10 ms·
Chinese dev jailed and fined for posting DJI's private keys on GitHub
- devy 8y agoI don't understand why this post has to put "Chinese" in the title?! If the dev was United States citizen, would you rename the title to American dev jailed? Absurdity!
- bdcravens 8y agoThe developer was prosecuted in China. HN guidelines also indicate the title should be unchanged from the original most of the time.
- jldugger 8y ago> If the dev was United States citizen, would you rename the title to American dev jailed The only reason I can think of to not mention the nation that jailed someone for accidentally leaking their employers keys would be because the default assumption would be they are an American. This wasn't a hack, there was no criminal intent. I think most people assume that the worst consequence for an accident like this is losing your job. The absurdity here is being fined, jailed, and receiving a criminal record.
- lkj 8y agoAlso note the hints at the original in the URL: "dji_dev_jailed_fined_leaking_aes_ssl_keys_github" The Register decided that adding the nationality was good for clicks. :(
- mattnewton 8y agoThe fact that the developer was prosecuted under Chinese law is important to an audience of developers who want to know what precedent it sets for their own work.
- devy 8y agoSharing private information public either intentional or unintentional that leak customer data and weaken the software security is illegal in any country as far as I know.
- mattnewton 8y agoHe claims it was a mistake. Checking in private keys is a fairly common mistake and seems analogous here. https://m.slashdot.org/story/181081 https://m.slashdot.org/story/181081
- deleted 8y ago[deleted]
- mattnewton 8y agoI would be really alarmed if this happened in America, as an American developer myself. I obviously wouldn’t think a mistake like this should be criminal.
- lostphilosopher 8y agoHN "post" - Because that's the HN guideline. > "Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize." - https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Register "post" - The Register is not a Chinese publication. The nation/legal system involved can't be assumed from the source, and is a vital part of the story since it's about a legal matter. > "the Shenzhen Municipal People's Procuratorate – the local version of the Crown Prosecution Service – successfully prosecuted the developer in early April, before the Shenzhen District Court." Had The Register _not_ included "Chinese" it could have been accused of "click baiting" since the Register's predominantly non Chinese[1] readership might have thought this was about laws that applied to them and clicked through. Had the source been a Chinese publication writing about a American developer jailed, I'd imagine they would use "American dev jailed..." for exactly the same reasons. 1. "The Register is a leading global online tech publication, with more than nine million monthly unique browsers worldwide. The core audiences are the UK and US, accounting for more than six million. The bulk of the remaining readership are located in Canada, Australia and northern Europe." - https://www.theregister.co.uk/Profile/about_the_register/ https://www.theregister.co.uk/Profile/about_the_register/
- devy 8y ago> HN "post" - Because that's the HN guideline. I understand HN guideline here. I am talking about the Guardian's post. Leaking private information to the public even unintentionally , that compromise the security of software and may cause public harm is illegal no matter which country you go. So the nationality of the one who leaked it is irrelevant as far as I am concerned.
- Canada 8y agoGenerally it isn't illegal under any system based on common law. A necessary component a crime is mens rea, which is the intention or knowledge of the wrongful act. The act alone, even if it is illegal doesn't constitute a crime. By this principle it's not a crime for a delvery man to be in posession of contraband that he has no knowledge of. This isn't to be confused with not knowing something is illegal. That's no defense. It's about knowing or not knowing the consequences of your action. That said there are lesser offences, misdemenors or summary offences, where mens rea is not required. They usually have fines but also can have limited jail time. For example, you can be punished for speeding and whether you knew you were doing it or not is irrelevent. What's unclear in this case is whether the developer knew or ought to have known there were secrets in the code, or that his push was to a public place. It's also unclear, at least to me, whether Chinese law requires mens rea.
- bcaa7f3a8bbc 8y agoMy first submission on Hacker News was the link below, 2 years ago. It didn't receive any upvote. Click and see, it's fascinating. * GitHub commit search: “remove private key” https://news.ycombinator.com/item?id=14262124 https://news.ycombinator.com/item?id=14262124 Although most keys removed are just useless automatically generated test keys, but genuine keys do exist. Someone should write a crawler to monitor these commits, creates digital signatures from private keys to prove the leak, and notify the CA issuer to revoke them automatically.
- jldugger 8y agoThere are multiple bots that crawl github for pubkeys and other credentials.
- bcaa7f3a8bbc 8y agoI know blackhats and grayhats must have been doing it for years. But I'm not aware there's any bot that acts in a whitehat manner to disclose it to affected parties and conduct public researches, is there? I mean, something like those RSA keys crawling projects by cryptographers that have discovered several types of non-random keys with zero security.
- jldugger 8y agoI admit I've been on the receiving side of some notices about low value API keys. https://www.gitguardian.com https://www.gitguardian.com for example, uses this sort of thing as a public service / sales lead I guess.
- bcaa7f3a8bbc 8y agoGood to know, thanks for the info.
- detaro 8y agoGithub does it themselves: https://github.blog/2018-10-17-behind-the-scenes-of-github-token-scanning/ https://github.blog/2018-10-17-behind-the-scenes-of-github-t...
- AFascistWorld 8y agoMaybe irrelevant but it's worth noting. Sued and jailed for submitting vulnerability. Open through google search. https://www.caixinglobal.com/2016-10-17/are-chinas-ethical-hackers-cyber-heroes-or-criminals-100997712.html https://www.caixinglobal.com/2016-10-17/are-chinas-ethical-h...
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- bcaa7f3a8bbc 8y agoFrom what I was told, around 2014 in China, there used to be a responsible-disclosure platform called WooYun that existed for a while (some of its articles has submitted to ~100 upvotes on HN). It was similar to HackerOne, and attracted a significant number of infosec researchers to hunt bugs and report it to the vendors. Until 2016, when the government arrested its founders. * WSJ: China’s ‘White-Hat’ Hackers Fear Dark Times After Community Founder Is Detained https://blogs.wsj.com/chinarealtime/2016/08/01/chinas-white-hat-hackers-fear-dark-times-after-community-founder-is-detained/ https://blogs.wsj.com/chinarealtime/2016/08/01/chinas-white-... * China Arrests 10 White Hats from WooYoun Ethical Hacking Community https://news.softpedia.com/news/china-arrests-10-white-hats-from-wooyoun-ethical-hacking-community-506861.shtml https://news.softpedia.com/news/china-arrests-10-white-hats-...
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- xvector 8y agoTruly pathetic from DJI's side. And China, but that's to be expected at this point. They do not deserve to have white-hats find their vulns for them. > "I am done. I will go to jail, and I have to take this stain ... in my life. My girlfriend begin to break up with me, woooo, my family are broken. Fuck!!! What are terrible things! Maybe the only thing I can do now is to die; it is so hard. I need to be free.” This is horrifying. It honestly makes me feel sick for this poor developer. Companies and nations this cruel have no place in modern society.
- peterwwillis 8y agoThere's no reason to be that dramatic. The US often has worse impacts on people's lives. If you're poor and uneducated in this country, one mistake can lead to a lifetime of debt and a cycle of prisons, hospitals, mental health facilities, homeless shelters, and so on. There is no significant social safety net for a large swath of the population (we're talking tens of millions of people) and people's lives are often left in shambles by a system that doesn't operate on empathy. But also, this person is only facing six months and $30,000. That is no reason to consider suicide. Of course it sucks, but their life isn't over.
- sli 8y agoWhat does any of this have to do with a Chinese developer in China? This is just whataboutism.
- throwaway55321 8y agoNo, it’s perspective because he’s replying to the comment, “Companies and nations this cruel have no place in modern society.”
- throwaway55321 8y agoThis reminds me of Aaron Swartz‘s case.
- 8y ago
- RubenSandwich 8y agoIt seems that a lot of people commenting did not read the whole article. The developer committed four internal repos to DJI's public Github: 'spray-system', 'Management-platform', 'real_time_serve_v1' and 'real_time_serve'. These repos contained a wide variety of secret keys. So it does seem that this was intentional. Even playing devil's advocate because many large companies, Facebook, Google, etc, have systems to mirror part of their internal repos to GitHub, but I can imagine that adding a new path is checked and double checked by multiple people. Also this wasn't just a mistake of one repo, it was four. I'm making no comment on if the punishment fit the crime, just that by reading the article it does seem that this was very much intentional.
- oh_sigh 8y agoThere have been thousands of instances of people unintentionally uploading their private keys to github. It seems at least plausible that this developer just didn't know the implications of what he was doing.
- forkLding 8y agoYea but you've breached NDA and likely committed some kind of intentional sabotage because this was done 4 times, so what happens to you is up to the courts and how you can argue it.
- adamnemecek 8y agoIt might not be international, he might have had a broken process or he was unfamiliar with it. Like it's easy to make the same mistake if you weren't alerted to it the first time.
- oh_sigh 8y agoIf you can make a mistake once, you can make it 4 times. If this guy was going for intentional sabotage, why not sell the keys on the dark web? Why not anonymously publish them on pastebin? Why would he just upload them to github under his own name?
- ab_c 8y agoI feel sorry for this dev as I've seen people do a lot of cluelessly dumb shit over the years when it comes to security. For example, I worked in a place which hires co-op students and every year there'd be at least one university-educated student who --after being told not to-- would put their nondescript FOB security key card in their wallet. In the event they lose their wallet, any stranger can google the name found on their drivers license to find out information about them, their friends, or their place of employment. Then there are the countless startups where the boss has decided they don't need to worry about security so their communal password is "password" and they keep their user database in plain text. Nobody takes security seriously until it blows up. And that tends to be the common attitude from business management: worry about it when it's a problem.
- fiddlerwoaroof 8y agoThis example isn't particularly good: I'm much more likely to lose a random keycard in my pocket than my wallet so, although having the keycard in my wallet might make it easier to figure out what door it opens, it also makes it much less likely that I'd lose my keycard in the first place.
- bcaa7f3a8bbc 8y ago> I'm much more likely to lose a random keycard On this example, I don't think it's a problem as well. First, the keycard has a PIN. After 3 failed attempts, it would either self-destruct the private key or lock itself down until a secret recovery code is provided. Second, private keys on keycards that are reported as lost can be revoked immediately.
- vl 8y ago>after being told not to-- would put their nondescript FOB security key card in their wallet. But what specifically are they supposed to do with the security key card? What mode of securing and transportation do you envision?
- rightbyte 8y ago
- nicodjimenez 8y agoChina is setting an example here that intellectual property laws are to be taken seriously. It's not clear whether this particular case was intentional or not, but in general greater IP protection in China is definitely a good thing.
- bovermyer 8y agoIf you think jailing someone for a mistake is a good thing, then you have some serious humanity issues that you need to work on.
- nicodjimenez 8y agoWell it all depends on severity of the mistake. If you run someone over with a car, even if it was an accident, ther need to be consequences.
- bovermyer 8y agoNo, it really doesn't. If you accidentally run someone over with a car, then there was definitely a failure of something, but it wasn't a moral failing. Punishment should never be used when correcting the underlying problem will have a more lasting positive impact. In the car example, what do you think would be better - jailing the person who drove the car, or developing systems to prevent future such accidents?
- Veen 8y agoYou can be sent to jail for a mistake if it was caused by negligence.
- penagwin 8y agoWell yeah obviously. The question is whether an individual should go to jail because of negligence. Obviously, there is a real "It depends". Hit and kill an individual with your car because you were distracted? That could mean jail. Accidentally pushed code to the wrong repo? Should that mean jail time?
- Rebelgecko 8y agoThat's pretty lame, especially considering DJI's abysmal security practices. For the Phantom 2, I think the root password to ssh into the drone was something like "12341234". For the Phantom 3, they make it more secure by upgrading the password to "Big~9China".
- bitL 8y agoDo you know one for Phantom 4? I'd like to adjust maximal allowed elevation (the hard limit gets in the way while shooting movies in mountains).
- penagwin 8y agoJust curious, do you have any pictures from your drone at various heights? I don't have a gps/barometer on my drone yet and I'm curious how high say 300 ft looks like.
- bitL 8y agoI don't have any public ones, though I found some video of P3 climbing continuously to 1600ft with altitude on the screen: https://www.youtube.com/watch?v=1sC5cnm3zVQ https://www.youtube.com/watch?v=1sC5cnm3zVQ
- Rebelgecko 8y agoDon't know, sorry. It might be worth checking if that limit is enforced on the drone itself or the app. At least for the older drones, things like no fly zones around airports were only in the app. Messing with the firmware of the actual drone seemed nontrivial.
- bitL 8y agoP4 was supposed to have it baked in the firmware as DJI didn't want to allow 3rd party apps to bypass that limit.
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- outworlder 8y agoWhy aren't we questioning the fact that there were secrets stored in Git? This is terrible security practice, and this fallout is exactly the kind of issues we should expect to happen as consequence.