LC-2 · Software Danger Reports

LrrK Kinematic Software Danger Report

# LrrK Kinematic Software Danger Report

**LRRK Watch / Software Assurance** — Monthly filing.

| Field | Value |
| --- | --- |
| Collection cutoff | 31 May 2020 |
| Platform | Quiet Systems |
| Series | DKSR-M-2020-05 |
| Status | short |
| Data label | Open-source intelligence // LRRK analytic product |
| Handling | Public-source material. Retrospective monthly. Image rights require separate verification before publication. |

## Executive read

### BLUF

River Loop’s Mimo/Osmo writeup is about a camera companion app, not a flight controller. MobTech identifier collection is the prior public record Synacktiv later cites for GO 4.

### Key judgments

1. **[Assessment — High confidence]** Blog dateline 12 May 2020. Product is DJI Mimo with Osmo cameras.
2. **[Assessment — High confidence]** This is payload-adjacent, not a drone C2 CVE.
3. **[Inference — Moderate confidence]** Same SDK family reappears on GO 4 in July.

### Analytic labels

- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades

- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution

## 01. River Loop: DJI Mimo / Osmo MobTech telemetry

*Event / publication dates: 12 May 2020*

| Field | Value |
| --- | --- |
| Component | software |
| Product | DJI Mimo Android/iOS with DJI Osmo action cameras |
| CVE / advisory | no CVE |
| Patch | partial later on GO 4 (MobTech removed by 4.3.36 per Synacktiv); this post is about Mimo |
| Exploit status | public writeup |
| Taxonomy | OWASP IoT I3 · I6 · I7 |

**Verified record — [Fact — A1] https://riverloopsecurity.com/blog/2020/05/dji_mimo/**

**Exposure.** Camera/payload companion app sending identifiers on weak or cleartext channels.

**Intelligence assessment.** [Assessment — High confidence] Date and product. [Inference — Moderate confidence] Prior record for the July GO 4 MobTech finding.

**Opportunity.** Passport camera apps separately from the aircraft GCS.

**LRRK relevance.** Sense (payload identity). Watch GO 4.

**Confidence.** High.

## Forward indicators

1. Synacktiv/GRIMM GO 4 (23 July 2020).

> **Collection integrity.** Camera app, kept because it sits on the DJI payload/GCS SDK path. Not padded. No exploit steps.

*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C2</span></p>