Drone jailbreaking: Russian website sells DJI Phantom hack to remove vital safety features

A Russian website is selling modified hardware and software which removes the safety limits of DJI Phantom and Mavic drones. The hacks lift speed and altitude limits, and even disables a geofencing system designed to keep drones away from no-go sensitive locations like airports and their runways.

The company, called CopterSafe and operating through a second website called SkyHack, includes videos on its site of customers flying their drones at speeds and altitudes not permitted by DJI's own software.

One shows a Mavic drone climb vertically at 22mph (as opposed to the usual 7mph) to a height of over 2,000 feet, far exceeding the 1600 feet limit imposed by DJI. An image shows a drone flying at 5,600ft over Moscow

CopterSafe's website, translated into English, states: "We deeply understand the mechanisms" of DJI's technology, allowing the company "to remove many restrictions...so you can use the techniques in full force."

This means customers of the hacking tools can, according to CopterSafe:

• Disable no-fly zone restrictions
• Disable height restrictions
• Remove temperature limits, which stop the drone starting when the battery is below -12 degrees celsius
• Remove restrictions on descent and ascent speed
• Roll back to older firmware
• Use non-original batteries
• Remove tighter European rules on power and flight range

Although increasing the speed is likely to cause amateur pilots some control issues, it is the removal of DJI's geofencing system which is most concerning. Unmodified, this stops drones from being flown close to airports or other sensitive areas like city centres. The system is in place to prevent drones getting too close to, and potentially striking, commercial aircraft as they approach airport runways.

CopterSafe offers several modifications on its website, ranging from $200 (£160) for removing the 500 metre altitude limit of the DJI Mavic, to custom circuit boards for the DJI Phantom which cost $550 and remove the no-fly zone, altitude and speed limits.

Law-abiding DJI pilots, in some circumstances, can apply to have the geofencing system temporarily switched off, in situations where they have gained permission from the owner of the airfield, for example.

Speaking to Motherboard, the company defended itself: "It is very good that DJI makes a lot of effort about safety, but I think that limitations should be set according to local laws."

Christian Struwe, head of European public policy at DJI, said in a statement: "DJI strongly discourages any attempt to defeat our safety systems, which are advisory and intended to facilitate compliance and safe operations by the average responsible person. Disabling such features may inadvertently disable others and cause unpredictable behaviour. We will not provide warranty repairs on a product that has been damaged because of tampering."