back to article Hackers able to turbo-charge DJI drones way beyond what's legal

Drone hackers in the UK are busy at work exploiting the application security shortcomings of a major manufacturer to circumvent restrictions, including flight elevation limits. DJI says it has pushed out a firmware update to nip the problem in the bud, but one expert The Register spoke to maintains that hacking is still possible …

Page:

  1. Chris Tierney

    DJI can't police this.

    DJI aren't the only route to drone ownership and at least should be commended for having a stab at drone safety restrictions for the uninformed masses.

    If you really want some high altitude footage then invest in some helium, weather balloons and learn how to submit a Notam.

    1. PrivateCitizen

      Re: DJI can't police this.

      DJI aren't the only route to drone ownership and at least should be commended for having a stab at drone safety restrictions for the uninformed masses.

      I dont fully agree. DJI cant police people misbehaving with drones but they can police what happens with their own code and drones. They have obviously felt the need to put some application code in place to limit the drone but haven't felt it was worth doing this properly.

      This is probably the worst option for them to take.

      1. Phil W

        Re: DJI can't police this.

        I'm with Chris on this one, DJI aren't (and shouldn't be) under any obligation to put these restrictions in in the first place, let alone continually patch them when people find ways to hack/mod them. It's more impressive that they bother in the first place, given the vast number of other manufacturers who won't be.

        Responsibility for complying with the law lies with the operator of the drone, both legally and morally, not with the manufacturer.

        Requiring manufacturers to make sure drone operators can't fly beyond visual range, or over certain altitudes is akin to saying car manufacturers have to make sure people can't drive cars with their eyes shut or break any speed limits.

        1. Thought About IT

          Re: DJI can't police this.

          "Requiring manufacturers to make sure drone operators can't fly beyond visual range, or over certain altitudes is akin to saying car manufacturers have to make sure people can't drive cars with their eyes shut or break any speed limits."

          Not quite. The drone operator is at no physical risk, unlike the occupants of any aircraft it may collide with.

          1. Thought About IT

            Re: DJI can't police this.

            "The drone operator is at no physical risk, unlike the occupants of any aircraft it may collide with."

            Got to wonder why I got 4 thumbs down for such a inarguable fact. Perhaps the perpetrators would like to explain?

            1. Phil W

              Re: DJI can't police this.

              I didn't actually downvote you for disagreeing with my argument, however I would point out that it doesn't really work. You can do considerable damage to other people with a car/van with no risk to yourself, as unfortunately recent terrorist attacks have shown.

      2. Anonymous Coward
        Anonymous Coward

        Re: DJI can't police this.

        It gives them plausible deniability while allowing customers to get what they paid for.

    2. Jonathan 27

      Re: DJI can't police this.

      Even if DJI was the only company that made drones, they couldn't stop this. Sure, software hacks are really easy, but if you couldn't do that you could do hardware hacks instead. Say, hack the altimeter to display all values over the limit as their high - the limit. You can't really totally control a product that's out in the user's hands. This is a job for law enforcement.

      1. Anonymous Coward
        WTF?

        Ferraris don't have speed limiters

        I don't really understand why this is the drone manufacturer's problem. e.g. Car dealers sell cars which are easily capable of exceeding the maximum permitted speed on UK roads, and normally even register it for use on these same roads as a standard part of their standard service.

    3. Anonymous Coward
      Facepalm

      News just in...

      Criminals able to:

      break laws.

      sharpen blunt edges.

      decide to take an action or not take an action.

      do something it is impossible for us to stop.

  2. TrumpSlurp the Troll
    Black Helicopters

    Conspiracy or cockup?

    I wonder how many sales are the result of this hack being there?

    1. Peter2 Silver badge

      Re: Conspiracy or cockup?

      I expect the number is going to be quite limited.

      Personally I would imagine that were you caught breaking a no fly zone with a bit of equipment that has deliberately been modified to allow you to break that no fly zone then your going to end up in trouble. A lot of trouble.

    2. werdsmith Silver badge

      Re: Conspiracy or cockup?

      "I wonder how many sales are the result of this hack being there?"

      I do remember when DVD players were new, the ones with the region lock override hacks "leaked" in the public domain were the ones that everyone wanted.

      1. John Brown (no body) Silver badge

        Re: Conspiracy or cockup?

        "I do remember when DVD players were new, the ones with the region lock override hacks "leaked" in the public domain were the ones that everyone wanted."

        For some small value of "everyone". At the time, the market for "grey" importing of out of region DVDs was fairly small and specialised. The average buyer probably had little to no awareness of DVD region locking, let alone the ability to override it on some DVD players.

  3. Anonymous Coward
    Anonymous Coward

    underground groups of drone users

    oh no, we CAN'T allow that!!! Mind boggles at what those pesky (...) might come up with. Sorry I can't use certain words, because we live in a democracy, but if you're familiar with a certain set of (...-...) by an Ian Banks, he did have some ideas for micro... micro... youknowmicrowhats. Combine the youknowmicrowhats with a UK based underground group of drone users and... Theresa, what's that funny thinny doing behind the window...?!

    1. Dave 126 Silver badge

      Re: underground groups of drone users

      It's Iain (M) Banks, some Scotts use a second i in Iain, but at least it's more parsable than some Welsh uses of the letter to this philistine English monoglot. And yeah, drones that look like mosquitos would have an impact on our ideas of privacy. I believe Arthur C Clarke explored a post-privacy world, where the agent of change was millions of wormholes crossing the Earth... Hmm, maybe he spent more time chatting to beat poets in the Chelsea hotel than he claimed.

      1. Jamie Jones Silver badge

        Re: underground groups of drone users

        No ambiguities, it's really rather simple. In Welsh, "i" is pronounced as the English "e", or before someone says that that is stupid, it's pronounced as the "i" in words such as safari, salami, shanti, chilli, scampi, muesli etc.

  4. graeme leggett Silver badge

    unfortunately unsurprising

    In the same way that teens in 1980s fitted non-standard (usually illegally loud as well) exhausts to their restricted 50cc Fizzie mopeds to give more speed, it's all about personal achievement and damn the safety implications for anybody else.

    1. Anonymous Coward
      Anonymous Coward

      Re: unfortunately unsurprising

      Reminds me of walkie talkies when I was a lad. One of my friends had a set that he was going to use to communicate with his girlfriend. Unfortunately his parents didn't approve of her and when they realised that he was doing this bought a set themselves. That way they could hear exactly what was being said and deal with any use after lights out. Being a geek even back then and having read about radios, antennas and frequencies I did some research in the library (remember them?). If you took the back off the things there was a tuning pot (from memory) and you could fine tune the frequency. So I basically tuned them them so that they were still broadcasting on very close to the original frequency but far enough away that his parents couldn't intercept the signal. All you heard was static and what sounded like garbled interference not two lovebirds chatting.

      Then looked at the antenna the range wasn't up to much at all, about 50ft was usable where the voice was still understandable - which was frankly crap. I looked at the antenna and spotted that the length bore little resemblance to the frequency used. I don't know who designed them but it looked like they had just produced the unit and then thrown some spare antenna in regardless of the performance it would give. Maybe they had a job lot unused from another model. So I soldered a bit of extra wire on the end of the antenna to match the frequency and they had a much better range and you could be understood at either end (i.e. her house). They then had a perfect method of communicating clandestinely with each other. Nowadays you'd just use a mobile that could probably be bought for the same money as the walkie talkies cost him. Back then this was for someone just turning 13 a neat solution although probably illegal.

      1. Mr. Flibble

        Re: unfortunately unsurprising

        Nice!

        That reminds /me/ of a time when I was using cheap walkie talkies at a horse jumping day to talk to my dad. After a few minutes a soldier came over to ask if we could stop using them as it was interfering with his trailer-mounted, army issue radio... oops!

        We were slightly concerned that our crappy device could distrupt army comms :(

    2. Anonymous Coward
      Anonymous Coward

      Re: unfortunately unsurprising

      My first successful homebuilt radio control transmitter used to draw around 5W from its batteries, when legal ERPs were 0.5W max and typical hand held units transmitted 100mW or less...and single channel receivers were so broadband only one could fly at a time...

      ..on the flying field a younger lad was yelling 'I can't control it, its out of range' and I looked at the dot fast vanishing downwind

      'switch off, I'll bring it back'..

      ..'what frequency are you on?'

      ..'It doesn't matter'

      And I did..and it didn't.

      Actually drones with GPS dont need to be within radio range to fly. Most are programmable to go miles away and then come back.

      And any competent person can build there own from arduinos, GPS units and model receivers and gyros.

      They are here to stay, and moderately out of (political) control. I suspect the answer is to simply say that any drone is fair game oir a 12 bore or localised EMP or gigahertz jammer.

      1. Anonymous Coward
        Anonymous Coward

        "drones with GPS dont need"

        Because GPS gives you the position, height, sizes of every possible obstacle within your path, right? The real world is a bit more complex than any simulation on a computer.

        1. Danny 14

          Re: "drones with GPS dont need"

          Aha CBs modded with sideband and a burner (plus a decent swr thanks to being able to calculate then measure cables and antennae), my mates were all glad I was handy with a soldering iron and some dodgy rephotocopied instructions. My fiesta 900 was a proper hotbed of eyeballing in the late 80's

          happy days.

          1. Anonymous Coward
            Anonymous Coward

            Re: "drones with GPS dont need"

            Hygain V, zetagi 400w burner and a white K40 antenna.

            Ahhh. I miss the 80's.

  5. Anonymous Coward
    Black Helicopters

    "It's a bit silly to leave debug code in production apps"

    But is it? Is it really?

    In other news, sales of DJI drones exceed expectations. Rivals at a loss to explain popularity.

    1. Andrew Commons

      Re: "It's a bit silly to leave debug code in production apps"

      I think at least one of the Mars rovers was saved because debug code had been left in the production software.

      1. Anonymous Coward
        Anonymous Coward

        Re: "It's a bit silly to leave debug code in production apps"

        "I think at least one of the Mars rovers was saved because debug code had been left in the production software."

        As I understand it, that's not exactly the case. I believe they were actually designed with the expectation that their firmware can be updated remotely. As I understand it, that's in the specification for the forthcoming EXOMars rover, and it's not a "new" requirement.

        1. Pedigree-Pete
          Alien

          Re: "It's a bit silly to leave debug code in production apps"

          I think I remember one Mark Watney being rather glad of that requirement. :) PP

      2. Anonymous Coward
        Anonymous Coward

        "I think at least one of the Mars rovers"

        Even if so, how many have access to a Mars rover? There's a difference between the code you deploy on the devices you no longer control, and what you deploy on devices you fully control, and which outside the reach of the users.

        With this kind of devices - including IoT - if safety checks can be easily bypassed, things may get dangerous.

    2. Destroy All Monsters Silver badge
      Mushroom

      Re: "It's a bit silly to leave debug code in production apps"

      It is absolutely correct to leave debug code in production apps.

      Only idiots permanently thinking of the terrorists or people "stealing muh intellectual prupperty" would disagree.

      (One guy in particular who wrote something about terror attacks via John Deere tractors or some equally abysmally stupid idea, can't remember. It's easier to commandeer a random truck, that's just the satb of a knife away.)

      Meanwhile: AI to Ensure Fewer UFOs: To respond to a plague of drones, airports and other venues deploy AI systems to track and identify intruders

      1. Anonymous Coward
        Anonymous Coward

        Re: "It's a bit silly to leave debug code in production apps"

        Are you speaking of Chris Roberts? I met Chris a year and a half ago and he mentioned something about changing the depth of planting seeds on the John Deer code and how easy it was to change the programming in their firmware for anyone who updates it to get the modified code. Also mentioned something about a train cargo hack his team was working on. ..

    3. Anonymous Coward
      Anonymous Coward

      Re: "It's a bit silly to leave debug code in production apps"

      This is an issue with some languages which doesn't allow to remove code from releases easily because they lack a mechanism to allow for it, like "ifdef" or the like (and, of course, interpreted languages where the source code is deployed). Using "if" statements still lets hacked code to execute debug code.

      Debug code is also different from tracing code. The former may give access to functionalities that may be dangerous when used outside a test environment. The latter will just collect enough information to pinpoint bugs origins quickly.

      1. PM from Hell

        ****** Tracing code

        I remember being called in to the data center years ago because" the upgraded processors on the payroll system were running at 1% of the throughput of the old system".

        While the payroll developer was fighting with my staff over their stupidity and the fact they had obviously mis-configured the system (there was no configuration performed by my team it was installed by the vendor) I wandered over the system console, in the middle of the screen there was a grey flickering box. "Hey Dave I asked, did you turn off your debug mode before setting off the live payroll"?

        Cue a very quiet withdrawal of said Dave from the data center. Luckily he had decided to run the smallest payroll first, unluckily for us it still took 6 hours to run instead of 15 minutes so yet again tech support and ops had to work through the night to catch up ad we did want to get paid ourselves.

  6. Redstone
    WTF?

    Is it really hacking...

    when you supply an IDE that (unsurprisingly) provides you access to the device's API? That used to just be called programming..

    1. Hans 1

      Re: Is it really hacking...

      Well, this is hacking of the purest kind ... reverse engineering and then modifying software so that it behaves the way you like ... they had to fool the code into spitting out debug info, dev passwords etc ...

  7. Andy Non Silver badge
    Mushroom

    Sooner or later

    Some twat will fly his drone in restricted airspace causing a collision with another aircraft, possibly killing one or more people. Then unlicensed drones will be banned outright with heavy fines imposed on violators. Flight rules are there for very good reasons, just like rules of the road. Just because someone could drive on the wrong side of the road doesn't make it a good idea or a "cool" thing to do.

    1. fajensen

      Re: Sooner or later

      Just because someone could drive on the wrong side of the road on a motorway doesn't make it a good idea or a "cool" thing to do.

      Even though drivers can do all of those bad things, we accept that it is not really possible or practical to design cars smart enough to pre-empt evil/stupid drivers.

      Why? Because cars and roads were invented long before IT made mass surveillance possible!

      Today, "It Has Been Decided" that every possible known risk or abuse (and a few imaginary ones, I bet) somehow has to be foreseen and forestalled by "smart" software to thwart all those morons and terr'ists. Which of course doesn't work in practice.

      1. Anonymous Coward
        Anonymous Coward

        "possible or practical to design cars smart enough to pre-empt evil/stupid drivers."

        Actually, it's what car manufacturers are implementing now. The problem was not "mass surveillance", when cars were introduced there was no technology that could make them "smart". We have it only now.

        Just like many devices were once designed just to perform their primary task, without any safety protection. In my childhood, I saw many people without fingers - or worse - getting goods from my grandfather hardware and tools store - most of them blue collars workers using tools and machinery that were quite dangerous. And sometimes existing safety protection were disabled because "they got in the way". Until they lost a finger, an eye, a hand, or an arm...

    2. imanidiot Silver badge

      Re: Sooner or later

      If DJI was actually fast and expedient with adding and/or removing no fly zones and updating airspace structures I would agre with you about those removing DJI restrictions from their devices. However, DJI is known to be slow and sluggish in getting anything changed, leading people to being unable to fly where they SHOULD be able to fly. I can undertand people removing DJI restrictions for that very reason. This DOES mean that the responsibility for safely and legally operating a multicopter should lie with the operator/pilot, not with the company selling it. And it means those flying their craft well above safe altitudes in busy airspace should get a good clobbering before being arrested and thrown into a deep dark hole for a few years for endangering the lives of others.

      I've recently had to explain the same thing to someone flying a DJI Phantom over my home city. "But I'm staying very close to the roof level of the houses, nothing comes over here". 'That doesn't matter. You're under the CTR of the local (international) airport, that goes from ground to 1500 meters, above that is more class A airspace. And the police helicopter HAS been known to fly that low over here due to the local football stadium. I really don't care what you do, but YOU should realise you are risking a very heavy fine at best and a long prison sentence at worst. Decide for yourself it that is worth getting some shaky low level footage of your neighbourhood.'

      (Weirdly enough it seems to have worked because I haven't seen him fly the thing since)

      1. nijam Silver badge
        Happy

        Re: Sooner or later

        > ... leading people to being unable to fly where they SHOULD be able to fly...

        In the interest of fairness, equity, etc., I suggest that the same NFZs apply to all airborne vehicles - airliners, police helicopters, weather balloons, drones.

      2. Anonymous Coward
        Anonymous Coward

        "leading people to being unable to fly where they SHOULD be able to fly"

        Most of the DJI restrictions can be easily lifted by the user - they are just there to ensure you can't fly unintentionally inside a zone that have safety, security or other concerns. You have to unblock them explicitly - so you can't say later "I didn't know I couldn't fly there freely".

        There are of course some zones where flying is highly restricted and that cannot be easily unblocked.

        Otherwise saying "responsibility for safely and legally operating a multicopter should lie with the operator/pilot" means the operator/pilot needs a license, to ensure he/she is aware of all the relevant rules, and any active restriction - a license that could be revoked from people who don't abide to the rules.

    3. Joe Montana

      Re: Sooner or later

      You could build a car that has a built in GPS, works out what road it's on and then automatically limits your top speed to stop you breaking the speed limit... But how many times have you driven down a highway only for the GPS to think you're on a different road nearby, such a system would cause crashes when it forced your car to suddenly brake from highway speeds down to the speed limit of the road it thought it was on.

      MacOS automatically sets your wifi regulatory zone to the country code being broadcast by the first access point it sees... If someone has a misconfigured access point nearby your wireless settings could become suboptimal or even completely broken.

      All of these features designed to restrict what users can do in the name of safety or legality end up causing problems, and they cause these problems for legitimate users. Those who intentionally want to do something illegal will go out of their way to find a way to bypass any restrictions put in place.

  8. This post has been deleted by its author

  9. DropBear
    Black Helicopters

    I cannot fathom why anyone would agree to fly a drone with a controller that you are not the absolute master of. Open source flight controllers definitely do exist, no idea why one would be willing to put up with an endless (and ever-changing) list of restrictions and dependencies. You _cannot_ "restrict away" stupid, if the pilot is flying responsibly you don't need them and if he doesn't, no restriction in the world will help.

  10. Anonymous South African Coward Bronze badge

    The BOFH and the drone, the Bossly Unit and the Bossly Unit's wife, and some blackmail...

  11. Anonymous Coward
    Anonymous Coward

    "underground groups of drone users"

    If they are underground, how can they fly their drones?

    1. Martin Summers Silver badge

      Re: "underground groups of drone users"

      Caverns

    2. Anonymous Coward
      Anonymous Coward

      Re: "underground groups of drone users"

      It's a big cave...

      1. John Brown (no body) Silver badge
        Trollface

        Re: "underground groups of drone users"

        "It's a big cave..."

        There are exits to N, S and E. You hear a faint shuffling sound.

    3. Chris G

      Re: "underground groups of drone users"

      Tunnels! Mate. Tunnels!

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like