Subscribe - Chongxi's Coffee House

Subscribe to new posts via RSS/Atom. Works with Follow, Feedly, Inoreader and most readers.

https://xice.cx/en/atom.xml

● XML / Atom 1.0● 837 lines● Full Content

atom.xml

837 lines

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

<?xml version="1.0" encoding="utf-8"?>

<id>https://xice.cx/en/</id>

<title>Chongxi's Coffee House</title>

<generator>Astro - Feed Library</generator>

<name>Chongxi</name>

<email>[email protected]</email>

<uri>https://xice.cx/</uri>

</author>

<subtitle>Coffee, code and night. A table for thoughts beyond the information flood.</subtitle>

<icon>https://xice.cx/favicon.ico</icon>

<entry>

<id>https://xice.cx/en/posts/dji/</id>

How a technology company spent nine years systematically destroying the security community’s trust in it

</blockquote>

<h2>Prologue: October 24, 2026, Shanghai</h2>

It was Programmer’s Day.

In Shanghai, GEEKCON 2026 was underway — one of China’s top white-hat hacking competitions. Its predecessor, GeekPwn, was founded in 2014, and its founding team DARKNAVY had already pulled off the world’s first remote hack of a Tesla back in 2015. Over the past decade and more, contestants have broken into Apple devices, Teslas, Android phones and all kinds of robots. Breaking the most iconic smart devices in front of a live audience is the event’s whole point.

This year’s drone attack-and-defense segment was called “Runaway Drone.” The judges first used GPS spoofing to force a consumer drone into a virtual no-fly zone and lock it down completely. Contestants then had to find an unknown vulnerability, seize back control and break through the flight restriction. The proposition being tested was a hard one: once low-level control is lost, do the safety mechanisms that constrain flight fail along with it?

Halfway through the event, the police arrived.

This was not part of the show. These were real police officers.

Someone had reported the event on the grounds of “illegal hacking instruction and soliciting others to crack devices.” Several contestants and judges were taken away for questioning, and the schedule was suspended on the spot. According to security expert Tan Xiaosheng, the person who filed the report was “a drone manufacturer with an extremely high market share that had been cracked.” Given that DJI has held more than 70% of China’s consumer drone market for years, the internet immediately guessed the same company: DJI.

Wang Qi, chairman of the GEEKCON organizing committee, erupted in public: “I’ve been doing this for so many years, and I’ve never met anyone this fucking stupid!”

</blockquote>

Tan Xiaosheng was equally blunt: “Instead of solving the problem itself, solving the person who found the problem has become the ‘best practice’ at plenty of companies. It’s truly sad.”

</blockquote>

That evening, the organizers announced the Shanghai stop was closing. The security world erupted. But for anyone familiar with DJI’s history, this was not an accident. It was another rerun.

<h2>Background</h2>

To understand how absurd this is, you first need to understand what level of event GeekCon is.

GEEKCON was founded by DARKNAVY as a global non-profit platform for security geek technology. Since 2014 it has been held in Beijing, Shanghai, Macau, Singapore, Las Vegas and elsewhere. Huawei, Tencent Security, Ant and other leading Chinese tech companies have sponsored it for years — which is itself an endorsement of the idea that finding vulnerabilities early beats patching them after they explode.

This is a public stage for top-tier security research. More importantly, GeekCon has clear responsible-disclosure rules: it never reveals vulnerability details from beginning to end, and it does not even publicly name the manufacturers of the devices that were cracked. In other words, before the police showed up, nobody had even said publicly whose drone had been cracked.

At the same 2026 event, a vivo phone was cracked. vivo was a sponsor, and its security president was in the room. Nobody called the police. DingTalk was cracked, with an Ant Group executive present as an organizing-committee member. Nobody called the police. A Unitree robot was cracked. Nobody panicked. The only company that called the police was DJI.

The previous GEEKCON 2025 also featured drone attack-and-defense: contestants never touched the bodies of the drones, yet made two hovering drones lose control and crash while hijacking two others into a straight vertical climb. Nobody in the industry thought that was a problem, because that is simply how security research works.

<h2>The Finisterre Incident</h2>

To understand why the security community’s first reaction was “DJI again, of course,” we need to go back to 2017.

<h3>How the Bug Bounty Started</h3>

In August 2017, the U.S. Army ordered a full halt to the use of DJI products, citing “cyber vulnerabilities.” Under public pressure, DJI hastily launched a bug bounty program, offering rewards ranging from $100 to $30,000.

In the words of security researchers afterward, the program looked more like a PR move than a genuine attempt to improve security.

<h3>Four Days After Launch</h3>

Security researcher Kevin Finisterre contacted DJI. In DJI’s own public GitHub repository, he found something almost too painful to believe:

DJI’s wildcard SSL private key (*.dji.com), AWS account credentials and firmware AES encryption keys were all sitting in plaintext in a public code repository. And they had been sitting on GitHub for two to four years.

What did that key mean? With the SSL private key, you could impersonate DJI’s official website. With the AES firmware key, you could decrypt flight-control firmware and bypass every geofence and flight restriction. With the AWS credentials, you could access user data stored on DJI’s servers.

Following that key, Finisterre reached unencrypted user flight logs, passport scans, driver’s licenses and government IDs — including flight logs from military and government domains. He put together a 31-page report and submitted it to DJI.

DJI confirmed the vulnerability fell within the bug bounty scope and offered the maximum reward: $30,000.

<h3>After 130 Emails</h3>

Then came a long tug of war. DJI produced an NDA for Finisterre to sign, requiring that he never publicly claim he had discovered the vulnerability. For a security researcher, public attribution is worth no less than cash. The condition was hard to accept. Finisterre consulted lawyers; four of them independently reached the same conclusion: the contract was “extremely risky” and “apparently drafted in bad faith to silence him.”

After more than 130 emails, DJI’s legal department sent a letter citing the Computer Fraud and Abuse Act (CFAA) — a U.S. federal law that can carry criminal liability.

Finisterre saw it as a threat. He gave up the $30,000 and went public with the whole story. He published an 18-page PDF titled “Why I Walked Away From DJI’s $30,000 Bounty,” which spread widely through the security community.

DJI’s response: publicly call Finisterre a “hacker” and characterize his actions as “unauthorized access.”

<h3>Another Researcher Had It Worse</h3>

In the same month the Finisterre story was unfolding, another researcher, Sean Melia, reported the Heartbleed vulnerability, SQL injection flaws and a serious defect that allowed full access to the purchase-order database. By DJI’s own bounty standards, that was worth at least $16,000. DJI offered him $500.

Melia refused and told DJI: “You shouldn’t be running a bug bounty program at all.”

<h3>What Happened to the Employee</h3>

The DJI employee who uploaded the keys to GitHub was named Li Zhanbin. He later emailed Finisterre saying he had uploaded them by accident. In January 2018, DJI fired him. In 2019, he was sentenced to six months in prison and fined 200,000 yuan.

Look at the structure: the DJI employee who put the keys online in plaintext went to prison; Finisterre, who found and reported them, was threatened and publicly shamed; Melia, who did nothing wrong, was offered a token $500. DJI itself, the company that actually committed the serious security failure, suffered nothing.

<h2>Why the PR Was So Terrible</h2>

DJI is a company with a top-tier engineering culture, yet its public relations look as if they were entirely outsourced to amateurs. There are probably a few structural reasons.

<ol>

<li>

The Chinese market never demanded good PR. DJI is essentially a monopoly at home, and consumers have no alternative. In that environment, the PR department’s muscle memory is to suppress, not to communicate. When something goes wrong, seal it, threaten, call the police. That occasionally works in China, but it is a disaster in the security community, because programmers are the last people who respond well to that.

</li>

<li>

It treats silence as arrogance. Apple rarely explains itself publicly either, but Apple’s product design is its best PR. DJI copied the posture and forgot the precondition: every decision has to withstand review. Claiming to care about security while reporting white-hat hackers to the police is a contradiction you cannot leave unexplained.

</li>

</ol>

The core issue is that DJI has never really lost. From its founding in 2006 to today, its products have consistently been the best in the world, its market share has never been shaken, and its competitors have died one after another on the beach. A company that spends twenty years in that environment develops a dangerous belief: everything we do is right, because we always win. Every time it “suppresses” a problem, the wrong lesson is reinforced. Every narrow escape makes the next one more reckless.

At GeekCon, DJI had a perfect PR opportunity: “Our products are so good that even top hacking competitions use them as target practice.” Instead it chose the approach that generated the most hostile coverage, turning a story it could have bragged about into an industry-wide joke. This is the Streisand Effect: when Barbra Streisand sued a photographer to remove an aerial photo of her home, the photo went from six views to hundreds of thousands. DJI just did it again.

<hr />

Drones are not phones. There is no “good enough” budget alternative. Flight-control stability, battery life and video transmission quality degrade in ways users feel immediately, and the cost can be a crashed aircraft or an injury. The industry naturally concentrates around the strongest technical player; there is no room for low-end substitutes. DJI’s competitors — Yuneec, Zero Zero, Parrot — are either dead or barely breathing.

In a market with one dominant player, DJI knows its user base very well: people who care about security were never going to buy from it, and people who buy from it do not care about security. So from a business-logic standpoint, calling the police may even have seemed rational.

This is the price of dominance, the price of no competition: it protected DJI, and it also removed the pressure that would have forced DJI to become better.

<h2>The Deepest Consequence</h2>

The deepest consequence of the GeekCon incident is a broken chain of trust.

When a white-hat hacker reports a vulnerability to a vendor, it is essentially a gentleman’s agreement: I help you find the problem, you fix it and give me credit or a reward, and everyone is happy. DJI has now publicly declared: play this game with us and we will put you in jail.

From now on, a researcher who finds a DJI vulnerability has only three options: throw it away, publish it, or sell it. Reporting it to DJI has disappeared from the table.

An RCE vulnerability that can remotely control a drone is worth a great deal on the exploit market. Researchers used to wrestle with “I’d feel bad selling this.” DJI has now solved that psychological burden for them: if I can be arrested for entering a legal competition, why do I owe you any moral restraint?

DJI’s global installed base is astronomical. At a large drone light show, hundreds of machines hang in the air at once. If there is an undisclosed RCE vulnerability, an attacker needs no gun and no artillery — just a laptop to create a major news event. The targets are dense, the crowds are gathered, and the livestream footage is crystal clear. The GeekCon challenge was literally called “Runaway Drone.” DJI’s police report stopped the demonstration, but it did not stop the vulnerability from existing.

The end result: the vulnerability still exists, except it has moved from the stage to the dark-web price list, and the patch timeline has gone from “a week” to “never.” Every DJI drone a customer buys is, because of that police report, actually less secure.

<h2>The Only Lesson Humans Learn From History Is That They Learn Nothing</h2>

While the GeekCon story was spreading, someone on Zhihu brought up a story from eleven years earlier.

Around 2015, a security researcher disclosed a vulnerability in the dating site Jiayuan on WooYun, then China’s largest vulnerability disclosure platform. WooYun notified Jiayuan according to responsible-disclosure procedure, and Jiayuan fixed the flaw. Then Jiayuan turned around and called the police, sending the researcher to a detention center.

That incident shook the Chinese security community at the time, and WooYun eventually shut down in 2016. In 2026, the same script played out on a much bigger stage.

Someone on Zhihu wrote: “That was eleven years ago. I never thought I’d still be seeing this in 2026.”

</blockquote>

The difference is that this time it was China’s most famous hacking competition, and the organizers had enough credibility and reach to fight back, which multiplied the impact. But the structure is identical: a researcher helps you find a vulnerability, and you use the law to attack the researcher.

<h2>Vicious Cycle and Slow Death</h2>

Put all these events together and a very clear structure emerges:

Winning too easily → no need for reflection → arrogance → suppress problems with power → get away with it → even less need for reflection

</blockquote>

Every successful suppression reinforces the wrong lesson. The decision-making system itself is broken, and there is no correction mechanism. A normal company has three correction paths: pressure from competitors (none), users voting with their feet (there is no alternative in drones), and internal dissent (with a personality like Frank Wang’s, probably nobody inside dares to speak up). All three are blocked.

DJI will die, but it may die later than anyone expects. Historically, the only things that break this kind of cycle are a disruptive technology that evaporates the moat, or regulators stepping in directly. The former shows no sign of appearing; the latter is being prepared in various countries but is moving slowly.

The most likely path is a combination: an RCE vulnerability is actually exploited, a high-profile security incident occurs, and regulators intervene; overseas markets legislate it out of existence; security talent refuses to work at DJI, and the technical moat starts eroding from within. Any one of these alone is not fatal, but all three together, and suddenly it is gone.

Nokia took ten years. Kodak took twenty. DJI’s moat is deeper and its inertia stronger, but once the direction is wrong, depth only makes the sinking more complete.

A vulnerability does not disappear because a demonstration is stopped. It only moves from the stage underground. And the people who pay at the end of the chain are precisely the ordinary customers who spent real money on a drone.

<h2>Conclusion</h2>

The line worth rereading most from this whole affair is Tan Xiaosheng’s: “Instead of solving the problem itself, solving the person who found the problem has become the ‘best practice’ at plenty of companies. It’s truly sad.”

DJI’s vulnerability is there. Whether or not the GeekCon demo was interrupted, the vulnerability is there. White-hat hackers can choose not to research your products. Criminal groups will not spare your products just because nobody researches them.

In 2017, Finisterre found SSL keys sitting on GitHub, brought the evidence to DJI, was threatened, gave up $30,000 and wrote an 18-page report telling the whole story. Nine years later, security researchers demonstrated a flight-control vulnerability at a legal event and were taken away by police for questioning.

The essence of both events is exactly the same: a technical problem treated as a PR problem, and a PR problem treated as a legal problem.

Every time DJI responds to a technical problem with power instead of technology, it pushes its own customers toward greater risk. This is not exaggeration. It is logic.

And right now, millions of DJI drones are flying in the sky, above people’s heads, over farmland, film sets and firefighting scenes, in neat formations above cities. Their safety depends on DJI being willing to take security seriously.

And DJI has given up on security first.

]]></content>

<name>Chongxi</name>

<email>[email protected]</email>

Preview of the first 120 lines · 837 lines total ·View full file →

● Feed● UTF-8● Read Only

Copy the URL above into your RSS reader to subscribe. Works with Follow, Feedly, Inoreader, NetNewsWire and most readers.

Archive_Ref