Chinese dev jailed and fined for posting DJI's private keys on GitHub

https://www.theregister.co.uk/2019/04/30/dji_dev_jailed_fined_leaking_aes_ssl_keys_github/

by adamnemecek • 7 years ago

78 58 7 years ago

theregister.co.uk

devy3• 7 years ago

I don't understand why this post has to put "Chinese" in the title?! If the dev was United States citizen, would you rename the title to American dev jailed? Absurdity!

bdcravens• 7 years ago

The developer was prosecuted in China. HN guidelines also indicate the title should be unchanged from the original most of the time.

jldugger3• 7 years ago

If the dev was United States citizen, would you rename the title to American dev jailed

The only reason I can think of to not mention the nation that jailed someone for accidentally leaking their employers keys would be because the default assumption would be they are an American.

This wasn't a hack, there was no criminal intent. I think most people assume that the worst consequence for an accident like this is losing your job. The absurdity here is being fined, jailed, and receiving a criminal record.

lkj• 7 years ago

Also note the hints at the original in the URL: "dji_dev_jailed_fined_leaking_aes_ssl_keys_github"

The Register decided that adding the nationality was good for clicks. :(

mattnewton3• 7 years ago

The fact that the developer was prosecuted under Chinese law is important to an audience of developers who want to know what precedent it sets for their own work.

mattnewton3• 7 years ago

I would be really alarmed if this happened in America, as an American developer myself. I obviously wouldn’t think a mistake like this should be criminal.

lostphilosopher2• 7 years ago

HN "post" - Because that's the HN guideline.

"Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize." - https://news.ycombinator.com/newsguidelines.html

Register "post" - The Register is not a Chinese publication. The nation/legal system involved can't be assumed from the source, and is a vital part of the story since it's about a legal matter.

"the Shenzhen Municipal People's Procuratorate – the local version of the Crown Prosecution Service – successfully prosecuted the developer in early April, before the Shenzhen District Court."

Had The Register _not_ included "Chinese" it could have been accused of "click baiting" since the Register's predominantly non Chinese[1] readership might have thought this was about laws that applied to them and clicked through.

Had the source been a Chinese publication writing about a American developer jailed, I'd imagine they would use "American dev jailed..." for exactly the same reasons.

1. "The Register is a leading global online tech publication, with more than nine million monthly unique browsers worldwide. The core audiences are the UK and US, accounting for more than six million. The bulk of the remaining readership are located in Canada, Australia and northern Europe." - https://www.theregister.co.uk/Profile/about_the_register/

devy3• 7 years ago

HN "post" - Because that's the HN guideline.

I understand HN guideline here. I am talking about the Guardian's post.

Leaking private information to the public even unintentionally , that compromise the security of software and may cause public harm is illegal no matter which country you go. So the nationality of the one who leaked it is irrelevant as far as I am concerned.

bcaa7f3a8bbc5• 7 years ago

My first submission on Hacker News was the link below, 2 years ago. It didn't receive any upvote.

Click and see, it's fascinating.

* GitHub commit search: “remove private key”

https://news.ycombinator.com/item?id=14262124

Although most keys removed are just useless automatically generated test keys, but genuine keys do exist. Someone should write a crawler to monitor these commits, creates digital signatures from private keys to prove the leak, and notify the CA issuer to revoke them automatically.

jldugger3• 7 years ago

There are multiple bots that crawl github for pubkeys and other credentials.

bcaa7f3a8bbc5• 7 years ago

I know blackhats and grayhats must have been doing it for years. But I'm not aware there's any bot that acts in a whitehat manner to disclose it to affected parties and conduct public researches, is there? I mean, something like those RSA keys crawling projects by cryptographers that have discovered several types of non-random keys with zero security.

AFascistWorld• 7 years ago

Maybe irrelevant but it's worth noting.

Sued and jailed for submitting vulnerability. Open through google search. https://www.caixinglobal.com/2016-10-17/are-chinas-ethical-h...

bcaa7f3a8bbc5• 7 years ago

From what I was told, around 2014 in China, there used to be a responsible-disclosure platform called WooYun that existed for a while (some of its articles has submitted to ~100 upvotes on HN). It was similar to HackerOne, and attracted a significant number of infosec researchers to hunt bugs and report it to the vendors.

Until 2016, when the government arrested its founders.

* WSJ: China’s ‘White-Hat’ Hackers Fear Dark Times After Community Founder Is Detained

https://blogs.wsj.com/chinarealtime/2016/08/01/chinas-white-...

* China Arrests 10 White Hats from WooYoun Ethical Hacking Community

https://news.softpedia.com/news/china-arrests-10-white-hats-...

xvector• 7 years ago

Truly pathetic from DJI's side. And China, but that's to be expected at this point. They do not deserve to have white-hats find their vulns for them.

"I am done. I will go to jail, and I have to take this stain ... in my life. My girlfriend begin to break up with me, woooo, my family are broken. Fuck!!! What are terrible things! Maybe the only thing I can do now is to die; it is so hard. I need to be free.”

This is horrifying. It honestly makes me feel sick for this poor developer. Companies and nations this cruel have no place in modern society.

0xbadcafebee• 7 years ago

There's no reason to be that dramatic. The US often has worse impacts on people's lives. If you're poor and uneducated in this country, one mistake can lead to a lifetime of debt and a cycle of prisons, hospitals, mental health facilities, homeless shelters, and so on. There is no significant social safety net for a large swath of the population (we're talking tens of millions of people) and people's lives are often left in shambles by a system that doesn't operate on empathy.

But also, this person is only facing six months and $30,000. That is no reason to consider suicide. Of course it sucks, but their life isn't over.

sli• 7 years ago

What does any of this have to do with a Chinese developer in China? This is just whataboutism.

throwaway553212• 7 years ago

This reminds me of Aaron Swartz‘s case.

decoyworker• 7 years ago

In which way? In the way that Aaron Swartz accidentally broke into a closed area and extracted copyrighted material and then apologized for being so clumsy?

Havoc• 7 years ago

Companies and nations this cruel have no place in modern society.

That's exactly the direction modern society IS moving towards

gnode2• 7 years ago

My understanding is that the conviction was for deliberately (disregarding the accused's claim to the contrary) publicly sharing his employer's proprietary source code and private keys. Assuming this is actually true, then it's justified that there are legal consequences for sabotaging his employer like this, and most countries have laws penalising such behaviour.

craftyguy• 7 years ago

Meanwhile, companies and governments are allowed to 'accidentally' expose all sorts of private information about millions of people without any meaningful punishment.

londons_explore• 7 years ago

DJI should take the majority of the blame for not protecting its private keys with hardware security modules.

RubenSandwich• 7 years ago

It seems that a lot of people commenting did not read the whole article. The developer committed four internal repos to DJI's public Github: 'spray-system', 'Management-platform', 'real_time_serve_v1' and 'real_time_serve'. These repos contained a wide variety of secret keys. So it does seem that this was intentional. Even playing devil's advocate because many large companies, Facebook, Google, etc, have systems to mirror part of their internal repos to GitHub, but I can imagine that adding a new path is checked and double checked by multiple people. Also this wasn't just a mistake of one repo, it was four.

I'm making no comment on if the punishment fit the crime, just that by reading the article it does seem that this was very much intentional.

oh_sigh2• 7 years ago

There have been thousands of instances of people unintentionally uploading their private keys to github. It seems at least plausible that this developer just didn't know the implications of what he was doing.

forkLding• 7 years ago

Yea but you've breached NDA and likely committed some kind of intentional sabotage because this was done 4 times, so what happens to you is up to the courts and how you can argue it.

ab_c• 7 years ago

I feel sorry for this dev as I've seen people do a lot of cluelessly dumb shit over the years when it comes to security.

For example, I worked in a place which hires co-op students and every year there'd be at least one university-educated student who --after being told not to-- would put their nondescript FOB security key card in their wallet. In the event they lose their wallet, any stranger can google the name found on their drivers license to find out information about them, their friends, or their place of employment.

Then there are the countless startups where the boss has decided they don't need to worry about security so their communal password is "password" and they keep their user database in plain text. Nobody takes security seriously until it blows up. And that tends to be the common attitude from business management: worry about it when it's a problem.

fiddlerwoaroof• 7 years ago

This example isn't particularly good: I'm much more likely to lose a random keycard in my pocket than my wallet so, although having the keycard in my wallet might make it easier to figure out what door it opens, it also makes it much less likely that I'd lose my keycard in the first place.

bcaa7f3a8bbc5• 7 years ago

I'm much more likely to lose a random keycard

On this example, I don't think it's a problem as well. First, the keycard has a PIN. After 3 failed attempts, it would either self-destruct the private key or lock itself down until a secret recovery code is provided. Second, private keys on keycards that are reported as lost can be revoked immediately.

vl• 7 years ago

after being told not to-- would put their nondescript FOB security key card in their wallet.

But what specifically are they supposed to do with the security key card? What mode of securing and transportation do you envision?

rightbyte• 7 years ago

The same thing that we are supposed to do when we need to make up a new password every 3 months. Absolutely not add 1 to it and call it a day.

nicodjimenez3• 7 years ago

China is setting an example here that intellectual property laws are to be taken seriously. It's not clear whether this particular case was intentional or not, but in general greater IP protection in China is definitely a good thing.

bovermyer2• 7 years ago

If you think jailing someone for a mistake is a good thing, then you have some serious humanity issues that you need to work on.

nicodjimenez3• 7 years ago

Well it all depends on severity of the mistake. If you run someone over with a car, even if it was an accident, ther need to be consequences.

Veen• 7 years ago

You can be sent to jail for a mistake if it was caused by negligence.

gnode2• 7 years ago

Except they don't believe it was a mistake; they go as far as calling it "hacking". That the accused claims it was a mistake means little.

sdinsn• 7 years ago

Did you not read the article?

nicodjimenez3• 7 years ago

I did read it, it just wasn’t clear to me if it really was just an accident.

Rebelgecko2• 7 years ago

That's pretty lame, especially considering DJI's abysmal security practices.

For the Phantom 2, I think the root password to ssh into the drone was something like "12341234". For the Phantom 3, they make it more secure by upgrading the password to "Big~9China".

bitL3• 7 years ago

Do you know one for Phantom 4? I'd like to adjust maximal allowed elevation (the hard limit gets in the way while shooting movies in mountains).

penagwin2• 7 years ago

Just curious, do you have any pictures from your drone at various heights? I don't have a gps/barometer on my drone yet and I'm curious how high say 300 ft looks like.

Rebelgecko2• 7 years ago

Don't know, sorry. It might be worth checking if that limit is enforced on the drone itself or the app. At least for the older drones, things like no fly zones around airports were only in the app. Messing with the firmware of the actual drone seemed nontrivial.

outworlder• 7 years ago

Why aren't we questioning the fact that there were secrets stored in Git? This is terrible security practice, and this fallout is exactly the kind of issues we should expect to happen as consequence.

Chinese dev jailed and fined for posting DJI's private keys on GitHub

Related Stories