DJI Pays $30K for Romo Robot Hack

🔑 Enhanced Key Takeaways

• •Azdoufal used Anthropic’s Claude Code AI to reverse-engineer the DJI Romo’s communication protocol without bypassing encryption or hacking DJI systems.[1][2][3]
• •The vulnerability stemmed from DJI’s MQTT message broker lacking topic-level access controls, allowing plaintext access to data from other devices after authenticating with one token.[3]
• •DJI’s Power portable battery stations, sharing the same MQTT infrastructure, were also accessible through the flaw.[3]
• •DJI initially claimed the flaw was fixed a week prior, but Azdoufal demonstrated thousands of robots still vulnerable during a live demo with a journalist.[3]

🛠️ Technical Deep Dive

• •DJI Romo communicates with servers via MQTT protocol without topic-level access controls, storing device data (floor plans, live video, microphone input) in plaintext.[1][3]
• •Authentication with a single device's private token granted access to traffic from ~7,000 vacuums and Power battery stations across 24 countries.[2][3]
• •TLS encryption protected connections but not stored data content; remaining issues include PIN bypass for camera streams.[1][3]

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline