AeroScope data leak with 80,000 drone IDs found

Dimitri Wolf Von Dimitri Wolf 2 Min. Lesen
Symbol image. Millions of entries from AeroScope systems reveal sensitive drone pilot data. Image: unsplash.com

Information on over 80,000 different drone IDs was spotted in a publicly available database. Among other things, the data leak contains information about locations, flight routes and associated serial numbers.

The Cybernews research team discovered an open database of over 90 million entries of drone surveillance logs generated by 66 different DJI AeroScope devices. AeroScope is a drone surveillance device from DJI and can “identify the vast majority of drones on the market today.”

Most of the logs found (53) originated in the USA. Other data originated in Qatar (six) and a few in Germany, France and Turkey.

Contents of the AeroScope data leak

The records now found included the drone’s location, model and serial number, the location of the drone’s pilot, and the home point (usually the launch point). However, the record did not contain any personally identifiable information . In total, Cybernews staff found over 80,000 unique drone IDs in this case.

Werbung

DJI told Cybernews that the 54.5GB dataset Cybernews discovered on July 11, 2022, hosted on AWS in the US, is not in their possession. This suggests that the data most likely came from a customer using AeroScope equipment to monitor airspace.

Since the server was hosted on AWS and no domains were assigned to it, it was not possible for Cybernews researchers to track down the owner. For that, they also relied on the help of VirusTotal, Centralops Domain dossier, nmap and dig, as well as other useful open source intelligence tools (OSINT).

Cybernews notified both DJI and AWS about the leaked database and asked them to fix the issue as soon as possible to reduce the risk of unauthorized people accessing the dataset. AWS said it had “passed the security concerns to the respective customer for their attention and possible remediation.”

However, so far there are no reports of a corresponding response from this customer.

What is the risk posed by the data leak?

Surveillance of drones is unsurprising due to security concerns and is already a common practice in many areas. However, it is usually assumed that the data collected in this way is not publicly accessible and is not stored permanently.

Aras Nazarovas, a cybernews researcher, says the information now found is troubling for amateur drone pilots because it can essentially show the routes they take with their drone.

“For people launching drones in their backyards, there’s the added risk of their address being exposed and the fact that they’re rich enough to own a DJI drone – prices range from $300 to $13,700, and you can see what drone they have,” Nazarovas said.

We do not know exactly from which regions users from Germany are affected by the data leak. Cybernews also does not disclose any further details about the information contained in the data leak for good reason. It is therefore not possible to verify whether one is affected by this data leak.

It should also be mentioned again that this data leak was obviously not DJI’s fault, but someone who had the AeroScope system in use. AeroScope is not available for free sale, but only via a contact form on the DJI website.

Source: Cybernews

THEMEN:
Folgen:
Dimitri is the founder of DeinDrohnenpilot.de and has been working at skyzr since 2021. He has been fascinated by the topic of drones since 2016. When he is not flying a drone, he is responsible for planning and developing new concepts for the platform as well as writing and creating content. He is also responsible for the technical implementation and maintenance. His training as an IT specialist for system integration and his bachelor's degree in media informatics help him with this.
Hinterlasse einen Kommentar

Leave a Reply

Your email address will not be published. Required fields are marked *