Drone operators frustrated by geofencing are hopping the fence and hacking their way to fly way, way up and over what’s legal. And they’re more than able to do so, as drone maker DJI reportedly left development debug code in its Assistant 2 application. From @UAVHive, a group for hobbyists in Yorkshire, England:
It’s looks like #DJI‘s #Spark was jailbroken due to poor app security? Leaving dev code & passwords in the app was probably not a good idea.
— UAVHive (@UAVHive) July 4 2017
DJI probably accounts for the vast majority of drone sales in the United States, so this code glitch makes for a hell of a lot of no-holds-barred unmanned aerial vehicles (UAVs) buzzing over our heads.
Some cynics wonder if rather than being a glitch, it could instead be a brilliant marketing ploy to get around flight restrictions, but per Hanlon’s razor, we won’t attribute to malice that which is adequately explained by incompetence, misunderstanding, or “Oops! Debug code left in production app!”
The manufacturer sent a statement to the Register, claiming to have fixed the problem with a firmware update:
A recent firmware update for Phantom 4 Pro, Phantom 4 Advanced, Phantom 3 Standard, Phantom 3 SE, Mavic Pro, Spark, and Inspire 2, among others, fixes reported issues and ensures DJI’s products continue to provide information and features supporting safe flight. DJI will continue to investigate additional reports of unauthorised firmware modifications and issue software updates to address them without further announcement.
But one expert – Kevin Finisterre, one of multiple drone security experts who’ve been repeatedly warning DJI since at least April – says the update hasn’t stopped him from hacking away:
The bugs that I disclosed that were circulating in the underground have NOT been fixed for what it is worth.
The jailbreak has been proved on other DJI models besides Spark, including the Phantom and Inspire 2. The hack is a drop-dead simple change to settings. One YouTube video that shows operators how to tweak flight height to 2,500 feet is less than two minutes long.
That video, for what it’s worth, also offers this advice:
Don’t be an idiot using these settings.
For real?! To state the blindingly obvious, idiots are why geofencing exists. Drone operators have flown close to UAV-sucking jet engines on passenger planes, police helicopters, and firefighting aircraft. They’ve flown UAVs on to the White House lawn and above playgrounds, concussed at least one person at a parade, and aggravated at least one homeowner to the extent of “Hey, gadget! Have a taste of birdshot!!!” (Yup, and he had a right to do it, said the judge.)
You don’t even have to do the simple altitude restricion hack yourself. Anybody who wants to “fly your drone faster and higher than the legal limit” can call on a Russian hacking company called CopterSafe that offers hacked upgrades for DJI drones.
To be fair, drone operators have legitimate gripes about geofencing.
Take Sky 1, a UAV pilot who said that they had a paid gig near a stadium they couldn’t fly over because their DJI drone labelled it a red, no-fly zone. They were also restricted from flying inside the Class D airspace of an airport, even though, they claimed, they had received permission.
As the Register reports, users authorized to fly in restricted areas can either unlock these zones using DJI’s GEO system or by submitting a request via email. Apparently, as somebody who claimed to be a law enforcement operator said, that’s all way too klunky:
I have said it before, when you purchase a car, it does not come with a daggum BABYSITTER!!!!!!!!!!!! Your trusted to abide by the rules and regulations!!! And as a Law Enforcement Operator, I AM NOT WAITING 5 DAYS to get authorization when I have all other paperwork in line and I need to fly NOW!!!!!!!!
I’ve got a request for comment in to DJI and will update the story if I hear back.
Kurt S
Regarding the claim by Sky 1 the restrictions on use of the drone are there for a reason. Claiming that permission was given and not providing proof is one of those “he said:she said” arguments. As to the other folks who want to fly their devices higher than permitted or in areas that are restricted: find ’em and fine ’em. Just because you have disposable income and want to play with your new toy doesn’t mean that you can flout the laws. I am almost tempted to use the analogy of obeying speed limits while driving, but so few people seem to feel that those laws apply to them….
jkwilborn
This ‘law enforcement’ officer isn’t or shouldn’t be. He is stating to all that he is ‘above the law.’ This is not ‘public safety’ which is priority one.
Lisa Vaas -> nice article. )
Lisa Vaas
Thank you!
Phill White
I think that DJI did a good thing but they took it too far. Warning was enough but to not let the motors startup is just bad .
David Blair
If the man has permission and paperwork in order he should not have to wait 5 days for dji to get off their ass and open his map. The BS red tape to get authorization is already to cumbersome. If dji is going to force geofencing upon customers (which they shouldn’t )then they need to step the fuck up and fucking manage it properly and timely.
Ed
Build something that is idiot proof and only idiots will use it
fry
you can easily build a +90 mph racer with fpv and enough flight time to be a problem for a lot of things within a mile radius.
this doesnt do jack against ppl that dont have dji drones (guess +60% of the market),
punishes ppl living above a certain level (enough places on this planet where you ARE allowed to fly without ANY preconditions, so ppl talking about “law” is a joke, unless “you” know every uav law in every country,m you dont know what is and is not legal.
im close enough to a local airport that im not allowed to fly, yet the flight path is NEVER closer than 2mls,
nor am i interested in going there (as multiple civ/mil transmitters close to it will likely affect radio signal anyway),
but would like to fly around behind the house (farm/forest).
a simple height limit (100-150ft) at 5mls and then limited to 50ft until at 2mls distance would be enough).
maybe we should do the same with cars. far more ppl get hurt/killed then by drones every day.
lets make it that “your” car would only work on certain roads, its top speed fixed to the max legal speed limit,
and max acc limited to 10s from 0-60s, no matter what make/model.
even capital punishment doesnt prevent ppl from doing bad things, but yeah, its important that i cant fly,
the product i bought, with my money, the way i want to (around my place).
Jason
When you buy a car, you are not prevented from speeding. Cars kill many more people than drones. When you buy a gun, you aren’t told you can only shoot rubber bullets or low powered ones. We don’t stop selling alcohol because people drink and drive.
People are responsible to follow laws and except the consequences if they break them and are caught. We should have complete control and access to our drones and what they can do. We paid for them.
I would like to see more control of our recreation planes and their pilots. They should be tracked or at least required to have radios and black boxes. I have been at the scene of two plane crashed this year. The fatal one destroyed three houses, one completely. Luckily and sadly, only the pilot perished. They will never know what happened because the plane was not required to have a black box.
Our government needs to stop with the conspiracy BS and start doing things that actually make us safer. With the drones they are searching for a solution to a problem that doesn’t exist or that they are making up. I bet a small plane will be first to collide with an Amazon drone!