Independent cyber audit finds zero malware or backdoors in DJI drones — U.S. firm's hardware analysis challenges FCC ban amid ongoing $1.56 billion legal battle

News
By published

The same firm that inspects TikTok's U.S. platform found zero critical, high, or medium-risk issues across five months of testing.

DJI drone flying
(Image credit: Shutterstock)

DJI has published the results of an independent security assessment by U.S. cybersecurity firm OnDefend, which tested the DJI Air 3S consumer drone and Matrice 4E enterprise drone over five months and reported zero critical, high, or medium-risk findings. OnDefend also found no evidence of data being transmitted outside the U.S., no hidden backdoors, and no successful attempts to hack or tamper with either aircraft. The audit comes as DJI pursues a Ninth Circuit lawsuit against the FCC over the agency's decision last December to ban all new foreign-made drones from receiving U.S. equipment authorization, a move DJI claims will cost it $1.56 billion this year.

The ban took effect after a government-mandated national security review of DJI's products failed to begin before the December 2025 deadline; DJI initiated the OnDefend engagement in October on its own, whose team includes former U.S. military and government cybersecurity professionals.

The firm tested both drones across software, hardware, firmware, and radio frequency, including man-in-the-middle attack simulations and physical teardowns. OnDefend bought the test units independently: the Air 3S from a retail channel and the Matrice 4E from dealer inventory, both without DJI's involvement in the selection process.

Latest Videos From

The assessment identified 10 low-risk findings, including weak TLS protocols in the companion app and authentication tokens in URLs. OnDefend described these as consistent with standard practices for complex embedded systems, and DJI said it’s addressing them through firmware updates. OnDefend also recommended ongoing testing of future firmware, software updates, and hardware revisions, acknowledging that the audit represents a snapshot of two products at one point in time.

OnDefend is one of the independent security inspectors appointed by TikTok's U.S. Data Security division in June 2024 to perform continuous penetration testing of that platform. The audit of DJI means the firm has now inspected two Chinese-owned technology companies facing active U.S. national security proceedings.

While DJI maintains that the OnDefend audit was conducted independently, DJI did authorize and pay for it, and the overall arrangement differs from a government-directed review, which would have been conducted under federal oversight with no financial relationship to the subject.

DJI sued the FCC back in February, arguing the Covered List designation violated the U.S. Constitution. In an April court filing, DJI disclosed that the FCC had revoked authorizations for 14 existing products and that 25 planned 2026 launches can’t reach the U.S. market. Chinese customs data reported by Nikkei Asia show monthly civilian drone exports to the U.S. have fallen 60% to 70% year-on-year since December.

Google Preferred Source

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.

Luke James
Luke James
Contributor

Luke James is a freelance writer and journalist.  Although his background is in legal, he has a personal interest in all things tech, especially hardware and microelectronics, and anything regulatory. 

13 Comments Comment from the forums
  • PEnns
    Makes you wonder what research or evidence our government relied on when declaring this product (and others) a "National Security Threat".
    Reply
  • helper800
    PEnns said:
    Makes you wonder what research or evidence our government relied on when declaring this product (and others) a "National Security Threat".
    Obviously none at all. Top down vibes based governance from the current administration in all things as per usual.
    Reply
  • chaos215bar2
    PEnns said:
    Makes you wonder what research or evidence our government relied on when declaring this product (and others) a "National Security Threat".
    DJI was called a threat by default, because the government never actually did the audit required by law within the necessary timeframe. Presumably they were worried it wouldn't turn up whatever they were looking for.
    Reply
  • Notton
    I'm not saying there's a pattern, but usually some rich guy will complain to the white house, and a few days later said things get banned.
    be it DJI, routers, or a cross-border bridge.
    Reply
  • JakobePaulobe
    Notton said:
    I'm not saying there's a pattern, but usually some rich guy will complain to the white house, and a few days later said things get banned.
    be it DJI, routers, or a cross-border bridge.
    In this case it was largely thanks to lobbying efforts by Skydio and their ceo Adam Bry, who went out of his way to get as much of Skydio's competiton in the US eliminated by regulatory action as possible, while simultaneously pulling out of the consumer market. For someone who's supposedly a "drone enthusiast", Adam Bry really doesn't seem to want anyone else to be able to fly drones. Classic ladder pulling.
    Reply
  • endocine
    Well there is this though : "While DJI maintains that the OnDefend audit was conducted independently, DJI did authorize and pay for it, and the overall arrangement differs from a government-directed review, which would have been conducted under federal oversight with no financial relationship to the subject."

    That's about the same as a major pharma company funding a study on a new drug. Doesn't mean it isn't valid, but uh....
    Reply
  • USAFRet
    JakobePaulobe said:
    In this case it was largely thanks to lobbying efforts by Skydio and their ceo Adam Bry, who went out of his way to get as much of Skydio's competiton in the US eliminated by regulatory action as possible, while simultaneously pulling out of the consumer market. For someone who's supposedly a "drone enthusiast", Adam Bry really doesn't seem to want anyone else to be able to fly drones. Classic ladder pulling.
    And I was right on the edge of buying a Skydio when they pulled out of the consumer market.
    Like...days edge.
    Reply
  • PEnns
    Notton said:
    I'm not saying there's a pattern, but usually some rich guy will complain to the white house, and a few days later said things get banned.
    be it DJI, routers, or a cross-border bridge.

    Actually, it has become a pattern!!

    Plenty of rich guys / Tech Bros with deep pockets deciding what is "good AND SAFE for the country"...for quite a while now.
    Reply
  • Mindstab Thrull
    endocine said:
    Well there is this though : "While DJI maintains that the OnDefend audit was conducted independently, DJI did authorize and pay for it, and the overall arrangement differs from a government-directed review, which would have been conducted under federal oversight with no financial relationship to the subject."

    That's about the same as a major pharma company funding a study on a new drug. Doesn't mean it isn't valid, but uh....
    Except that's the same kind of process so many other companies go through for their products: "we need <X> tested for <Y> so we'll call up known company <Z> who tests these things and go through their process to make sure we're good."
    We can be cynical about it, but sometimes it's as simple as "run the tests you'd run anyways" - and also, the versions of the products bought were off the shelf, not supplied by DJI. All OnDefend has to do is say "we ran our regular tests and published the results, all DJI did was pay for them." Otherwise we couldn't trust any testing organization who gets the products supplied and/or methodology financed by the company being tested.

    Mindstab Thrull
    Reply
  • endocine
    Mindstab Thrull said:
    Except that's the same kind of process so many other companies go through for their products: "we need <X> tested for <Y> so we'll call up known company <Z> who tests these things and go through their process to make sure we're good."
    We can be cynical about it, but sometimes it's as simple as "run the tests you'd run anyways" - and also, the versions of the products bought were off the shelf, not supplied by DJI. All OnDefend has to do is say "we ran our regular tests and published the results, all DJI did was pay for them." Otherwise we couldn't trust any testing organization who gets the products supplied and/or methodology financed by the company being tested.

    Mindstab Thrull
    Its a potential conflict of interest
    Reply