DJI – The ART of obfuscation
blog.quarkslab.com
blog.quarkslab.com
Is it really that hard?
Anyone know why it's not on the Play Store? (On iOS it is on the App Store, well because there isn't another way till this DMA thing kicks in)
Can’t think of any reason that isn’t sketchy. The article gives a clue already.
If the app passes Apple’s review, then it could pass Google’s review.
Did Cydia Impactor stop working or something? Sure you need a developer account, but then you can use the account to sideload any third-party IPA.
The Chinese government, while not openly supporting Russia, has been repeatedly accused of covertly doing so. Imagine what kind of harm a device used for reconnaissance could do if it secretly works for the other side.
https://cybernews.com/resources/how-to-access-google-play-ap...
Otherwise, it might depend whose side you're on?
https://www.businessinsider.com/elon-musk-tesla-spacex-secre...
They likely flash verified firmware and use a verified app version, not the latest one from DJI's website... Maybe they have their own code, by now. Especially with reconnaissance drones. The Ukrainians probably need to do this, not just because of the obvious possibility of a "backdoor", but RF adaptability in the EM warfare situation.
I would worry more about contractor John Doe bringing a compromised private phone to a government or industrial facility. Not sure a highres video feed from a drone could be easily exfiltrated unnoticed, anyway, since they usually don't come with WWAN hardware built-in. But the phone itself would be able do all sorts of reconnaissance and become an attack vector in a sensitive context. Then again, this is not specific to drone (software), but all untrusted software people install.
https://qz.com/1145669/googles-true-origin-partly-lies-in-ci...
Drone business is important to the military industrial complex
This however is akin to malware development, i wouldn't want to install such software
That they don't want to release through the official android app stores for a free app is a bit sus.
Their china-based engineers might not even consider it important to support the play store.
As a non-US citizen, I frequently see how US based engineering teams just don't understand local markets/customs. This is just being on the other side of that.
It's almost as if it were intentional.
But since they control entire device, there's no need for Play Framework, Play Store and whatever is needed for certification just to ship it.
The Play Store versions of some of those apps are likely not the same as the side-loaded version.
The phone doesn't need to broadcast anything to control the drone directly. The phone talks to the remote control unit, which is what broadcasts signals to control the drone. You don't need wifi or mobile internet, or even bluetooth to fly a DJI drone (the phone connects by cable to the remote control unit).
(Actually, that's not 100% true -- if you're in a locked zone that requires permission to fly (such as near airfields or other protected sites), you will need internet access to start your flight and unlock the zone using your DJI account. Otherwise the drone may refuse to fly into restricted zones.)
You don't even need the phone at all -- the remote unit is quite capable of controlling the drone in flight with the phone switched off.
I'm surprised people really think it's anything other than wanting to protect their IP.
Your statement reflects little knowledge on US national defense matters, shows a lack of knowledge about the technology, ignores recent historical knowledge of China's hacking efforts against the US, and provides zero information to back up your claim.
You mean the NSA?
https://en.wikipedia.org/wiki/The_Shadow_Brokers
https://en.wikipedia.org/wiki/Equation_Group
https://en.wikipedia.org/wiki/PRISM
Surely we apply the same level of scrutiny to everyone right? Don't pretend that this is about China being a bad actor in the space. Everyone is a bad actor here, and arguably the NSA is worse.
I'm not trying to say DJI shouldn't be banned for government applications. It definitely has a hardware kill switch back home. But let's not pretend that facebook et al + Google + Apple are any different.
Were we pretending this? Was anyone pretending this? It would likewise be quite wise for China to ban the use of products made by these companies in their own sensitive federal applications, and my understanding is that broadly, they have.
I'm sure TSMC also not bringing their latest node tech to their US fabs also happens to be because they're doing something dirty! oh wait, corporations want to protect their IP, and countries have time and time again proven that they're willing to enter the private business to give their country an edge.
I mean, the central point is straight where everyone's focusing:
> But broadly speaking, U.S. drone makers say they expect to see a sales bump this year even though the new ban on federal purchases is not yet in effect.
Does anyone have more details on this step? The linked issue is devoid of information and was closed because the person refused to release the technique publicly.
On that note, I’ll just remark how RE tutorials avoid talking about anything but the basics, and the advanced writeups handwave away the challenging parts, leaving a major void for learners.
There is already some signal analysis done by those in the field on Youtube but an open source method to pull packets from transmitting drones and redisplay them without transmitting to the drone would be wonderful.
It’s a solved problem, spectating is supported out of the box and frequency bands have been public for a long time.
Here’s a JB video with all you need to know to coexist with analog: [1] Here’s Oscar Liang’s frequency chart (updated for O3): [2]
You can see what happens when you try this by putting DJI FPV Goggles in Audience Mode. It's horrible and not suitable for flying. The DJI link is fundamentally two-way and aggressively uses sounding and HARQ.
The solution to flying with DJI FPV users at your field is to not use Raceband 6 at all (DJI uses this for link negotiation), and otherwise look up the Raceband to DJI correlation chart and allocate separate channels as usual.
Interesting that they go through all that work to protect against modern deobfuscation attacks and reversing - and then use RC4 and MD5. They may be ok in this context, but the choice is sort of odd.
I sent it back.
Later, I found out HOW MUCH data was sent back to DJI. It was basically everything. It was sent to a variety of sites, with stuff like flight profiles, images, all kinds of stuff.
I think open source drones are the answer.
Next thing will be assassinating people with their own phone by causing it to blow up next to their head.
The tool isn't the problem, the problem is that "we" still think killing each other is some sort of solution.
Wishful thinking. Always have, always will. War is even “legal”, think about that, no repercussions for NATO countries.
I don't know if this was an intentional reference or not, but that has definitely already been done (with a rigged phone). Plus the widespread use of phone position data for targeting.
> the problem is that "we" still think killing each other is some sort of solution
The problem is that violence works against everything except more violence.
It’s not like Japan or Germany were going to wave a white flag just because someone finally convinced them they were wrong.
Urban radio environments are crowded, not actively hostile.
The issue with high energy jamming (broad frequency band denial) is it makes your jammer a super tempting (and easy) target for a HARM or equivalent, and consumes quite a bit of power. If someone is actively denying such a wide frequency band, any high school level electronics student can design a pretty effective seeker.
And the whole 'radio power drops off as a cube of the distance' thing means the equipment needs to be pretty close to operations, so it's going to get attacked pretty often.
The noise level in a typical urban environment from wifi is already pretty terrible, 'hostile' or not. Way more terrible than a typical remote environment, which is where these drones are being used, unless there are active countermeasures pretty close.
Counter measures, counter-counter measures, etc. But I'm not seeing much mention of effective jamming happening in-theatre right now.
DJI drones fitted with grenade-dropping mechanisms have been used extensively and still see some use, but DIY FPV drones are now the preferred offensive weapon, used in a kamikaze role as a kind of cheap guided missile. They're cheaper, faster and more agile than the DJI drones. A good FPV pilot can hit the weak spots on a moving tank, or fly through a narrow opening to hit troops sheltering in a bunker. They're invariably used with DJI drones in hunter-killer teams, with a DJI drone acting as a spotter for an FPV pilot.
The sound of a DJI drone is known to everyone on the front line and it means exactly one thing - that you need to find hard cover now. If you can hear it, then chances are that it has spotted you, the pilot has passed on your coordinates and a kamikaze drone or an artillery shell is already flying towards you. If you ignore it or take pot shots at it, then you're gambling with your life.
https://www.youtube.com/watch?v=NjsemcB7I9o (subtitles available)
https://breakingdefense.com/2024/02/european-coalition-bids-...
Exactly 0 of those 1,000,000 consumer drones will be flying in US operating areas.
And the components are easy to buy as most if not all have plenty of other use cases.
If you opt into DJI's Flight Record Sync service, you send them your flight records. If you send DJI the additional logs they request for a warranty claim, you send them basically every imaginable bit of data from your drone. Both of these things make sense intuitively.
Overall, DJI appear to be earnestly attempting to respect data privacy, especially in their newer apps, DJI Fly and DJI Pilot 2. DJI Fly overall attempts to honor the user's flight analytics and flight log transfer preferences. DJI Pilot 2 in Local Data Mode genuinely stops using the network entirely. DJI's newer "Clear All Data" feature genuinely (but insecurely) erases all stored historic flight and user data on a drone and controller. DJI's efforts towards obfuscation seem generally directed at preventing reverse-engineering by their competitors, not hiding CCP malware.
HOWEVER:
DJI are a hardware company and lack competence in the software space, so they frequently make egregious mistakes which expose users to information disclosure or device security issues. This is especially bad in their older apps (DJI Go and DJI Pilot 1). They occasionally ship third-party libraries containing their own analytics and forget to disable these third-party analytics. Their information security practice seems quite bad overall, including a very prominent leak where all of their AWS data was downloaded in 2017, including synced flight logs, warranty logs, and app telemetry data.
DJI's consumer apps (DJI Fly) are loaded with product-manager-requested mobile app telemetry, as are most American phone apps of all kinds, and require app login to activate a drone. This enables powerful cross-correlation against a user's activities in the app. Sufficiently advanced telemetry is indistinguishable from surveillance malware. There is no evidence of a massive conspiracy where DJI are trying to siphon data to the CCP, but a malicious actor with access to their mobile app analytics dashboard could definitely infer a lot more information than a sensitive customer would like to disclose, including locations where the app was used, with what drone model and for how long it was used for, and whether or not special no-fly zone authorization was requested from DJI.
My summary of DJI is:
I would use a modern DJI drone, enterprise or consumer, in a casual home or business application. However, I would only use a DJI drone with DJI Remote Controllers (which are Android tablets), not my own phone. I would activate the drone, then forget the WiFi network I used to activate it. This provides an end-run around the product telemetry features present in the app, and avoids security issues on your local device introduced by DJI's poor programming practice.
DJI Enterprise hardware and software genuinely attempts to provide offline functionality. I would use it with one of the professional standalone RC units, even in a moderately sensitive situation (say, Law Enforcement use), after auditing one specific app version's behavior (to ensure they didn't accidentally introduce a library with telemetry enabled, which they've been known to do).
Also, be aware that all DJI drones broadcast a local proprietary beacon, sometimes referred to as Drone ID or Aeroscope (not to be confused with US Remote ID standards), containing drone serial number and current location data. On newer consumer drones, this broadcast is encrypted. Regardless, it should be assumed that if you are flying a DJI drone, it can and will be tracked by nearby parties. This should be assumed for any drone, realistically. In the usual use case, you are controlling a giant RF emitter using another giant RF emitter.