Did DJI just hack your drone? - AeroScope contemplations

Drones rely on a solid connection between flying machine and remote control to ensure safe flight. DJI has announced tech to piggyback off that connection to collect information about the drone and the remote.

We applauded this as a great method to increase privacy and reduce wasted law enforcement hours to protect our skies. DJI AeroScope is certainly better than having your drone shot out of the air, but what does it mean for those of us that fly legally?

[related_articles title=”Related Articles”][/related_articles]

First, this is a thought experiment. We have much to learn about the functions and technology behind DJI AeroScope. We just want to air some basic concerns that might be floating around.

We have no reason to not trust DJI. They are a world leader in drones and have proven themselves more interested in helping pilots fly than in helping governments ground aircraft. Makes sense, after all.

DJI recognized that the FAA has restrictive laws on sUAS operation. They aired (erred – sorry, bad pun,) on the side of caution, which we can’t fault, but these rules limit legitimate drone flight. The second issue comes in the form of registration. The FAA enacted a basic registration for drones, which has since been blocked in the courts.

FAA drone registration was simple enough. The FAA issues hobby pilots a unique identifier, which we were to display on our aircraft. You’ve seen tail numbers on passenger aircraft, this is common practice for things that fly in this country.

This tag number provided great privacy for pilots, as the FAA could identify you by tail number, but other pilots could not. The problem became that penalizing illegal flights required enforcement to manually track down the pilot, or get there hands on the craft to get that tiny number marked on it. Several shotgun based solutions are now available to shoot down drones. Not ideal.

The topic shifted to full time flight tracking of all craft. We do this for most manned aircraft, why not our toys. The main problems with this, privacy and cost.

If all craft are always announcing their flight and owner info… you’d basically be handing out cards that say “Don’t like my flying? Come to my house to confront me and my family in person.” That’s a big NO from me, thanks.

DJI AeroScope

DJI has been talking about a method for a while now, simply enough, a digital license plate on drones that is only accessed when absolutely needed.

Great stuff, the tech is live. Law enforcement will run around with a scanner with limited range, they can grab info about drone and owner of only the craft in the area. When a drone breaks the rules, the GPS coordinates of the remote control are provided, law enforcement steps over to say hi. Clean and concise, just like it should be.

Now, DJI has their proprietary RC connectivity, making it easy for them to identify and capture info from the data streams of each drone.

Wait! What? Just like that DJI can capture all of the information being passed between my drone and remote?

I get it, it’s their tech, they know the ins and outs. OcuSync on my Mavic Pro allows connectivity to multiple devices as is, so I know they’re not going to crash my drone by interfering with my connection. Right?

Things go deeper. DJI claims that AeroScope may be able to collect owner and craft data for other drones too.

I want to give you a moment to get over the shock. Don’t go throwing chairs at DJI just yet, come back to finish reading before you do anything rash.

It’s not DJI, drones are just insecure?

I feel like DJI has done nothing more than reveal a flaw in our drones. They are exploiting this ease of hacking for a great security tool, but I am now worried that all drones can be ‘hacked,’ wondering what we can do about that.

I understand that the 2.4 and 5.8 GHz bands in use for RC connectivity are the same bands for most all wireless internet devices as well. Encryption and other protocols ensure safe data transmission of our emails and passwords on the web, do drones not utilize similar handshakes between remote and craft?

Locking down connectivity is key to safe operation around other craft. Somehow this whole process feels more like the RF signals of a TV remote. Any TV will accept input from any remote as long as they are using the same frequency. But I’ve flown side-by-side with other Mavic Pro pilots, and the machines responded to their own remotes accordingly.

We will be digging deeper as we go. Please feel free to send us any info you know of that either proves drones are secure, DJI just has a hacking tool on their hands, or that drones are not secure and we should thank DJI for making this obvious.

What’s next?

Best Drones