has a bunch of CV features that will track you as you run around on the ground. Flying it is pretty boring though. You just point it in the direction you want and it flies there.
Ardupilot etc are extremely customizable and will let you do anything you want but it's the DIY approach that will probably have you spending more time tweaking PID values on the controller than flying it. These will let you fly in completely manual mode which is quite difficult but also rewarding. Since it looks like you want to actually build a drone, that's the way to go. DJI are all basically ready to fly dones now, I don't think they even have frame kits like they used to years ago.
Re:Are the open source options better? (Score:4, Interesting)
Want to record great video and the thought of tuning the damping factors in a motorized gimbal (and building the gimbal) doesn't turn you on? Get a DJI.
Want to experiment, do acrobatics, fly through trees, crash lots and not cry too much? Buy some parts and build your own.
Always fancied having a try at aircraft design? Get a 3d printer, wood shop or lots of styrofoam and git gud with a hot wire, and really build your own.
A big problem (Score:2)
Don't a lot of devices and software, Chinese and not, do this? Also, the part about the Chinese government being able to access the data upon request .. isn't that the same of all data anywhere? Which country can't force its way onto a company's data? I am not saying it's right or acceptable, I'm saying we should prevent it everyplace rather than trading one tyranny for another.
Re: (Score:3)
Lets hope (Score:3)
Let's hope they are using better firmware in the ones they make with Gatling guns and bombs. [youtube.com] and selling in the Middle East. Sadly the odds that those are also running DJI code with the weapons stuff tacked on is somewhere between 99.99% and 99.999%.
Re: (Score:2)
Eh, the Finnish did it on the cheap [youtu.be]...
Cloud only when a cloud make sense. (Score:2)
I do find it inefficient for a drone to communicate to a Cloud server thousand of mile away to bounce back to a phone that are only hundreds of feet apart.
For a lot of IoT devices, it seems the cloud isn't for what it is good for, (the ability to perform large calculations and be be better balanced) but as a cheap workaround for the fact that TCP/IP was never designed to be a Remote Control input. Thus needing to connect to a shared public server to have both parts considered a client.
Re: (Score:3)
DJI doesn't use the cloud for remote, you have a normal RC controller for that. It does phone home though for firmware updates, restricted airspace database, etc.
misleading article title in NYT? (Score:2, Offtopic)
If you RTFA, you'll see the article title is misleading and alarmist.
Re: (Score:3)
HE READ THE ARTICLE! GET HIM!
So so wrong (Score:2)
Am I supposed to take special notice about the completely unnewsworthy notice that complex computer systems have errors? Slashdot news!!! Software is not perfect! Gasp.
Or am I instead supposed to care that this could be as easily exploited by China (China!!!! scary!!!) as by my own corrupt surveillance state? The land of the free my ass. The US is more corrupt and cares less about privacy or human rights than any modern nation. The US is an abomination, and I'm supposed to worry about China hacking my
Re: (Score:2)
The US is more corrupt and cares less about privacy or human rights than any modern nation.
More than Russia or China? Now look, the USA is a shithole country, but it's still better than either of those two, where they don't even bother to pretend that you still have rights.
Old News (Score:2)
This is the way China can compete: (Score:1)
Re: (Score:1)
Oooh, the irony (Score:2)
That there is a beautiful example of implied verbal irony.
Maybe
So legalize reverse engineering their shit... (Score:2)
So legalize reverse engineering their shit with the offending code removed, and allow an American company to bootstrap homegrown drone software based on "stolen" code.
If it's good for the goose...
Read the article. Not just the headlines. (Score:1)
Everything has weaknesses... (Score:1)