5 ms·

Ask HN: DJI possibly providing location of Ukranian drones

Apparently from this CNN report there is a suggestion (@1:57) that DJI is feeding Russians the location of Ukranian drones used to call in artillery. Is there any scheme (alternate firmware, open source app, firewall settings) that can prevent DJI from receiving this location data? https://youtu.be/b166ecyNBCw?t=117

throwaway888abc 5y ago
Some more details, not heard about solution https://dronexl.co/2022/05/09/dji-aeroscope/ https://dronexl.co/2022/05/09/dji-aeroscope/ https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-si... https://mavicpilots.com/threads/disable-aeroscope-on-mavic-air-2.123912/ https://mavicpilots.com/threads/disable-aeroscope-on-mavic-a...
- VectorLock 5y ago
  >DJI spokesman Adam Lisberg tells The Verge himself that he has been misinformed all along about how AeroScope works by his Chinese R&D colleagues Thats really bad if they're even lying to each other internally how this works.
  - dboreham 5y ago
    Much more likely they were just too lazy to audit/verify that it wasn't sending plaintext. It's also debatable whether encryption would be effective since the packets would need to be decrypted by the drone monitoring devices worldwide. At least the key could be changed in war zones though.
- annoyingnoob 5y ago
  Interesting. Seems possible then to send your own signals spoofing drone locations. You could fill the receiver with drones that are not there.
  - jhugo 5y ago
    Yes. As always, the choice to not use encryption cuts both ways. No secrecy for the sender, but no guarantee of authenticity for the receiver.
    - Nomentatus 5y ago
      Annoyingnoob seems to have the obvious quick and dirty solution: "overwrite" the real signals; obfuscate by sending out a blizzard of false signals to mask the rare true ones.
wmf 5y ago
To be clear, the data never goes to DJI themselves. DJI drones broadcast their location and other information over RF for anyone nearby to receive. In a war zone we should assume that all interested parties are listening.
- jhugo 5y ago
  > DJI drones broadcast their location and other information over RF for anyone nearby to receive. This is true, it's in an unencrypted beacon. > To be clear, the data never goes to DJI themselves. Is this true? If I fly my Spark with my phone connected, the phone sends a pretty constant stream of stuff to somewhere on the Internet. It's encrypted, so I don't know what it is, but I assumed it would include telemetry of drone parameters that could include location. Of course, if you're in a war zone, consider just not connecting your phone... the drone flies fine with no possible connection to the Internet.
  - flemhans 5y ago
    Especially if you modded the drone (range extension hack, height limit hack), you anyway don't connect it to the phone as it may reverse the hacks. The DJI FPV has a range of 5+ km with the range extension hack, which ignores local regulations and boosts sending power.
nickphx 5y ago
The "drones" broadcast the data over wifi as an AP beacon with additional data.. Aside from developing the firmware to do this, DJI does not control or provide the information.. https://github.com/DJISDKUser/metasploit-framework/blob/62e36f1b5c6cae0abed9c86c769bd1656931061c/modules/auxiliary/dos/wifi/droneid.rb#L187 https://github.com/DJISDKUser/metasploit-framework/blob/62e3... Might be able to create sufficient 'noise' using this -- https://github.com/DJISDKUser/ESP8266_DJI_DroneID_Throwie https://github.com/DJISDKUser/ESP8266_DJI_DroneID_Throwie
- singularity2001 5y ago
  So we should soon see drone alarms triggered by wifi signals (?)
tristanj 5y ago
Here is a video showing a DJI drone operator in Ukraine being struck by artillery seconds after landing a drone. https://www.youtube.com/watch?v=UZXzMUxfR6c https://www.youtube.com/watch?v=UZXzMUxfR6c According to this article [0], DJI drones broadcast the following data in real-time: – Model of drone, – position and height, – the story of flight, – home point (off point), – the position of the pilot (with GPS included in the mobile device connected to the remote). Russia has reportedly installed DJI Aeroscope monitoring stations that can detect these signals from 30-40 miles away. [0] https://dronexl.co/2022/03/16/risk-of-flying-a-dji-drone-in-ukraine/ https://dronexl.co/2022/03/16/risk-of-flying-a-dji-drone-in-...
- ed25519FUUU 5y ago
  I think this is simply coincidence or this guy was spotted when he first flew off. Russian artillery simply isn’t that accurate or that fast.
- kevin_thibedeau 5y ago
  I guess the easiest mitigation is an app that sends a false location of the pilot. Ideally near the target so they have a chance to receive some friendly fire.
  - bb88 5y ago
    I don't think that would be too hard to do, either given an SDR or reverse engineering the firmware to give some other loctation.
- ncmncm 5y ago
  I saw a short video where they are carefully running the drone way out in a field before turning it on, and running away after.
neonsunset 5y ago
For now we’re just not using DJI near frontlines, where instead Autel is usually chosen, especially the ones with thermal sights. Being able to use open firmware would definitely be awesome, to protect lives of operators and to customize drones further.
vytvy 5y ago
Here is video that was done by biggest distributor of dji drones in Ukraine about what happened and that China helped russians to track ukrainian dji drones - https://www.youtube.com/watch?v=706sOiEEVkY https://www.youtube.com/watch?v=706sOiEEVkY
sschueller 5y ago
DJI and third parties sell equipment to track drones and even locate the pilot easily. These are available for a few thousand dollars and were meant to protect airspace such as around an airport but of course they can also be used by militaries to target an enemy. In fact the DJI system [1] will see a drone as soon as its powered on even if it isn't even flying. In the end any drone pilot sending signals can be tracked and the only way around this is to fly a drone completely autonomously with way points and only receive video from it. Some open source firmwares and controllers support such features. [1] https://www.dji.com/ch/mobile/aeroscope https://www.dji.com/ch/mobile/aeroscope

throwaway888abc 5y ago

Some more details, not heard about solution https://dronexl.co/2022/05/09/dji-aeroscope/ https://dronexl.co/2022/05/09/dji-aeroscope/ https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-si... https://mavicpilots.com/threads/disable-aeroscope-on-mavic-air-2.123912/ https://mavicpilots.com/threads/disable-aeroscope-on-mavic-a...

VectorLock 5y ago
>DJI spokesman Adam Lisberg tells The Verge himself that he has been misinformed all along about how AeroScope works by his Chinese R&D colleagues Thats really bad if they're even lying to each other internally how this works.
- dboreham 5y ago
  Much more likely they were just too lazy to audit/verify that it wasn't sending plaintext. It's also debatable whether encryption would be effective since the packets would need to be decrypted by the drone monitoring devices worldwide. At least the key could be changed in war zones though.
annoyingnoob 5y ago
Interesting. Seems possible then to send your own signals spoofing drone locations. You could fill the receiver with drones that are not there.
- jhugo 5y ago
  Yes. As always, the choice to not use encryption cuts both ways. No secrecy for the sender, but no guarantee of authenticity for the receiver.
  - Nomentatus 5y ago
    Annoyingnoob seems to have the obvious quick and dirty solution: "overwrite" the real signals; obfuscate by sending out a blizzard of false signals to mask the rare true ones.

wmf 5y ago

To be clear, the data never goes to DJI themselves. DJI drones broadcast their location and other information over RF for anyone nearby to receive. In a war zone we should assume that all interested parties are listening.

jhugo 5y ago
> DJI drones broadcast their location and other information over RF for anyone nearby to receive. This is true, it's in an unencrypted beacon. > To be clear, the data never goes to DJI themselves. Is this true? If I fly my Spark with my phone connected, the phone sends a pretty constant stream of stuff to somewhere on the Internet. It's encrypted, so I don't know what it is, but I assumed it would include telemetry of drone parameters that could include location. Of course, if you're in a war zone, consider just not connecting your phone... the drone flies fine with no possible connection to the Internet.
- flemhans 5y ago
  Especially if you modded the drone (range extension hack, height limit hack), you anyway don't connect it to the phone as it may reverse the hacks. The DJI FPV has a range of 5+ km with the range extension hack, which ignores local regulations and boosts sending power.

nickphx 5y ago

The "drones" broadcast the data over wifi as an AP beacon with additional data.. Aside from developing the firmware to do this, DJI does not control or provide the information.. https://github.com/DJISDKUser/metasploit-framework/blob/62e36f1b5c6cae0abed9c86c769bd1656931061c/modules/auxiliary/dos/wifi/droneid.rb#L187 https://github.com/DJISDKUser/metasploit-framework/blob/62e3... Might be able to create sufficient 'noise' using this -- https://github.com/DJISDKUser/ESP8266_DJI_DroneID_Throwie https://github.com/DJISDKUser/ESP8266_DJI_DroneID_Throwie

singularity2001 5y ago
So we should soon see drone alarms triggered by wifi signals (?)

tristanj 5y ago

Here is a video showing a DJI drone operator in Ukraine being struck by artillery seconds after landing a drone. https://www.youtube.com/watch?v=UZXzMUxfR6c https://www.youtube.com/watch?v=UZXzMUxfR6c According to this article [0], DJI drones broadcast the following data in real-time: – Model of drone, – position and height, – the story of flight, – home point (off point), – the position of the pilot (with GPS included in the mobile device connected to the remote). Russia has reportedly installed DJI Aeroscope monitoring stations that can detect these signals from 30-40 miles away. [0] https://dronexl.co/2022/03/16/risk-of-flying-a-dji-drone-in-ukraine/ https://dronexl.co/2022/03/16/risk-of-flying-a-dji-drone-in-...

ed25519FUUU 5y ago
I think this is simply coincidence or this guy was spotted when he first flew off. Russian artillery simply isn’t that accurate or that fast.
kevin_thibedeau 5y ago
I guess the easiest mitigation is an app that sends a false location of the pilot. Ideally near the target so they have a chance to receive some friendly fire.
- bb88 5y ago
  I don't think that would be too hard to do, either given an SDR or reverse engineering the firmware to give some other loctation.
ncmncm 5y ago
I saw a short video where they are carefully running the drone way out in a field before turning it on, and running away after.

neonsunset 5y ago

For now we’re just not using DJI near frontlines, where instead Autel is usually chosen, especially the ones with thermal sights. Being able to use open firmware would definitely be awesome, to protect lives of operators and to customize drones further.

vytvy 5y ago

Here is video that was done by biggest distributor of dji drones in Ukraine about what happened and that China helped russians to track ukrainian dji drones - https://www.youtube.com/watch?v=706sOiEEVkY https://www.youtube.com/watch?v=706sOiEEVkY

sschueller 5y ago

DJI and third parties sell equipment to track drones and even locate the pilot easily. These are available for a few thousand dollars and were meant to protect airspace such as around an airport but of course they can also be used by militaries to target an enemy. In fact the DJI system [1] will see a drone as soon as its powered on even if it isn't even flying. In the end any drone pilot sending signals can be tracked and the only way around this is to fly a drone completely autonomously with way points and only receive video from it. Some open source firmwares and controllers support such features. [1] https://www.dji.com/ch/mobile/aeroscope https://www.dji.com/ch/mobile/aeroscope