Security researchers from Synacktiv and GRIMM have uncovered security flaws in an Android app developed by Chinese drone manufacturer Da Jiang Innovations (DJI), which comes with an automatic update mechanism that bypasses the Google Play Store and can be used to install malware , as well as transmit sensitive personal information to DJI servers . Specifically, the researchers found that the DJI Go4 Android app not only requests extensive permissions and collects personal data (IMSI, IMEI, SIM card serial number) , but also uses anti-debug and encryption techniques to prevent security analysis.
Synacktiv said this mechanism closely resembles the command and control servers found in malware. It added that given the broad permissions requested by the DJI Go4 Android app – contacts, microphone, camera, location, storage, network connection switching – DJI or Weibo servers have complete control over a user’s phone.
It is worth noting that the Android app has over a million downloads and installations from the Google Play Store. Furthermore, the security bugs found in it do not apply to the iOS, which does not have the hidden update feature, so it is not affected by the security bugs.
As noted by GRIMM, the research was conducted in response to a security audit requested by an anonymous defense and public safety technology supplier, who sought to investigate the privacy implications of DJI drones within the Android application DJI GO 4.
Examining the app, Synacktiv reported that it spotted a URL (“hxxps://service-adhoc.dji.com/app/upgrade/public/check”), which it uses to download an update and ask the user to grant permission to “Install unknown apps.
The researchers modified this request to trigger a forced update on an arbitrary app, which first prompted the user to allow the installation of untrusted applications and then prevented them from using the app until the update was installed.
This operation is not only a direct violation of Google Play Store guidelines, but also has very serious consequences. In particular, an attacker could compromise the update server to target users with malicious app updates. An even more serious consequence is that the app continues to run in the background even after it is closed and leverages a Weibo SDK (“com.sina.weibo.sdk”) to install an arbitrarily downloaded app.
Additionally, the researchers concluded that the app exploits the MobTech SDK to convert metadata about the phone, such as screen size, brightness, WLAN address, MAC address, BSSID numbers, Bluetooth, IMEI and IMSI numbers, carrier name, SIM serial number, SD card information, OS language and kernel version, and location information.
Highlighting that the findings constitute “typical software concerns”, DJI disputed the research, while stating that it contradicts reports from the U.S. Department of Homeland Security (DHS), Booz Allen Hamilton and others who have not found evidence of unexpected data transmission connections from DJI applications designed for government customers. The company noted that there is no evidence that has ever been exploited, nor that has been used in DJI's flight control systems for government customers.
In future releases, users will also be able to download the official version from Google Play, if available in their country. If users do not consent to do so, the unauthorized version of the app will be disabled for security reasons, the company said. DJI is the world's largest manufacturer of commercial drones and has been subject to scrutiny, along with other Chinese companies, over national security concerns , which led the U.S. Department of the Interior to ground its drones in January.
Also in May, DHS warned companies that their data may be at risk if they use commercial drones manufactured in China, stressing that they contain elements that can compromise their data and expose their confidential information.
The US makes it clear that the US government's concerns about DJI drones have nothing to do with safety. Instead, it is a policy to reduce competition in the market and support domestic production of drone technology.
