13/11/2018
DJI Drone Vulnerability
Research by: Oded Vanun, Dikla Barda and Roman Zaikin
DJI is the world’s leader in the civilian drone and aerial imaging technology industry.
Besides from consumers, though, it has also taken a large share of the corporate market, with customers coming from the critical infrastructure, manufacturing, agricultural, construction, emergency-management sectors and more. With so many customers worldwide, both consumer and corporate, DJI drones can obtain data and images from a wide range of viewpoints and across a large spectrum of subject matter.
In a recent investigation, Check Point Research discovered a vulnerability that, if exploited, would grant an attacker access to a user’s DJI account without the user being aware of it. This could have provided access to:
Flight logs, photos and videos generated during drone flights, if a DJI user had synced them with DJI’s cloud servers. (Flight logs indicate the exact location of a drone during its entire flight, as well as previews of photos and videos taken during the flight.)
A live camera view and map view during drone flights, if a DJI user were using DJI’s FlightHub flight management software.
Information associated with a DJI user’s account, including user profile information.
The vulnerability was accessed through DJI Forum, an online forum DJI runs for discussions about its products. A user who logged into DJI Forum, then clicked a specially-planted malicious link, could have had his or her login credentials stolen to allow access to other DJI online assets:
DJI’s web platform (account, store, forum)
Cloud server data synced from DJI’s GO or GO 4 pilot apps
DJI’s FlightHub (centralized drone operations management platform)
We notified DJI about this vulnerability in March 2018 and DJI responded responsibly. The vulnerability has since been patched. DJI classified this vulnerability as high risk but low probability, and indicated there is no evidence this vulnerability was ever exploited by anyone other than Check Point researchers.
Diagram: A simplified view of the three potential attack flows.