DJI Threatens Researcher Who Reported Exposed Cert Key, Credentials, and Customer Data (arstechnica.com) 81
An anonymous reader quotes Ars Technica:
DJI, the Chinese company that manufactures the popular Phantom brand of consumer quadcopter drones, was informed in September that developers had left the private keys for both the "wildcard" certificate for all the company's Web domains and the keys to cloud storage accounts on Amazon Web Services exposed publicly in code posted to GitHub. Using the data, researcher Kevin Finisterre was able to access flight log data and images uploaded by DJI customers, including photos of government IDs, drivers licenses, and passports. Some of the data included flight logs from accounts associated with government and military domains.
Finisterre found the security error after beginning to probe DJI's systems under DJI's bug bounty program, which was announced in August. But as Finisterre worked to document the bug with the company, he got increasing pushback -- including a threat of charges under the Computer Fraud and Abuse Act. DJI refused to offer any protection against legal action in the company's "final offer" for the data. So Finisterre dropped out of the program and published his findings publicly yesterday, along with a narrative entitled, "Why I walked away from $30,000 of DJI bounty money."
The company says they're now investigating "unauthorized access of one of DJI's servers containing personal information," adding that "the hacker in question" refused to agree to their terms and shared "confidential communications with DJI employees."
Finisterre found the security error after beginning to probe DJI's systems under DJI's bug bounty program, which was announced in August. But as Finisterre worked to document the bug with the company, he got increasing pushback -- including a threat of charges under the Computer Fraud and Abuse Act. DJI refused to offer any protection against legal action in the company's "final offer" for the data. So Finisterre dropped out of the program and published his findings publicly yesterday, along with a narrative entitled, "Why I walked away from $30,000 of DJI bounty money."
The company says they're now investigating "unauthorized access of one of DJI's servers containing personal information," adding that "the hacker in question" refused to agree to their terms and shared "confidential communications with DJI employees."
The Chinese won't pay, huh? (Score:5, Interesting)
I'm pretty sure someone from another country will pay, don't worry.
Dear companies, in general: Somehow you'll pay for us finding your blunders. Either you pay us, or you pay the damage the one does we sell it to.
Re: (Score:2)
It's possible to be right but still annoying.
Great drones, but invasive... (Score:5, Informative)
After doing some investigation, I understand why the US Military decided not to allow DJI use any more.
DJI makes some really nice drones (I have a Phantom III Pro). No argument there.
However, their app is a security nightmare. Installing it leaves persistent services running on your phone forever, and those persistent services maintain open network connections to servers in China. With it's extensive list of required permissions, you basically give it complete and total control of your phone.
Re: Great drones, but invasive... (Score:1)
The question is, why do people install crappy software?
Re: Great drones, but invasive... (Score:1)
Most would after they have spent a tidy sum purchasing a drone.
Re: Great drones, but invasive... (Score:5, Interesting)
I control my DJI drone with my burner phone, not my primary device. There is nothing on it for them to steal.
Re: Great drones, but invasive... (Score:5, Insightful)
I control my DJI drone with my burner phone, not my primary device. There is nothing on it for them to steal.
Except anything said in conversation around the device, images it points at, photos your drone takes, GIS information based on the drone flying around mapping your neighborhood, etc. If WW3 rolls around you're basically painting your house for a potential invasion site, since they already have detailed maps of your area.
Re: (Score:3)
Re: (Score:1)
Many commercial drones use open source software (Score:4, Informative)
A significant fraction of available quadcopters use PX4 or it's relatives, DroneCode and Ardupilot. You can buy one ready to fly, or you can do as many PX4 users do and select your own motors, frame, radio, and controller to make exactly the quad you want.
Re: (Score:2)
PX4 or it's relatives, DroneCode and Ardupilot.
And most of the rest now seem to run cleanflight or a derivative.
Re: (Score:2)
Yes they do, but it requires an Internet connection. At least with the US military, I'd expect them to hand the folks using the drones a nice little Android tablet. With the Wifi plugged off.
There are lots of DJI users, myself included, who just don't let the Chatty Cathy apps just blather along. Both the iOS and Android apps can be quieted, it just takes a modicum of work. Perhaps beyond Joe Clueless, but I really hope the US 'Cyber Command' could rise to the occasion.
And from what I've seen on the DJI
Re: (Score:2)
Watch the Defcon video about drone hacking. The software has to keep an ever updated database of no fly zones. However once the database is on your phone you can edit it as you please.
Re: (Score:2)
This may be naive - I don't have a DJI drone. Can't you just install it on an older phone you're no longer using as a phone, making it a dedicated remote for the drone. Is anything more than WiFi needed?
in a just world (Score:3)
Re: (Score:3)
They might be, especially if people start to realize that there in a company from France called Parrot making similar drones to DJI but a little cheaper.
in a just and sensible world... (Score:2)
... goods wouldn't be produced for profit, but for satisfying the needs of consumers, in cooperation, not competition. In such a world, we wouldn't even have a story. In the world as it is, no matter how just or how effective in their justice the reactions ever will be, such stories will continue to be the normality they are and have always been since the invention of money.
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Good thing, then, I suppose, that I didn't propose "government-run centralized manufacturing of goods" in any part whatsoever of what I wrote!
Re: (Score:1)
Why is DJI doing this? (Score:3)
Why was DJI unwilling to offer the guy a deal that said "if you agree to destroy all our data (credentials, keys, customer data etc), not use it for any purpose and not talk publicly about it, we will agree not to take you to court over it". Then DJI could have replaced the credentials that got put into the GitHub code (certificate private keys, AWS credentials, whatever else) with things that aren't public, closed any other holes that resulted from what the guy found and moved on with the public at large not finding out what happened.
Re: (Score:2, Interesting)
Ego. And stupidity. And some members of the company not on the same page with other members about how to handle their bug bounty program.
Of course, it could also be that Finisterre's methods exceed the parameters established in the program. He could be the type that thinks the ends justify the means, and that the rules don't apply to him. "Since I found something important you should be grateful and offer me indemnity, even though I broke the law and violated the TOS of your bug bounty program."
I don't
Re: (Score:1)
This is stupid. If there is a problem it's got to be fixed regardless. Your not going to have some Chinese agent or a Russian agent or a US agent or North Korea complying with whatever rules the company has. The company should just be thankful that this guy is reporting it period and get its act together and fix the bugs. Personally I think any computer connected to the internet is fair game. You are literally agreeing to accept *ANY* data sent your way from anywhere in the world. It's dumb f'cs who think t
Re: (Score:2, Informative)
Ego. And stupidity. And some members of the company not on the same page with other members
Yes. This is a big problem with many companies.
even though I broke the law and violated the TOS of your bug bounty program."
Their bug bounty program specifically said they were looking for: "potential threats related to DJI's servers, apps or hardware."
He found EXACTLY what they said they were looking for, and told them about it.
And, as he pointed out to them, in his response to their threat to prosecute him under the Computer Fraud and Abuse Act, "you can't find a security problem without first accessing the system".
Just another crooked company run by scumbags.
Re: (Score:1)
And, as he pointed out to them, in his response to their threat to prosecute him under the Computer Fraud and Abuse Act, "you can't find a security problem without first accessing the system".
Does he have permission to use Github? Yes. Does he have permission to use information from Github to connect to DJI servers and explore them? No.
He may have found a vulnerability doing that, but he broke the law to do so. There are ways to do these things legally, and fuck him if he decided to break the law instead.
Re: (Score:2)
Re: (Score:2)
Re:Why is DJI doing this? (Score:5, Insightful)
Why was DJI unwilling to offer the guy a deal that said "if you agree to destroy all our data (credentials, keys, customer data etc), not use it for any purpose and not talk publicly about it, we will agree not to take you to court over it".
A better agreement would have been:
"if you agree to destroy all our data (credentials, keys, customer data etc), not use it for any purpose and not talk publicly about it for a period of one year ending on Nov 1st, 2018, we will agree to credit you publicly and pay you the bounty."
Threatening someone you already gave permission to, and someone who has been acting in good faith all this time, is really a bad idea. It turns what is supposed to be a collaborative relationship into a confrontational one.
Furthermore, a bug bounty program can't expect to silence a white hacker from a foreign country forever. Hackers are very ego-driven. Also, they make money and recruit new clients from recounting their exploit stories to others.
Re:Why is DJI doing this? (Score:4, Insightful)
THat's what they tried to do! It is lame and slimy.
If you have a bug bounty, people who are finding security bugs are security researchers, if they can't talk about it how do they build their career?!
And when you give somebody permission to check your security for bugs, offering not to take them to court is actually a threat to take them to court, just phrased backwards, because you don't have any right to accuse them of crimes when you agreed for them to check your security.
He left $30k on the table over those lame, slimy, offered terms. Bug bounty is bug bounty! If anything he should sue them for calling him a hacker and claiming he's some kind of black hat!
The offer goes like this: Thanks for finding our bug, here is your money, thanks again, will you sign a document that says this is everything you found so far? There is no threats or demands. Nor is there even power to be making demands. Bug bounty is a service that helps the company!
annnnnnd... (Score:1)
Stock value goes to zero :/
Re: (Score:2)
I could solve your grass cutting woes by spraying acid across your lawn. Would you thank me or threaten me with legal action?
Had he contacted them to reveal the existence of the keys and made a claim under the bounty, he'd have been paid.
Instead he's compromised their security using the vulnerability he identified. That's unethical, illegal and he's going to be fucking lucky if they only threaten him.
Blacklisted (Score:2)
I was just considering a DJI Spark. Not anymore. Another business to add to my blacklist.
I bet you minor talks about this will happen, and in less then a month everyone will have forgotten about it.
Just like OnePlus, just like Lenovo, just like Blackberry.
Re: (Score:2)
"terms" (Score:2)
You don't just get to dictate any terms to anyone you want to and then say it's all their fault if they don't just accept whatever you throw at them. Sounds like the behavior of your stereotypical spoiled brat child.
Attacking responsible disclosure is bad enough, but when you invite people to pen test with a bug bounty, you're already essentially surrendering your right to apply hacking laws to them. If you then are following up outright refusing t
DJI are morons of the first degree. (Score:2, Informative)
the hacker in question" refused to agree to their terms
Are they fucking serious ??
Look, someone found a serious fuck up by DJI and tried to do the right thing and notify them about it. But, oh-no.. it has to be on DJI's terms.
How stupid are DJI here, they're being done a big favor here, they're not in a position to call the shots and piss on the guy trying to help them with their own fuck up.
What does that teach us? If anyone finds a serious problem with DJI again, they'll remember these ungrateful cunts and say "fuck it, I hope a black hat finds it too" , and
Consumer Protection? (Score:2)
It is high time that the US government start a blacklist of foreign companies with terrible security practices and block them from importing into the US. Sure, we can't sue DJI, but we sure as hell can block any new shipments from DJI China until they get their shit together, and then require them to pay US cyber security bounties to a third party responsible for auditing and probing their software for 5 years after they get permission to start importing again. This is basic consumer protection. We don't
Re: (Score:1)
I agree with just about everything you said, except for one word: foreign. If the US government would get off its corrupt, lazy ass and apply serious sanctions to ANY company doing business in the US that used shoddy security, the world would be a better place.
For example, I wonder how many people right on this site have been screwed by Equifax. Does anybody believe that massive leak would have happened if the consequences of that kind of negligence were multi-year prison terms for the entire board of di
Re: (Score:2)
The problem with businesses in general (I can't speak about Equifax because I am not fully up to speed on all the facts there) is that there must be some legal release of liability for best practices. For example, in Engineering, if you can demonstrate that you followed state of the art best practices, you are pretty much assured of avoiding criminal or civil liability, even if your product kills someone.
In the real world, shit happens, and some things are just un-knowable until they happen. I am all for
Who the hell will bug bounty for DJI now? (Score:2)
Re: (Score:2)
Someone's already posted the specific freqs for the entirety of the DJI line - in before everyone just makes a signal jammer and keeps DJIs from ever leaving the ground.
Finisterre had previously reported GPL violations (Score:1)
Finisterre exposed GPL violations of DJI to me and facilitated my getting DJI into compliance, including with my own copyrights. I did not charge DJI or anyone else or ask for DJI proprietary software. But maybe they're annoyed. So, could this be revenge?
Finisterre Reported GPL Violations. Revenge? (Score:5, Informative)
Kevin Finisterre had previously reported and documented GPL violations to me, which I enforced and got DJI to comply by distributing source for several programs and libraries. I did not charge DJI any money or ask for any proprietary software. One wonders if they have gotten annoyed with Kevin, though.