DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operators physical location via the AeroScope protocol.
Weakness
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mavic_3_firmware | Dji | - (including) | - (including) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/102.html
- https://cwe.mitre.org/data/definitions/117.html
- https://cwe.mitre.org/data/definitions/383.html
- https://cwe.mitre.org/data/definitions/477.html
- https://cwe.mitre.org/data/definitions/65.html
References
- https://twitter.com/StarFire2258/status/1519767091829637120
- https://twitter.com/d0tslash/status/1519774807776284672
- https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking
- https://twitter.com/StarFire2258/status/1519767091829637120
- https://twitter.com/d0tslash/status/1519774807776284672
- https://www.theverge.com/2022/4/28/23046916/dji-aeroscope-signals-not-encrypted-drone-tracking