Malware delivery via DJI?

[murmur]

No, I have no direct evidence of malware being distributed by DJI. On the other hand, what's the most obvious conclusion to come to when confronted with Windows USB drivers, supplied by DJI for use with the Phantom simulator, which have gone unsigned for months and demand that certain Windows security measures be disabled in order to gain the functionality of the drivers? That the driver installation contains malware, of course. Since driver signing by Microsoft isn't generally considered to be a giant hurdle for manufacturers to surmount, and given that DJI hasn't commented on any particular difficulties posed by the process, and that the drivers should not be tasked with doing anything particularly strenuous (i.e. they're supposed to enable communications between Windows and software running on the android-based controller, not an unusual thing to do at all.). Why would this still be the situation, after all this time, if there weren't a "good" reason? I for, one really want to know what that reason is.

 

[Just_nick]

Anyone with unsigned drivers is sketchy, no matter how large you are.

 

[Remote Pilots Australia]

You're only paranoid if they're not out to get you. Dis able my anti malware? Yeah good!

 

[Meta4]

Why would this still be the situation, after all this time, if there weren't a "good" reason? I for, one really want to know what that reason is.

If you haven't run into unsigned drivers, you haven't been around windows software much.
I'd say the chance of malware is zero and the reason is simple slackness.

 

[murmur]

I agree, Meta4, the odds are low that installing those DJI drivers infects your PC with malware. But I don't know why you'd say "zero". Slackness could be the reason for not bothering to run the drivers past Microsoft for signing, but that seems dissonant for a company that goes to some lengths to impress us with their commitment to protecting its users' privacy. If nothing else, signing the drivers would guarantee that what you're installing on your PC is exactly what DJI wants you to install (i.e. they haven't been modified by any 3rd parties since DJI published them. Yes, downloading them directly from DJI should mitigate that risk, but nevertheless...).

The fact that there is no publicly known instance of DJI-supplied software being implicated in malware infections (they're upfront about sending the lat/lon of your controller whenever it's connected to the internet) is promising, but getting their Windows drivers signed seems like it would be helpful to their privacy-assurance efforts, at the cost of relatively little effort on their part.

 

[Remote Pilots Australia]

If you haven't run into unsigned drivers, you haven't been around windows software much.

Hi Meta4

I can't speak for murmur but I've been working with I/T, occasionally as a primary career but usually as adjunct to my other primary roles for about 37 years, I think windows 2.0 was the standard at that time although like a lot of us I didn't get on the windows wagon for some years afterwards. Obviously, I've seen countless sets of unsigned drivers since the driver certification scheme was introduced. In fact it wasn't so many years ago that unsigned drivers were the norm and verified drivers were rare.

Over at least the last 5 years that has turned around dramatically. Obviously you still see them but usually from small startups or work alone software engineers on obscure projects. On billion dollar entities is a different matter.

The unsigned driver by itself is not the major issue anyway, it's the requirement to turn off Anti Malware or system monitoring during install (having not installed the simulator I'm taking the OP's word about this as fact). Why should I need to do that? The only reasons that come to mind are that the install modifies the TCP stacks, changes the registry or performs some other restricted function, while I allow this from some software as it's necessary I still want to know why before I do. The other main cause is because the software causes a false positive on many modern anti malware suites, once again not uncommon and many applications do, remote administration software springs straight to mind.

In these cases with reputable vendors it's always well documented on the software vendor's home that this is a case and it can usually be confirmed with your anti malware vendor that this situation exists. Neither of these hold true with DJI from a quick look.

I'd say the chance of malware is zero

With respect, in my opinion at least the chance of malware is *never* zero. We've seen it inserted into legitimate banking applications and government sponsored apps before now. If Facebook and google can be hacked who am I to think myself immune?

the reason is simple slackness

I could accept this from the likes of startup companies or stand alone software engineers as mentioned above but a Billion dollar enterprise that can announce a $150 million dollar loss due to fraud and still march on (apparently) unfazed does not have an I/T department professional enough to oversee having their drivers signed? .......

Look, it is probably paranoid to state "It's a Chinese commercial super entity and the Chinese government and or military probably have a hand in there somewhere" but the sad fact is

It's a Chinese commercial super entity and the Chinese government and or military probably have a hand in there somewhere.

I realise that sounds like something from the "tinfoil hat brigade" but I still do work for regional I.S.P.s and some remote Systems Admin work over and above my R.P.A. work. I keep a couple of hardened work stations on the home network and it's my job at times to keep a roll of tinfoil laying around the workshop.

When Mr Average has and raises a concern I think it's counter productive to dismiss it out of hand. I think being responsible you have to say, "well, it may well be nothing to worry about but don't take it for granted". The unsigned drivers are one thing but if indeed I do need to turn off system security to install it I want a public statement from the vendor as to why and I want it independently verified and I don't care if that software comes from the governments itself ... infact probably MORE so if it comes from the Government lol.

You don't have to agree of course, maybe I'm just old and jaded who knows?

Regards
Ari

 

[Meta4]

Some more discussion on this here: DJI Assistant 2 has Malware possibly

 

[bsartist]

You're only paranoid if they're not out to get you. Dis able my anti malware? Yeah good!

Just because you’re paranoid it doesn’t mean they’re not out to get you.

 

[Bad Andy]

You can get malware from signed drivers and installation packages too.

 

[Phil Tuggle]

Unsigned drivers can indeed carry malware, but "Spyware" (data trackers) is far more likely the case. Either way, not so good.

***EDIT*** However, everything from iPhones to "intelligent systems" home refrigerators collects data these days. The automated data collection web is very saturated and that is just the way it is now. No going back. Malware though, is a whole 'nother cupcake. Apologies for the diversion from that subject.

 

[Harleydude]

Hogwash.