Researcher says he was threatened after finding major DJI security flaw
Drone maker DJI has been criticized roundly this weekend over its alleged response to security researcher Kevin Finisterre's discovery of a significant security issue involving the company's system. According to Finisterre, he began hunting for bugs in DJI's system under its recently established bug bounty program. In the process, Finisterre says he discovered a major security issue, but rather than rewarding him for his effort, DJI accused him of hacking and threatened to report him to the authorities.
DJI announced its bug bounty program in August following a report that claimed the U.S. Army had banned use of the maker's drones over security concerns. As part of its announcement, DJI had stated:
The DJI Threat Identification Reward Program aims to gather insights from researchers and others who discover issues that may create threats to the integrity of our users’ private data, such as their personal information or details of the photos, videos and flight logs they create.
According to a long report on the matter published by Finisterre, he spent many weeks communicating with DJI through email about the scope of its bug bounty program, which hadn't yet been publicly defined. After receiving confirmation that it included the company's servers, Finisterre went to work in writing up a report disclosing his discoveries. Speaking of which...
Due to multiple security issues, including publicly available AWS private keys for DJI's photo-sharing service SkyPixel, Finisterre reports that he was able to get access to highly sensitive user data, including: identification cards and passports, flight logs, and drivers licenses. Once he found this flaw, he claims that he alerted DJI to this vulnerability, and that the company acknowledged it.
After more than 130 emails back and forth between DJI and Finisterre, he states in his report that DJI said he would be rewarded with $30,000 under the bug bounty program (the maximum award). However, Finisterre reports that weeks later he received an agreement for his particular bug bounty that was "literally not sign-able." As he goes on to explain in his report:
I won’t go into too much detail, but the agreement that was put in front of me by DJI in essence did not offer researchers any sort of protection. For me personally the wording put my right to work at risk, and posed a direct conflicts of interest to many things including my freedom of speech. It almost seemed like a joke. It was pretty clear the entire ‘Bug Bounty’ program was rushed based on this alone.
Efforts to alter the agreement didn't pan out as hoped, says Finisterre, who goes on to claim that several different lawyers advised him that DJI's final offer was, "likely crafted in bad faith," and that it was "extremely risky" for him to sign it. It was about this time that Finisterre also receive a legal demand from DJI ordering him to delete/destroy the data he had gathered during his investigation, while appearing to threaten Finisterre with the Computer Fraud and Abuse Act.
In a statement to Ars Technica, who was the first to cover this spat between DJI and Finisterre, the Chinese drone giant referred to Finisterre as a "hacker," claiming that he had accessed one of the company's servers without permission and that he had tried to claim it under the company's bug bounty program without following "standard terms for bug bounty programs." The statement goes on to claim that Finisterre "refused to agree to these terms, despite DJI’s continued attempts to negotiate with him, and threatened DJI if his terms were not met."
For his part, Finisterre says that he ultimately turned down the $30,000 in favor of going public with what he sees as an unsettling and unacceptable experience, concluding with the following statement:
If you that are wondering if DJI even bothered to respond after I got offended over the CFAA threat, you should be happy to know it was flat out radio silence from there on out. All Twitter DM’s stopped, SMS messages went unanswered, etc. Cold blooded silence.
|Street Food 2017 by ziggyzag|
from Your City - Fast Food
|Running free by LassiM|
|Treacherous Land- "Dune " by Frank Herbert by Domenick Creaco|
from Sci-Fi or Fantasy Film Titles
|1969 Oldsmobile 442 Resto-Mod by J Warren|
from O is for...
A report from the National Endowment for the Arts shows that photography and photo-finishing services contributed $10.2 billion to the US economy in 2015.
According to unnamed sources, Google will acquire Lytro's technology and patents, with Lytro employees already having left the company.
Our review of the Sony a7 III is well underway and, as part of this, we're publishing our studio test scene. We'll be building out the review in the coming weeks as we test and shoot the camera in a series of situations.
The new ExaDrive offers a three times higher capacity than the previous largest SSD, a 30TB model by Samsung.
A pair of images show what may be the upcoming DJI Phantom 5 drone featuring an interchangeable lens camera. Update: Comparing this image to the size of previous DJI lens mounts, and noting the 3:2 aspect ratio of the sensor, we're confident the leaked image shows a 1"-type sensor
We were saddened to hear of the death last week of Chuck Westfall, a 35-year veteran of Canon USA, and a legend in the photography industry.
Nikon looks to be positioning its D850 as a serious video rig with today's announcement of its D850 Filmmaker's Kit. The kit includes the body, 20/35/85mm F1.8G lenses, an Atomos Ninja Flame external recorder, two microphones and an extra battery.
Photographers shopping around for Lightroom alternatives have likely encountered Alien Skin's Exposure X3. Here's an overview of its organization and editing controls, and how they differ from the competition.
Alien Skin has released a significant update for its Exposure X3 image editor, adding greater precision to adjustment tools and more printing capabilities, among other improvements.
The FAA has ordered helicopter pilots and operators to halt certain doors-off flights in the wake of a tragedy that killed five passengers.
Analysts TechInsights have torn down a Samsung Galaxy S9 Plus to have a closer look at the device's internal components and their cost.
Oppo's new high-end phones bear an uncanny resemblance to the iPhone X, with features like face unlock to a portrait lighting mode.
Recently we visited the 2018 CP+ show in Yokohama, Japan and as usual, we booked interviews with senior executives from several major manufacturers, including Sigma.
At this year's CP+ show in Yokohama, we sat down with senior executives from several major manufacturers, including Canon. Topics of conversation included Canon's ambitions for high-end mirrorless cameras, and the importance of responding to the demands of the smartphone generation.
We were recently able to follow local frame builder Max Kullaway as he created one of his AirLandSea bikes. Here are our picks of the photos we got, as the project progressed from bare tubes all the way to rideable bicycle.
On paper, the Sony a7 III is a tempting option for photographers who've been considering a switch to full-frame mirrorless. But how does its image quality stack up? We compare it to the Mark II and a few of its other peers.
Erez Marom shares the details behind this beautiful aurora photograph, captured on Haukland Beach in the Lofoten Islands, Arctic Norway, on a moonless evening.
Google Lens uses artificial intelligence and 'computer vision' to identify and provide information about businesses, landmarks and other objects using your phone's camera. And now it's available for iPhone users, too.
The company posted a record quarterly revenue of $2.08 billion for the first quarter of the 2018 fiscal year. That represents incredibly healthy year-over-year growth of 24 percent.
In the job posting, the Times' describes this role as "one of the most important and high-profile jobs in visual journalism." If you're looking for a high profile job in photojournalism, you could do a lot worse than being Photo Director at The Gray Lady.
According to a recent report out of South Korea, Samsung is increasing production of its ISOCELL image sensors in a bid towards market leadership for image sensors. To reach this goal, Samsung will have to dethrone current market leader Sony... no small task.
In this video, large format photographer Ben Horne shows off the incredible resolving power of 8x10 slide film by pixel peeping a massive 709.6-megapixel drum scan of one of his landscape shots. And you thought 100MP medium format was big...
Photographer Wendy Teal tells the heart-breaking story of a wedding she shot at a hospital on just 24-hours notice. The mother of the bride had been given one week to live, and Wendy responded to the couple's desperate social media plea for someone to capture their special day.
This tiny little plug-and-play VR/AR camera for Android phones uses a pair of greater-than-180° FOV fisheye lenses to offer both 360° video/photo capture and 360° livestreaming at 1440p resolution.
Syrp has announced the Magic Carpet Pro: a slider that offers filmmakers an 'infinitely extendable' range thanks to built-in track levers that let you connect lengths of track without the use of tools.
At CP+ we sat down with executives from several major manufacturers. Among them was Kenji Tanaka, of Sony, who talked to us about the a7 III as well as its plans to attract more pro shooters – without ignoring APS-C and entry-level customers.
How do you shoot macro photography on an 18x24cm large format wet plate camera? You 'connect' two large format cameras together! That's how wet plate photographer Markus Hofstaetter did it, and you can read about the whole process in this article.
The Fujifilm X-H1 is a top-of-the-range 24MP mirrorless camera with in-body stabilization and the company's most advanced array of video capabilities. We've tested the X-T2's big brother extensively to see how it performs.
Motorsports photojournalist Jamey Price recently flew to Canada with Lamborghini for the car company's Winter Accademia 2018, where clients get to drive the latest Lamborghini supercars on snow and ice. Yes... it is exactly as awesome as it sounds.
For the Pixel 2 smartphone's Motion Photos feature, Google built on its existing Motion Stills technology by adding advanced stabilization that combines software and hardware capabilities to optimize trimming and stabilization.