Topic: DJI špijunira za kinesku vladu(?)...hibridni rat na američanski način. :) (Read 4974 times) previous topic - next topic

Portal sUAS News je prije koji tjedan objavio navodni memo od američanskog Homeland Securitya.
Dokument je datiran na 09.08.2017. i spekulira da DJI putem softvera za upravljanje dronovima špijunira na taj način da potajno šalju osjetljivi podaci na servere koje kontrolira kineska vlada.
To se provodi na dronovima koji služe za komercijalne i industrijske svrhe i ne odnosi se na one za hobističko letenje.
New York Times također analizira cijelu priču i tvrdi da izdavač navodnog mema nema komentara na cijelu stvar.
DJI se pak oglasio kako će angažirati neovisne stručnjake za kibernetičku sigurnost da analiziraju takve tvrdnje, ali priznaje da imaju problema sa hakerom koji im je otkrivši neki bug u sklopu programa "bug bounty" zaradio nagradu 30.000$.
Lik pak u ovom dokumentu razjašnjava njegovu stranu priče.
Ovdje ima još o toj sitauaciji.
Koliko vidim na brzaka haker ipak je potvrdio postojanje neautorizirang pristupa korisničkim podacima, ali bilo kako bilo DJI ima novu reklamu. 
Ako je pak stvar istinita onda se radi o genijalno smišljenom master planu špijuniranja bez špijuna na terenu gdje ni sami korisnici ne shvaćaju da su postali špijuni silom prilika.

A sta se spijunira i koji su to osjetljivi podaci?

Fakat, ne znam šta bi oni mogli imat osim fotki i snimki nebitnih mjesta, i onako područja koji njih ne zanimaju..... A za industrijske primjene to već možda i ima smisla, tipa termovizijske snimke nekih pogona itd.. a sad kako oni znaju tko za šta koristi fantoma? ili sparka... 
DJI se malo sjebao sa ovim hackerom kojeg nisu htjeli isplatiti.... i sve im je ošlo u javnost... kad postaneš velik tak je to...

Koliko razumijem stvar se uglavnom odnosi na dronove za industrijsku primjenu, biće ovako nešto(?)
https://store.dji.com/shop/industrial?from=menu_products
Ne znam točno što se sve može raditi sa tim dronovima, softverom koji se upotrebljava (spominju DJI GO i SkyPixel) i kako se skladište i obrađuju podaci, ali memo navodi da ih njihove vladine agencije i strukture vlasti dosta koriste u svakodnevnoj upotrebi.
Tu sigurno ima stvari zanimljivih za obavještajnu zajednicu, industrijsku špijunažu i tko zna što drugo.

Neki citati iz mema:

U//LES) DJI sells group one category (under five pounds) UASintended for consumer and professional use.[/font]
The UAS operate on two Android smartphone applicationscalled DJI GO and Sky Pixels that automatically tag GPS imagery and locations, register facial recognition data even when the system is off, and access users' phone data. Additionally, the applications captureuser identification, e-mail addresses, full names, phone numbers, images, videos, and computer credentials. Much of the information collected includes proprietary and sensitive critical
infrastructure data, such as detailed imagery of power control panels, security measures for critical infrastructure sites, or materials used in bridge construction.
According to the source of information (SOI), DJI automatically uploads this information into cloud storage systems located in Taiwan, China, and Hong Kong, to which the Chinese government most likely has access.
SIP Los Angeles assesses with high confidence a foreign government with access to this information could easily coordinate physical or cyber attacks against critical sites.[/font][/size]

...

U//LES) SIP Los Angeles assesses with moderate confidence that Chinese-based company DJI Science and Technology is providing U.S. critical infrastructure and law enforcement data to the Chinese government. SIP Los Angeles further assesses with high confidence the company is selectively targeting government and privately owned entities within these sectors to expand its ability to collect and exploit sensitive U.S. data.
 (U) Since 2015, DJI has targeted a number of U.S. companies in the critical infrastructure and law enforcement sectors to market its UAS. As of July 2017, at least ten large companies and organizations operating in the railroad, utility, media, farming, education, and federal law enforcement sectors have already purchased and begun using DJI UAS. The most frequent uses include mapping land, inspecting infrastructure, conducting surveillance, and monitoring hazardous materials. (U//LES) SIP Los Angeles assesses with high confidence the critical infrastructure and law
 enforcement entities using DJI systems are collecting sensitive intelligence that the Chinese government could use to conduct physical or cyber attacks against the United States and its population. Alternatively, China could provide DJI information to terrorist organizations, hostile non-state entities, or state-sponsored groups to coordinate attacks against U.S. critical infrastructure. The UAS capture close-up imagery and GPS information on water systems, rail systems, hazardous material storage systems, first responders’ activity, and construction of highways, bridges, and rails.

Vjerujem da ovakvim korisnicima nije svejedna spoznaja da postoji sumnja kako netko ima pristup podacima koje prikupljaju.
Haker je dokazao da postoji mogućnost neautoriziranog pristupa i to je po meni najvažniji detalj.
Taj navodni memo može i ne mora biti istint, a možda je samo sredstvo tržišne difamacije DJI-a(?)

http://www.youtube.com/watch?v=7b_6qM6noto

http://www.youtube.com/watch?v=J2Ri_QzyOnY