{"id":47440,"date":"2020-07-23T13:06:30","date_gmt":"2020-07-23T17:06:30","guid":{"rendered":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/?p=47440"},"modified":"2020-07-23T15:25:45","modified_gmt":"2020-07-23T19:25:45","slug":"dji-drones-china-android-application","status":"publish","type":"post","link":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/","title":{"rendered":"App for Chinese DJI drones could give hackers full control of users’ phones, researchers say"},"content":{"rendered":"

The Android application used to operate drones manufactured by DJI contains a number of features that could allow attackers to target users with malicious applications or gain full control of users\u2019 phones, according to recent research by France-based Synacktiv and U.S.-based GRIMM.<\/p>\n

Researchers found that the DJI GO 4 application can force updates on users without routing them through the Google Play Store. Given the access the application has \u2014 including users\u2019 contacts, microphone, camera, geolocation \u2014 it could give DJI<\/a> or third parties nearly full control of users\u2019 phones, Synacktiv<\/a> and GRIMM<\/a> found. It\u2019s also the kind of update that could place the company in violation of the store\u2019s guidelines.<\/p>\n

The application also may install arbitrary applications through the Weibo software development kit, bypassing Google once again, according to GRIMM researchers. In so doing, the application shares users\u2019 personal information with Weibo and could allow attackers to target individuals with malicious application installations, according to GRIMM.<\/p>\n

The DJI application simultaneously collects personal information, such as IMSI, IMEI, and the serial number of the SIM card in a phone \u2014\u00a0none of which are necessary for the operation of the drones, which could raise concerns this information is gathered for other purposes, the researchers found.\u00a0The application also continues to run in the background and make network requests even when users close the application, according to Synacktiv.<\/p>\n

GRIMM CEO Brian DeMuth told CyberScoop these features could give anyone who has the potential to gain access to DJI servers \u2014\u00a0including the Chinese government \u2014\u00a0the ability to target users.<\/p>\n

“Purely from a technical point of view, if you get access to the DJI servers, or you\u2019re someone who has the legal authority over DJI to force themselves to have access, you can target users, not just for mass exploitation but also targeted exploitation,\u201d DeMuth told CyberScoop. \u201cThe concern here is that you can push an update to the device. That update could include\u2026an exploit that takes over the phone. From there, you have access to everything.”<\/p>\n

The iOS version of the application does not appear to have the same features, according to Synacktiv.<\/p>\n

It’s not the first time\u00a0DJI has faced challenges over cybersecurity concerns. The U.S.\u00a0Army<\/a>\u00a0banned DJI drones three years ago following warnings from the Navy<\/a> that their drone systems were \u201chighly vulnerable.\u201d<\/p>\n

Chinese technology firms have been under a microscope in Washington in recent months, as the U.S. intelligence community warns that Chinese companies<\/a>, including telecommunications firm Huawei<\/a>, must abide by Chinese intelligence laws requiring them to share data on Americans with Beijing. Chinese drone companies have broadly faced heightened scrutiny in U.S. government circles in the last several years. The U.S. Department of Interior<\/a>\u00a0last year grounded approximately 800 Chinese-made drones, which it expanded earlier this year over cybersecurity concerns.<\/p>\n

DJI said in a statement that the features in question are not in the government-version of its software, claiming that the features are intended to block hackers from overriding safety constraints in the application.<\/p>\n

\u201cThis safety feature in the Android version of one of our recreational flight control apps blocks anyone from trying to use a hacked version to override our safety features, such as altitude limits and geofencing,\u201d DJI spokesperson Brendan Schulman said in a statement shared with The New York Times. \u201cIf a hacked version is detected, users are prompted to download the official version from our website.\u201d<\/p>\n

DeMuth countered DJI\u2019s statement, contending that it doesn\u2019t address the core concerns raised in the Synacktiv and GRIMM research.<\/p>\n

\u201cThat [statement] doesn\u2019t hold any weight \u2026 They have a mechanism \u2014\u00a0just like everybody else that has applications on the Google Play Store \u2014\u00a0to update the applications. Period. They have that,\u201d DeMuth told CyberScoop. \u201cMaybe it applies within China where their users can\u2019t get to the play store which is totally possible\u2026most companies who have that requirement, they take those features out of international versions.\u201d<\/p>\n

A DJI spokesperson added that users may soon be able to download the official app from the Google Play Store.<\/p>\n

“In future versions, users will also be able to download the official version from Google Play if it is available in their country,” the spokesperson\u00a0told CyberScoop in a statement. “If users do not consent to doing so, their unauthorized (hacked) version of the app will be disabled for safety reasons.”<\/p>\n","protected":false},"excerpt":{"rendered":"

The Android application used to operate drones from DJI, a Chinese firm, could allow hackers gain full control of users\u2019 phones, researchers say.<\/p>\n","protected":false},"author":211,"featured_media":41538,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":""},"categories":[5979,5],"tags":[320,2036,2037,3969,5491],"people":[],"special-report":[],"authors":[4570],"class_list":["post-47440","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-geopolitics","category-technology","tag-china","tag-dji","tag-drones","tag-grimm","tag-synacktiv","author-shannon-vavra"],"yoast_head":"\nApp for Chinese DJI drones could give hackers full control of users' phones, researchers say | CyberScoop<\/title>\n<meta name=\"description\" content=\"The Android application used to operate drones from DJI, a Chinese firm, could allow hackers gain full control of users\u2019 phones, researchers say.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"App for Chinese DJI drones could give hackers full control of users' phones, researchers say\" \/>\n<meta property=\"og:description\" content=\"The Android application used to operate drones from DJI, a Chinese firm, could allow hackers gain full control of users\u2019 phones, researchers say.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/\" \/>\n<meta property=\"og:site_name\" content=\"CyberScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-23T17:06:30+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-07-23T19:25:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2019\/12\/aerial-view-1866742_1920.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1280\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Shannon Vavra\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@shanvav\" \/>\n<meta name=\"twitter:site\" content=\"@CyberScoopNews\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/dji-drones-china-android-application\\\/\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/dji-drones-china-android-application\\\/\",\"name\":\"App for Chinese DJI drones could give hackers full control of users' phones, researchers say | CyberScoop\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/dji-drones-china-android-application\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/dji-drones-china-android-application\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2019\\\/12\\\/aerial-view-1866742_1920.jpg\",\"datePublished\":\"2020-07-23T17:06:30+00:00\",\"dateModified\":\"2020-07-23T19:25:45+00:00\",\"description\":\"The Android application used to operate drones from DJI, a Chinese firm, could allow hackers gain full control of users\u2019 phones, researchers say.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/dji-drones-china-android-application\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/dji-drones-china-android-application\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/dji-drones-china-android-application\\\/#primaryimage\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2019\\\/12\\\/aerial-view-1866742_1920.jpg\",\"contentUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2019\\\/12\\\/aerial-view-1866742_1920.jpg\",\"width\":1920,\"height\":1280,\"caption\":\"(Pixabay)\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/dji-drones-china-android-application\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"App for Chinese DJI drones could give hackers full control of users’ phones, researchers say\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#website\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\",\"name\":\"CyberScoop\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#organization\",\"name\":\"CyberScoop\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2023\\\/01\\\/CyberScoop-Black.png\",\"contentUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2023\\\/01\\\/CyberScoop-Black.png\",\"width\":1545,\"height\":186,\"caption\":\"CyberScoop\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cyberscoop\\\/\",\"https:\\\/\\\/x.com\\\/CyberScoopNews\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/cyberscoop\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCDG2jjHiZ8r97MCVnsaAkXw\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"App for Chinese DJI drones could give hackers full control of users' phones, researchers say | CyberScoop","description":"The Android application used to operate drones from DJI, a Chinese firm, could allow hackers gain full control of users\u2019 phones, researchers say.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/","og_locale":"en_US","og_type":"article","og_title":"App for Chinese DJI drones could give hackers full control of users' phones, researchers say","og_description":"The Android application used to operate drones from DJI, a Chinese firm, could allow hackers gain full control of users\u2019 phones, researchers say.","og_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/","og_site_name":"CyberScoop","article_publisher":"https:\/\/www.facebook.com\/cyberscoop\/","article_published_time":"2020-07-23T17:06:30+00:00","article_modified_time":"2020-07-23T19:25:45+00:00","og_image":[{"width":1920,"height":1280,"url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2019\/12\/aerial-view-1866742_1920.jpg","type":"image\/jpeg"}],"author":"Shannon Vavra","twitter_card":"summary_large_image","twitter_creator":"@shanvav","twitter_site":"@CyberScoopNews","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/","name":"App for Chinese DJI drones could give hackers full control of users' phones, researchers say | CyberScoop","isPartOf":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#website"},"primaryImageOfPage":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/#primaryimage"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/#primaryimage"},"thumbnailUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2019\/12\/aerial-view-1866742_1920.jpg","datePublished":"2020-07-23T17:06:30+00:00","dateModified":"2020-07-23T19:25:45+00:00","description":"The Android application used to operate drones from DJI, a Chinese firm, could allow hackers gain full control of users\u2019 phones, researchers say.","breadcrumb":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/#primaryimage","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2019\/12\/aerial-view-1866742_1920.jpg","contentUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2019\/12\/aerial-view-1866742_1920.jpg","width":1920,"height":1280,"caption":"(Pixabay)"},{"@type":"BreadcrumbList","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/dji-drones-china-android-application\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/"},{"@type":"ListItem","position":2,"name":"App for Chinese DJI drones could give hackers full control of users’ phones, researchers say"}]},{"@type":"WebSite","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#website","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/","name":"CyberScoop","description":"","publisher":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#organization","name":"CyberScoop","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#\/schema\/logo\/image\/","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2023\/01\/CyberScoop-Black.png","contentUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2023\/01\/CyberScoop-Black.png","width":1545,"height":186,"caption":"CyberScoop"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cyberscoop\/","https:\/\/x.com\/CyberScoopNews","https:\/\/www.linkedin.com\/company\/cyberscoop\/","https:\/\/www.youtube.com\/channel\/UCDG2jjHiZ8r97MCVnsaAkXw"]}]}},"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"CyberScoop","distributor_original_site_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop","push-errors":false,"jetpack_featured_media_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2019\/12\/aerial-view-1866742_1920.jpg","_links":{"self":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/47440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/users\/211"}],"replies":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/comments?post=47440"}],"version-history":[{"count":9,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/47440\/revisions"}],"predecessor-version":[{"id":47468,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/47440\/revisions\/47468"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/media\/41538"}],"wp:attachment":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/media?parent=47440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/categories?post=47440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/tags?post=47440"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/people?post=47440"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/special-report?post=47440"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/authors?post=47440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}