Connect with us

Technology

We went to 10 anti-Tesla protests — and a couple counter protests, too

Published

on

We went to 10 anti-Tesla protests — and a couple counter protests, too

Thousands of anti-Tesla protesters took to the streets Saturday March 29th in opposition to Elon Musk and his efforts with DOGE to eliminate humanitarian aid, close federal agencies, and fire government workers. It was the culmination of nearly two months of steady, almost daily demonstrations aimed at hurting Tesla’s sales — and ultimately Musk himself. Today was billed as a “Global Day of Action” with protests targeting hundreds of Tesla locations in the US, Canada, and Europe.

The Verge wanted to check the temperature and see how these protesters were thinking about this current moment, and whether they felt their boycott was having its desired effect. Tesla sales have slid significantly since the protests started, and its stock has shed a lot of its value. But Musk shows no signs of being deterred, as he ramps up his threats to sic the government on anti-Tesla forces.

London, March 29th, 2025.
Photo: Dominic Preston / The Verge

So we fanned out across the globe, from London to New York to Washington, DC to Los Angeles — and Paramus, NJ and Akron, Ohio too — to observe the movement as it enters it third month and talk to the people who opted to spend a good chunk of a Saturday afternoon waving signs and shouting about Musk and Tesla. We even saw several counter protesters who came out to support Musk — and Tesla.

London’s Tesla Takedown protest was a small affair, with 50-odd protestors, one dinosaur, and an inflatable Elon making that salute all perched outside a Tesla showroom in Park Royal, a neighborhood otherwise dominated by big box retailers, self-storage units, and ghost kitchens. But it’s come a long way since its humble beginnings six weeks ago, when it was just two protestors getting “kicked out of the Westfield shopping mall by security,” according to organizer John Gorenfeld.

Advertisement
A protest on the side of a road in London.

A protest on the side of a road in London.
Photo: Dominic Preston / The Verge

Gorenfeld is a Californian, but this protest was English to a fault: polite, peaceful, and a little quiet. There was no police presence, and nor was one needed; even a Tesla pulling in didn’t attract much ire from the crowd. Fortunately, passing drivers were there to provide the noise — a “Honk If You Hate Elon” sign was answered by a chorus of cars, trucks, and at least one city bus. Londoners may not have come out in force, but it’s pretty clear where the city’s sympathies lie.

On a busy shopping street in Georgetown, DC, protesters are dancing outside a Tesla showroom to everything from “Hot to go,” to “Under Pressure,” to the viral TikTok hostile takeover song. They’re wearing a mix of shiny boas, boat captain hats, and floral shirts. The loosely boat-themed dance party has been attracting a steady stream of honks from passing cars, and many pedestrians are stopping to gleefully take pictures. “Nazi cars sold here,” says one sign, “Porsche = fast, Ferrari = faster, Tesla = fascist,” says another.

A protest in Georgetown, DC.

A protest in Georgetown, DC.
Photo: Lauren Feiner / The Verge

“Part of how fascism operates is they want people to be fearful,” says Sara Steffens, part of a team that calls themselves Dance Against DOGE. Steffens dons a floral outfit and a captain’s hat that she says symbolizes how the people are in charge of their destiny, rather than Trump and Musk. “Bullies operate on fear and they want us to be afraid of them … so this is like a full force showing.”

The mix of attendees appears to span many ages, and one of the groups rallying older generations to get involved is Third Act. Mark, an attendee affiliated with Third Act who declined to give his last name, said it was important to be at the protest “as someone with two grandchildren, trying to do something so that they can grow up in a place that’s safe.”

Protesters gather to rally during a Tesla Takedown, a nationwide peaceful protest movement, at a Tesla Showroom in the Coral Gables neighborhood in Miami.

Protesters gather to rally during a Tesla Takedown, a nationwide peaceful protest movement, at a Tesla Showroom in the Coral Gables neighborhood in Miami.
Photo by Eva Marie Uzcátegui / The Verge

Cruise down Route 17 in north New Jersey and you’ll see a ton of car dealerships. But for the past few weeks, none have seen quite as much action as the Tesla dealership near Paramus. Each weekend, protestors of all ages have been holding up signs at the side of the highway, encouraging drivers to sell their Teslas, dump their stock, and honk against fascism. Today, the vibe is a little different.

Advertisement

The pro-Trumpers are here too — and the lines are clearly drawn.

“Last week, it was just us here,” says Ethan, a protester wearing a Super Mario Bros. Luigi cap and holding a sign that reads “Cyberfucked.” “Now all these Trump guys are here, walking around, doing whatever they want.”

Ethan, who declined to give his last name, says he’s been hassled by the Trump and Musk supporters. They’ve called him slurs, thrown water at him, and tried to grab his sign before a fellow protestor calmed the situation down. He says one Trump supporter told him his Luigi hat was offensive to Italian Americans. When I ask Ethan why he’s here today, he says “Because I fucking hate Elon Musk.” Then after a bit of thought, he adds, “We’re kind of screwed. It might not be much, but I want to at least say something and be heard by someone.”

Counterprotestors in New Jersey.

Counterprotestors in New Jersey.
Photo: Victoria Song / The Verge

On the other side, the Trump camp isn’t as concerned about holding up signs. They’re more milling about, grouping off into mini clusters. (They do, however, have many signs that read “Thank you Elon” and “Trump won.”) When I ask to speak to the organizer, I’m directed to John Tabacco — who wears a light blue blazer with prints of President Trump’s face.

“We need to show that there is support for what Elon Musk and DOGE is doing,” Tabacco says. He also takes issue when I characterize the pro-Trump crowd as a counterprotest. “This is a rally for us. A support rally for Trump, DOGE, and America-first policies. And I think those people,” he says, pointing to the anti-Tesla group, “Those people showed up today as counter-protesters.”

Advertisement

Tesla service center here is closed on weekends. It’s just off Route 18, at an intersection that services a shopping center with a Home Depot, Chick-fil-A, a local bar chain called The Winking Lizard, and more. The turnout is surprising, about 40-50 people (and two very good dogs) are lined up on both sides of the street waving signs and ringing cowbells. There’s a man with a bullhorn rousing the crowd with slogans, “When immigrants are under attack, what do we do?” he yells. “Fight back!” The crowd responds.

There’s a variety of people here, including a lot more gray and white hair folks using scooters and wheelchairs. A woman in a high-visibility vest said she and a lot of the older people here came on behalf of Third Act Ohio, an activist group for folks over 60. It’s hard to hear her as people continuously drive by, honking their horns in support.

Arriving 20 minutes before the event, it was quiet, even though organizers were expecting the crowd to be large, with last week’s attendance estimated around 1,300. They were right. Within ten minutes the plaza was full of attendees with a diversity of signage ranging from “Deport Elon Musk”, “Stop the Attack on Democracy”, “Hands off our Social Security” plus many others.

Photo by Victoria Barrios / The Verge

Even though the crowd is large, organizers emphasize their message over the speakers; this is a peaceful non-violent protest. This is similar to what one of the organizers told me as well, “Despite what the administration is saying, we’re not domestic terrorists, we are absolutely peaceful, nonviolent, we provide guidance and say no harassment of the Tesla showroom. We just want to make our voices heard.”

Photo by Victoria Barrios / The Verge

Alice Grimm said this is about bringing down the power of the billionaire. “From Elon Musk’s perspective, any dollar that doesn’t go to him is wasted and efficiency is whatever fills his pocket. And so Tesla, where most of his wealth is, if what he cares about is that element, then trying to drive down the stock price of Tesla, that attacks Elon’s power.”

Advertisement

Long Beach and Lakewood, California:

“I was on my way to another anti-Elon protest,” a woman named Nati said, while holding two signs at a Supercharger location in Lakewood. “I had to stop here when I saw everyone out.”

As Tesla owners pulled in and out, around 100 people stood on the sidewalk protesting. Most Tesla owners remained in their cars or went into nearby stores, largely avoiding the large crowd chanting, “This is what Democracy looks like,” and waving at passing cars that honked in support.

A man who asked to be identified as Sam set up a folding table and sold anti-Musk and Trump goods to passersby, though most at the Supercharger had brought their own homemade signs and wore shirts with “Gulf of Mexico,” and “Biden Harris,” emblazoned on them.

“I was on my way to another anti-Elon protest. I had to stop here when I saw everyone out.”

Advertisement

At a Tesla dealership a few miles away, in Long Beach, around 250 people lined the sidewalks on both sides of a busy four-lane road near a Home Depot and Costco that is packed on the weekends. As drivers drove past, people honked, cheered, and pumped their fists out their car windows, showing support.

The protests in Long Beach were peaceful, with protestors remaining on public property, cheering as people honked in support, but a tiny number of Trump and Musk supporters did show up to troll the crowds.

At the Supercharger location, a family decided to engage the protesters, yelling that they were “stupid. ” Their young daughter, who looked to be around ten years old, screamed profanities at the protesters. A pair of police SUVs were parked across the street, keeping an eye on things, and one lone Musk supporter lingered nearby holding a sign thanking Musk.

An anti-Tesla protester who asked not to be identified said that she’d been at another protest in Long Beach in late February when a truck driver rolled down his window and tried to pepper spray the protesters. No one was hurt, but the woman said that it did concern her. “You just don’t know how people are going to respond to exercising your right to free speech,” she said.

Hundreds of protesters marched and chanted in front of a Tesla showroom in the Meatpacking District in New York City. The mood was lively and enthusiastic as protesters waved signs, danced in flaming cardboard Cybertruck costumes, and smashed toy cars on the sidewalk with a hammer. A moment of silence was held for a large portion of the crowd to lay down on the street with cardboard signs shaped like gravestones to stage a “die in” in front of the Tesla showroom.

Advertisement
A protest in the Meatpacking District in New York City.

A protest in the Meatpacking District in New York City.
Photo: Owen Grove / The Verge

The protest was peaceful but there were two separate instances where protesters started shouting out for others not to engage with two men holding out microphones and asking questions. In the second instance of this, police that were surrounding the building came over to prevent one of these interviewers from engaging with the protesters. The man being escorted out of the crowd still held a microphone, walked backwards smiling and said “crackhead, come here” gesturing towards one of the protesters for an interview.

New York City.

New York City.
Photo: Owen Grove / The Verge

Slogans on signs varied in intensity. One sign depicted Elon Musk dressed as Emperor Palpatine that read, “Strike down Darth Ketamine, Congress must!!!” Another banner held by a group of three protesters read, “Burn A Tesla Save Democracy.”

Aside from some raised voices, there weren’t any violent altercations. The turnout at this protest was about three times larger than the protest at the same location a week earlier. As the protest neared its end there were chants of “we’ll be back” from the crowd. They were ready to come back for more.

Technology

Jikipedia turns Epstein’s emails into an encyclopedia of his powerful friends

Published

on

Jikipedia turns Epstein’s emails into an encyclopedia of his powerful friends

The folks behind Jmail are at it again with a clone of Wikipedia that turns the treasure trove of data in Epstein’s emails into detailed dossiers on his associates. Entries include known visits to Epstein’s properties, possible knowledge of Epstein’s crimes, and laws that they might have broken. The reports are dense, listing how many emails they exchanged with Epstein, basic biographical information, and details about how they’re connected.

Beyond that, there are entries for the properties Epstein owns, detailing how they were acquired and the alleged activities that took place there. There are also entries for his business dealings, including his relationship with JPMorgan Chase.

It is worth noting that the entries are AI-generated. While a casual glance seems to suggest Jikipedia is citing its sources, it’s still possible (if not likely) that there are some inaccuracies contained within them. The Jmail X account said that they’ll be implementing the ability for users to report inaccuracies and request changes soon.

Continue Reading

Technology

Android malware hidden in fake antivirus app

Published

on

Android malware hidden in fake antivirus app

NEWYou can now listen to Fox News articles!

If you use an Android phone, this deserves your attention. 

Cybersecurity researchers warn that hackers are using Hugging Face, a popular platform for sharing artificial intelligence (AI) tools, to spread dangerous Android malware. 

At first, the threat appears harmless because it is disguised as a fake antivirus app. Then, once you install it, criminals gain direct access to your device. Because of this, the threat stands out as especially troubling. It combines two things people already trust — security apps and AI platforms.

Sign up for my FREE CyberGuy Report

Advertisement

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

MALICIOUS GOOGLE CHROME EXTENSIONS HIJACK ACCOUNTS

Researchers say hackers hid Android malware inside a fake antivirus app that looked legitimate at first glance.  (Kurt “CyberGuy” Knutsson)

What Hugging Face is and why it matters

For anyone unfamiliar, Hugging Face is an open platform where developers share AI, NLP and machine learning models. It is widely used by researchers and startups and has become a central hub for AI experimentation. That openness is also what attackers exploited. Because Hugging Face allows public repositories and supports many file types, criminals were able to host malicious code in plain sight.

The fake antivirus app behind the attack

The malware first appeared in an Android app called TrustBastion. On the surface, it looks like a helpful security tool. It promises virus protection, phishing defense and malware blocking. In reality, it does the opposite. 

Advertisement

Once installed, TrustBastion immediately claims your phone is infected. It then pressures you to install an update. That update delivers the malicious code. This tactic is known as scareware. It relies on panic and urgency to push users into tapping before thinking.

FAKE ERROR POPUPS ARE SPREADING MALWARE FAST

The fake TrustBastion app mimics a legitimate Google Play update screen to trick users into installing malware.  (Bitdefender)

How the malware spreads and adapts

According to Bitdefender, a global cybersecurity company, the campaign centers on a fake Android security app called TrustBastion. Victims were likely shown ads or warnings claiming their device was infected and were instructed to manually install the app.

The attackers hosted TrustBastion’s APK files directly on Hugging Face, placing them inside public datasets that appeared legitimate at first glance. Once installed, the app immediately prompted users to install a required “update,” which delivered the actual malware.

Advertisement

After researchers reported the malicious repository, it was taken down. However, Bitdefender observed that nearly identical repositories quickly reappeared, with small cosmetic changes but the same malicious behavior. That rapid re-creation made the campaign harder to fully shut down.

What this Android malware can actually do

This Trojan is not minor or annoying. It is invasive. Bitdefender says the malware can:

Take screenshots of your device

Show fake login screens for financial services

Capture your lock screen PIN

Advertisement

Once collected, that data is sent to a third-party server. From there, attackers can move quickly to drain accounts or lock you out of your own phone.

What Google says about the threat

Google says users who stick to official app stores are protected. A Google spokesperson told CyberGuy, “Based on our current detection, no apps containing this malware are found on Google Play.

“Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.

“Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play.”

BROWSER EXTENSION MALWARE INFECTED 8.8M USERS IN DARKSPECTRE ATTACK

Advertisement

Once installed, the malware could capture screenshots, fake login details and even your lock screen PIN. (Kurt “CyberGuy” Knutsson)

How to stay safe from Hugging Face Android malware

This threat is a reminder that small choices matter. Here is what you should do right now:

1) Stick to trusted app stores

Only download apps from reputable sources like Google Play Store or the Samsung Galaxy Store. These platforms have moderation and scanning in place.

2) Read reviews before installing

Look closely at ratings, download counts and recent comments. Fake security apps often have vague reviews or sudden rating spikes.

3) Use a data removal service

Even careful users can have personal data exposed. A data removal service helps remove your phone number, email and other details from data broker sites that criminals rely on. That reduces follow-up scams, fake security alerts and account takeover attempts.

Advertisement

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. 

These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

4) Run Play Protect and use strong antivirus software

Scan your device regularly with Play Protect and back it up with strong antivirus software for added protection. Google Play Protect, which is built-in malware protection for Android devices, automatically removes known malware. However, it is important to note that Google Play Protect may not be enough. Historically, it hasn’t been 100% effective at removing all known malware from Android devices.

Advertisement

The best way to protect yourself against malicious links that install malware and potentially access your private information is to have strong antivirus software installed on all your devices. This protection can also help you detect phishing emails and ransomware, keeping your personal information and digital assets safe.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com

5) Avoid sideloading APK files

Avoid installing apps from websites outside the app store. These apps bypass security checks, so always verify the publisher name and URL.

6) Lock down your Google account

Your phone security depends on it. Enable two-step verification (2FA) first, then use a strong, unique password stored in a password manager to prevent account takeovers.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Advertisement

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com

7) Be cautious with permissions

Be cautious with accessibility permissions. Malware often abuses them to take control of your device.

8) Watch app updates closely

Malware can hide inside fake updates. Be cautious of urgent fixes that push you outside the app store.

Kurt’s key takeaways

This attack shows how quickly trust can be weaponized. A platform designed to advance AI research was repurposed as a delivery system for malware. A fake antivirus app became the threat it claimed to stop. Staying safe no longer means avoiding sketchy-looking apps. It means questioning even those apps that appear helpful and professional.

Have you seen something on your phone that made you question its security? Let us know your thoughts by writing to us at Cyberguy.com

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report 

Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

Copyright 2026 CyberGuy.com.  All rights reserved.

Advertisement
Continue Reading

Technology

The DJI Romo robovac had security so poor, this man remotely accessed thousands of them

Published

on

The DJI Romo robovac had security so poor, this man remotely accessed thousands of them

Sammy Azdoufal claims he wasn’t trying to hack every robot vacuum in the world. He just wanted to remote control his brand-new DJI Romo vacuum with a PS5 gamepad, he tells The Verge, because it sounded fun.

But when his homegrown remote control app started talking to DJI’s servers, it wasn’t just one vacuum cleaner that replied. Roughly 7,000 of them, all around the world, began treating Azdoufal like their boss.

He could remotely control them, and look and listen through their live camera feeds, he tells me, saying he tested that out with a friend. He could watch them map out each room of a house, generating a complete 2D floor plan. He could use any robot’s IP address to find its rough location.

“I found my device was just one in an ocean of devices,” he says.

A map like the one I saw, with robots and packets trickling in.
Image: Gonzague Dambricourt
Advertisement

On Tuesday, when he showed me his level of access in a live demo, I couldn’t believe my eyes. Ten, hundreds, thousands of robots reporting for duty, each phoning home MQTT data packets every three seconds to say: their serial number, which rooms they’re cleaning, what they’ve seen, how far they’ve traveled, when they’re returning to the charger, and the obstacles they encountered along the way.

I watched each of these robots slowly pop into existence on a map of the world. Nine minutes after we began, Azdoufal’s laptop had already cataloged 6,700 DJI devices across 24 different countries and collected over 100,000 of their messages. If you add the company’s DJI Power portable power stations, which also phone home to these same servers, Azdoufal had access to over 10,000 devices.

Azdoufal says he could remote-control robovacs and view live video over the internet.

Azdoufal says he could remote-control robovacs and view live video over the internet.

When I say I couldn’t believe my eyes at first, I mean that literally. Azdoufal leads AI strategy at a vacation rental home company; when he told me he reverse engineered DJI’s protocols using Claude Code, I had to wonder whether AI was hallucinating these robots. So I asked my colleague Thomas Ricker, who just finished reviewing the DJI Romo, to pass us its serial number.

With nothing more than that 14-digit number, Azdoufal could not only pull up our robot, he could correctly see it was cleaning the living room and had 80 percent battery life remaining. Within minutes, I watched the robot generate and transmit an accurate floor plan of my colleague’s house, with the correct shape and size of each room, just by typing some digits into a laptop located in a different country.

Here are two maps of Thomas’ living space. Above is what we pulled from DJI’s servers without authentication; below is what the owner sees on their own phone.
Screenshots by The Verge

Here’s a fuller floor plan from Gonzague Dambricourt, who tried out a read-only version of Azdoufal’s tool.
Image: Gonzague Dambricourt (X)

Separately, Azdoufal pulled up his own DJI Romo’s live video feed, completely bypassing its security PIN, then walked into his living room and waved to the camera while I watched. He also says he shared a limited read-only version of his app with Gonzague Dambricourt, CTO at an IT consulting firm in France; Dambricourt tells me the app let him remotely watch his own DJI Romo’s camera feed before he even paired it.

Advertisement

Azdoufal was able to enable all of this without hacking into DJI’s servers, he claims. “I didn’t infringe any rules, I didn’t bypass, I didn’t crack, brute force, whatever.” He says he simply extracted his own DJI Romo’s private token — the key that tells DJI’s servers that you should have access to your own data — and those servers gave him the data of thousands of other people as well. He shows me that he can access DJI’s pre-production server, as well as the live servers for the US, China, and the EU.

DJI has MQTT servers associated with the US, EU, and China. I’m not sure what VG stands for.

DJI has MQTT servers associated with the US, EU, and China. I’m not sure what VG stands for.
Screenshot by Sean Hollister / The Verge

Here’s the good news: On Tuesday, Azdoufal was not able to take our DJI Romo on a joyride through my colleague’s house, see through its camera, or listen through its microphone. DJI had already restricted that form of access after both Azdoufal and I told the company about the vulnerabilities.

And by Wednesday morning, Azdoufal’s scanner no longer had access to any robots, not even his own. It appears that DJI has plugged the gaping hole.

But this incident raises serious questions about DJI’s security and data practices. It will no doubt be used to help retroactively justify fears that led to the Chinese dronemaker getting largely forced out of the US. If Azdoufal could find these robots without even looking for them, will it protect them against people with intent to do harm? If Claude Code can spit out an app that lets you see into someone’s house, what keeps a DJI employee from doing so? And should a robot vacuum cleaner have a microphone? “It’s so weird to have a microphone on a freaking vacuum,” says Azdoufal.

It doesn’t help that when Azdoufal and The Verge contacted DJI about the issue, the company claimed it had fixed the vulnerability when it was actually only partially resolved.

Advertisement

“DJI can confirm the issue was resolved last week and remediation was already underway prior to public disclosure,” reads part of the original statement provided by DJI spokesperson Daisy Kong. We received that statement on Tuesday morning at 12:28PM ET — about half an hour before Azdoufal showed me thousands of robots, including our review unit, reporting for duty.

Not just robovacs — DJI’s power stations also use this system.

Not just robovacs — DJI’s power stations also use this system.
Screenshot by Sean Hollister / The Verge

To be clear, it’s not surprising that a robot vacuum cleaner with a smartphone app would phone home to the cloud. For better or for worse, users currently expect those apps to work outside of their own homes. Unless you’ve built a tunnel into your own home network, that means relaying the data through cloud servers first.

But people who put a camera into their home expect that data to be protected, both in transit and once it reaches the server. Security professionals should know that — but as soon as Azdoufal connected to DJI’s MQTT servers, everything was visible in cleartext. If DJI has merely cut off one particular way into those servers, that may not be enough to protect them if hackers find another way in.

Unfortunately, DJI is far from the only smart home company that’s let people down on security. Hackers took over Ecovacs robot vacuums to chase pets and yell racist slurs in 2024. In 2025, South Korean government agencies reported that Dreame’s X50 Ultra had a flaw that could let hackers view its camera feed in real time, and that another Ecovacs and a Narwal robovac could let hackers view and steal photos from the devices. (Korea’s own Samsung and LG vacuums received high marks, and a Roborock did fine.)

It’s not just vacuums, of course. I still won’t buy a Wyze camera, despite its new security ideas, because that company tried to sweep a remote access vulnerability under the rug instead of warning its customers. I would find it hard to trust Anker’s Eufy after it lied to us about its security, too. But Anker came clean, and sunlight is a good disinfectant.

Advertisement

DJI is not being exceptionally transparent about what happened here, but it did answer almost all our questions. In a new statement to The Verge via spokesperson Daisy Kong, the company now admits “a backend permission validation issue” that could have theoretically let hackers see live video from its vacuums, and it admits that it didn’t fully patch that issue until after we confirmed that issues were still present.

Here’s that whole statement:

DJI identified a vulnerability affecting DJI Home through internal review in late January and initiated remediation immediately. The issue was addressed through two updates, with an initial patch deployed on February 8 and a follow-up update completed on February 10. The fix was deployed automatically, and no user action is required.

The vulnerability involved a backend permission validation issue affecting MQTT-based communication between the device and the server. While this issue created a theoretical potential for unauthorized access to live video of ROMO device, our investigation confirms that actual occurrences were extremely rare. Nearly all identified activity was linked to independent security researchers testing their own devices for reporting purposes, with only a handful of potential exceptions.

The first patch addressed this vulnerability but had not been applied universally across all service nodes. The second patch re-enabled and restarted the remaining service nodes. This has now been fully resolved, and there is no evidence of broader impact. This was not a transmission encryption issue. ROMO device-to-server communication was not transmitted in cleartext and has always been encrypted using TLS. Data associated with ROMO devices, such as those in Europe, is stored on U.S.-based AWS cloud infrastructure.

DJI maintains strong standards for data privacy and security and has established processes for identifying and addressing potential vulnerabilities. The company has invested in industry-standard encryption and operates a longstanding bug bounty program. We have reviewed the findings and recommendations shared by the independent security researchers who contacted us through that program as part of our standard post-remediation process. DJI will continue to implement additional security enhancements as part of its ongoing efforts.

Advertisement

Azdoufal says that even now, DJI hasn’t fixed all the vulnerabilities he’s found. One of them is the ability to view your own DJI Romo video stream without needing its security pin. Another one is so bad I won’t describe it until DJI has more time to fix it. DJI did not immediately promise to do so.

And both Azdoufal and security researcher Kevin Finisterre tell me it’s not enough for the Romo to send encrypted data to a US server, if anyone inside that server can easily read it afterward. “A server being based in the US in no way, shape, or form prevents .cn DJI employees from access,” Finisterre tells me. That seems evident, as Azdoufal lives in Barcelona and was able to see devices in entirely different regions.

“Once you’re an authenticated client on the MQTT broker, if there are no proper topic-level access controls (ACLs), you can subscribe to wildcard topics (e.g., #) and see all messages from all devices in plaintext at the application layer,” says Azdoufal. “TLS does nothing to prevent this — it only protects the pipe, not what’s inside the pipe from other authorized participants.”

When I tell Azdoufal that some may judge him for not giving DJI much time to resolve the issues before going public, he notes that he didn’t hack anything, didn’t expose sensitive data, and isn’t a security professional. He says he was simply livetweeting everything that happened while trying to control his robot with a PS5 gamepad.

“Yes, I don’t follow the rules, but people stick to the bug bounty program for money. I fucking don’t care, I just want this fixed,” he says. “Following the rules to the end would probably make this breach happen for a way longer time, I think.”

Advertisement

He doesn’t believe that DJI truly discovered these issues by itself back in January, and he’s annoyed the company only ever responded to him robotically in DMs on X, instead of answering his emails.

But he is happy about one thing: He can indeed control his Romo with a PlayStation or Xbox gamepad.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Continue Reading

Trending