Drone news: DJI don't harvest user data without consent

[Londroner]

And independent study in America seems to clear DJI of accusations of harvesting user data, media, flight logs, etc., without consent. Read the article here.

[PingSpike]

Oh DJI… you guys…

Kevin Finisterre, a long-time penetration tester with Netragard, told Gizmodo that Kivu’s report “completely glosses over” concerns about DJI’s app, which peaked in the middle of last year.

“The snapshot in time that the paper is based on does not in any way address the realm of possibilities last year,” said Finisterre, who also works as a senior threat engineer for Department 13, which makes counter-drone technologies. “As an example, the old hot patching mechanism would allow a rogue DJI developer, or skilled attacker, to have complete control over a phone running the DJI Go application. The fact that DJI left their production SSL keys on GitHub further enabled this fact. Absolutely zero mention of this fact was made.”

As reported by The Register in August, DJI’s Go app previously contained a framework that allowed DJI to make “substantial changes” to the app without triggering a review by Apple. According to Finisterre, the hot-patch mechanism would’ve allowed DJI to covertly update the app without first seeking user consent, a critical security flaw.

And:

Following publication, a DJI spokesperson told Gizmodo by email that the data breach it suffered last year and the prior hot-patching issues were not mentioned in the report regarding its current security posture because those issues had been previously addressed by the company.

Further, the spokesperson intimated that DJI’s customers are not concerned about security issues that affected the company as recently as five months ago. “The report is based on the most current drones and apps available when Kivu did their work,” he said. “That’s what our customers want to know about."

Sigh…