DJI spying on the US?
2017-11-30 23:07:37.285834+00 by Dan Lyke 0 comments
Leaked government memo claims DJI is spying on the US for China. DJI is the maker of the popular quadcopter drone the Phantom:
The claims aren't a certainty, according to ICE, which says in the memo that Special Agent in Charge Intelligence Program (SIP) Los Angeles has "moderate confidence" that DJI is providing law enforcement and critical infrastructure data to China. However, the memo claims that SIP LA has "high confidence" that DJI is "selectively targeting government and privately owned entities within these sectors to expand its ability to collect and exploit sensitive U.S. data."
SIP Los Angeles makes some alarming claims about the DJI GO and SkyPixel mobile apps, saying in part that they grab facial recognition data even if the feature is disabled. The collected data, which is said to include sensitive personal info like full names, images and videos, phone numbers, and computer credentials, are automatically uploaded to unspecified "cloud storage systems" in Hong Kong and Taiwan "to which the Chinese government most likely has access."
DJI's statement on the ICE bulletin
Previously: Man gets threats—not bug bounty—after finding DJI customer data in public view:
DJI, the Chinese company that manufactures the popular Phantom brand of consumer quadcopter drones, was informed in September that developers had left the private keys for both the "wildcard" certificate for all the company's Web domains and the keys to cloud storage accounts on Amazon Web Services exposed publicly in code posted to GitHub. Using the data, researcher Kevin Finisterre was able to access flight log data and images uploaded by DJI customers, including photos of government IDs, drivers licenses, and passports. Some of the data included flight logs from accounts associated with government and military domains.
US Army calls for units to discontinue use of DJI equipment
Remember, kids, "the cloud" is just a fancy word for "other people's computers".