US Army calls for ban on DJI equipment over security concerns

[GaryMortimer]

This is going to be a big story, both the US Army and Navy have expressed concerns,

US Army calls for units to discontinue use of DJI equipment. - sUAS News - The Business of Drones

 

[Phill2]

Hopefully they'll auction them off at a good price

 

[GaryMortimer]

Perhaps commercial clients will demand non Chinese equipment is used moving forward.... (difficult to do)

 

[With The Birds]

Fair enough.

 

[deltamike]

I'm surprised at the American overreaction to be honest. However, I'm no expert.

I was working on my own project that I had hoped to profit from, but that's out the window now. Maybe the Russians might be interested.

Camouflage covering for Phantom P3a | DJI Phantom Drone Forum

 

[Phill2]

This is going to be a big story, both the US Army and Navy have expressed concerns,

US Army calls for units to discontinue use of DJI equipment. - sUAS News - The Business of Drones

You can't blame them now that dji is controlling where you can fly.
Who knows what other info they are collecting

 

[macoman]

They are worry about cyber security but what kind of issue a DJI drone have with cyber security? Can someone enlightened me?

 

[N017RW]

They are worry about cyber security but what kind of issue a DJI drone have with cyber security? Can someone enlightened me?

From the WWW:
Cyber security, also referred to as information technology security, focuses on protecting computers, networks, programs, and data from unintended or unauthorized access, change, or destruction.

 

[lickitysplit11111]

They are worry about cyber security but what kind of issue a DJI drone have with cyber security? Can someone enlightened me?

I'm not one of them computer gurus but any device that needs to be occasionally plugged into your computer is a security issue, PERIOD.

 

[macoman]

From the WWW:
Cyber security, also referred to as information technology security, focuses on protecting computers, networks, programs, and data from unintended or unauthorized access, change, or destruction.

Again what kind of issue a DJI drone possess that can affect computers, networks and data from unauthorized access? Because as far as I concerned, my phantom 3 standard does not connect to the internet, only the remote control to download firmware.

 

[Erised]

When we install GO we give it permission to access ALL the information in our phone or tablet and connect to the internet on it's own at any time (and it does), that being said so does many other apps you may have installed.

 

[N017RW]

Again what kind of issue a DJI drone possess that can affect computers, networks and data from unauthorized access? Because as far as I concerned, my phantom 3 standard does not connect to the internet, only the remote control to download firmware.

Try to think outside your 'bubble'.

 

[macoman]

When we install GO we give it permission to access ALL the information in our phone or tablet and connect to the internet on it's own at any time (and it does), that being said so does many other apps you may have installed.

That makes sense... I am sure DJI will try to let everyone know that they don't spy in anyone. DJI offered to contact the army about this issue.

 

[JohnSMith75]

For sure it's a serious question which need time and attention

 

[Erised]

I don't know what all the paranoia of a Chinese made drone spying is all about, almost all the cell phones are made in China, all the people who can and want to know what you are doing is way easier just to tap in to your phone or computer. We are in the information age and privacy is just an illusion. I'm just one in 5 billion and I don't really care anymore because there is nothing I can do about it and I don't plan to go hide in a cave. Keep it on the up and up and you should have nothing to worry about.

 

[N017RW]

Foreign threats are not the result of paranoid thinking. I applaud the DOD for addressing the obvious.

If you feel there is nothing to worry about you may already live in a cave.

 

[Erised]

Foreign threats are real and we need to be vigilant, it's just that I don't think it's the toy drones' we should be worried about. We have to link to the net for the information to transfer, if you have a cell or a computer you (me) are feeding the monster with every minute spent on the net.

 

[anotherlab]

I don't know what all the paranoia of a Chinese made drone spying is all about, almost all the cell phones are made in China, all the people who can and want to know what you are doing is way easier just to tap in to your phone or computer. We are in the information age and privacy is just an illusion. I'm just one in 5 billion and I don't really care anymore because there is nothing I can do about it and I don't plan to go hide in a cave. Keep it on the up and up and you should have nothing to worry about.

The concerns were not about the drones being made in China, but with the known security vulnerabilities with the DJI firmware. It's not terribly difficult to hack into a DJI drone. I would guess that they are also seeking clarification from DJI over what information is being sent back to DJI and for what purposes.

 

[Erised]

Yea the hack is not a good thing and it was bound to happen, if a man can program it somebody may be able to find a back door.

 

[anotherlab]

One of the problems is that at least with the Phantom 3, the AC's firmware is derived from OpenWRT. OpenWRT is an open source firmware that is used as the base code for many consume routers. There's nothing wrong with that, it's stable code base and well known. One of the problems is that DJI embedded an account and password into the firmware and it was just a matter of time before some went through the firmware and found it. The US Army has password standards and a fixed password would be in violation of their standards. I don't know if their password standards are applied to off the shelf hardware, but if it does, that alone could account for the ban.

That's a problem that's addressable by DJI. The same mechanism that DJI uses now to pair a RC to a AC could be used to generate a strong password that would only be known the to AC, RC, and the DJI Go app (and apps licensed to use DJI's libraries). There is no need to store a password in the firmware.

The default SSID password for the Wi-Fi connected DJI drones should also be unique. Just end "12341234" as the out of the box password. The user can change it, but how many of us have actually done so?