DJI Threatens Legal Action After Researcher Reports Bug

DJI has threatened to take legal actions against the researcher who claimed security vulnerabilities to the company as a part of bug bounty program. According to Finisterre, there were significant problems associated with the drone makers security. DJI has created a new website that aims at providing detailed information regarding the bounty program and were not announced early.

DJI threatens legal
action after researcher
reports bug

Introduction
• DJI announced that bug bounty program would provide rewards to
people that will find flaws within the software.
• Company decided to provide $100 and $30,000 based on the flaw.
• However the program did not have a good start.

DJI approach
• This approach cyber security is associated with
companies like Yahoo, Google and Microsoft.
• However the DJI be security published their
private key in the GitHub that allowed in
accessing the sensitive customer information.
• However after the report was published by
Finisterre the DJI’s legal team sent a letter for
Computer Fraud and Abuse Act.
• This was further interpreted as an act of threat

DJI legal action
• According to Finisterre there were significant
problems associated with the drone makers
security.
• DJI has threatened to take legal actions against
the researcher who claimed security
vulnerabilities to the company as a part of bug
bounty program.
• After this the DJI created a new website that
aims at providing detailed information
regarding the bounty program and were not
announced early.

Standard terms for researchers
• The standards terms includes
protecting the confidentiality
of data
• Allowing time for analysis
and resolution
• This will ensure proper data
is displayed after proper
analysis

Standards for researcher
• DJI decided to improve the system for overcoming the security
issues related to the products.
• In addition to this DJI has paid thousand of dollars towards the
researcher.
• This researcher has helped in determining the vulnerability within
the system.
• In addition to this DJI has also offered to pay new bounties to new
researchers.

Software Security
• The security of a software is
one of the most important
non-functional requirement .
• It is very important that the
people using the software can
operate safely on it.
• Software security depends
mainly on the access control
system and firewall system
installed in it.

Data Security and Privacy
• Data is one of the most important
part of the IT sector.
• It is very important that both the
data of the client and the
organization is protected efficiently.
• Privacy is one thing that should not
be tampered with and hence the
data security plan are kept into
place.

Conclusion
• Data is security is very important for any type of organization.
• DJI decided to improve the system for overcoming the security
issues related to the products.
• In addition to this DJI has paid thousand of dollars towards the
researcher.
• This researcher has helped in determining the vulnerability within
the system.
• In addition to this DJI has also offered to pay new bounties to new
researchers.

References
• Elazari Bar On, A., 2018. Private Ordering Shaping Cybersecurity Policy: The Case of Bug Bounties.
• Nichols, R.K., Mumm, H.C., Lonstein, W.D., Ryan, J.J. and Carter, C., 2018. Unmanned Aircraft Systems (UAS) in the Cyber Domain: Protecting
USA's Advanced Air Assets.
• Thierer, A., 2016. Permissionless innovation: The continuing case for comprehensive technological freedom. Mercatus Center at George
Mason University.
• Zhao, M., Laszka, A. and Grossklags, J., 2017. Devising effective policies for bug-bounty platforms and security vulnerability discovery. Journal
of Information Policy, 7, pp.372-418.
• Felderer, M. and Fourneret, E., 2015. A systematic classification of security regression testing approaches. International Journal on Software
Tools for Technology Transfer, 17(3), pp.305-319.
• Pattakou, A., Kalloniatis, C. and Gritzalis, S., 2017. Security and privacy requirements engineering methods for traditional and cloud-based
systems: A review. CLOUD COMPUTING 2017, 155.
• Van Den Berghe, A., Scandariato, R., Yskout, K. and Joosen, W., 2017. Design notations for secure software: a systematic literature review.
Software & Systems Modeling, 16(3), pp.809-831.
• Loruenser, T., Pöhls, H.C., Sell, L. and Laenger, T., 2018, August. CryptSDLC: Embedding cryptographic engineering into secure software
development lifecycle. In Proceedings of the 13th International Conference on Availability, Reliability and Security (p. 4). ACM.
• Reed, M., 2015, October. System security engineering for program protection and cybersecurity. In Proc. 18th Annu. NDIA Syst. Eng. Conf. (pp.
26-29).
• Ponsard, C., Massonet, P. and Dallons, G., 2016. Co-engineering security and safety requirements for cyber-physical systems. ERCIM News,
106, pp.45-46.