DJI Spying Summary Article

[Fred Garvin]

A really good article summarizing DJI Spying and information gathering to date:

DJI, Huawei, Spying and How They Bamboozled the FAA and American Public

DJI is in the press again about security concerns and has continually been allowed free range access over at the FAA when they were continually warned about security vulnerabilities. DJI has made p…

www.suasnews.com

 

[PatR]

If it’s not air gapped, it’s not secure. If it has to be linked to a computer “assistant” that downloads data from the aircraft, it cannot be secure unless the assisting computer cannot ever access the web. An aircraft cannot at any time be connected to the web and ever thought to be secure.

A secure system does not employ the web for active updates. A secure system cannot use web based apps. A secure system performs updates by loading them from disc, be that CD or SD, with no active web connections possible during the process. The update disc is formatted on an air gapped computer or the aircraft after the upload to assure no system data can be uploaded back to the web later.

For those that don’t know, DJI still cannot be used on military installations. Yuneec can’t either as they incorporated the OTA update system, which instantly rendered user data insecure. Every COTS multirotor used on military installations requires a waiver from the military beforehand, and every aircraft requires its own individual acceptance waiver. “Blanket” brand waivers are not being issued.