web analytics

Researcher: DJI RCE-holes offered me $500 after I found Heartbleed etc on its servers

Keep your money, says chap (tho Chinese drone firm did patch ’em right quick)

 

28th November 2017 By Gareth Corfield

 

 

Hello, this is 2014 calling, we’ve resurrected an OLD bug
 

Updated Chinese drone-maker DJI’s bug bounty programme has been struck with fresh controversy after a security researcher claimed he was offered just $500 for reporting, among others, the years-old Heartbleed vulnerability.

 

Infosec chap Sean Melia – no stranger to bug bounty programmes – said he discovered that DJI’s servers not only had not been patched against Heartbleed, the OpenSSL bug revealed in 2014, but were also vulnerable to SQL code injection attacks and remote code execution with root privileges.

 

Full Article.

Take a look at the best antivirus, anti-malware, anti-spy, etc. software

Powered by WPeMatico