19 ms·

ABC News hacks into popular robot vacuum, watches owner through camera

316 points by puffl 2y ago

yawnxyz 2y ago
Does this mean they found an exploit in the Bluetooth mechanism? How were they able to pair with any protected bluetooth device (was hoping for more info on that)
- FredFS456 2y ago
  Technical details here https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecova...
- Quail4056 2y ago
  based on the slides, any device can pair with the robot. They implemented the security based on the payload, not the BLE protocol.
  - yawnxyz 2y ago
    that... sounds like a really terrible idea?! Even my JBL refuses to connect half the time
dikkechill 2y ago
I found the open source Valetudo (https://github.com/Hypfer/Valetudo https://github.com/Hypfer/Valetudo) project quite interesting, as it sits between the vendor firmware and (cloud) connectivity. The project is made possible due to Dennis Giese's research. It currently supports Dreame, Xiaomi, Roborock and some others. But not Ecovacs. And not sure it prevents this type of Bluetooth vulnerabilities.
- Tier3r 2y ago
  No truck on this robot vacuum race because I don't own one, but one an incredible name.
- FloatArtifact 2y ago
  I specifically shopped for vacuum using that website and it wasn't too bad to set up.
  - pkulak 2y ago
    Same. Had to spend a bunch of time on Telegram finding a breakout board in NA, but once I did that, it was just a matter of following directions. It’s my favorite piece of tech at the moment, and it cost me 180 bucks brand new.
    - matheusmoreira 2y ago
      The breakout board is the reason I haven't bought and hacked one of these robots yet. I have to source the PCB and then solder the components myself. I've never done this before and learning this is taking up significant amounts of my free time. Personally I would rather get a manufactured PCB that would no doubt be better built. I respect their "learn to solder" stance but it's a fact that a lot more people would be involved in the project if it wasn't required.
- xkcd-sucks 2y ago
  +1 for Valetudo, not only does it work, but it is also maintained and keeps getting better. Moreover old vacuums are still maintained as new ones are added
  - dugite-code 2y ago
    Yup, my first gen roborock is still trundling along quite happily because of Valetudo. Would be nice if the base ubuntu was updatable but as it's offline except for a connection to a homeassistant instance it's probably safer than 99% of IOT devices
- cassianoleal 2y ago
  For (some) Ecovacs, there's Bumper [0]. Not exactly the same as Valetudo but serves a similar purpose. [0] https://github.com/bmartin5692/bumper https://github.com/bmartin5692/bumper
- FredFS456 2y ago
  Dennis works closely with the Valetudo developer. On one of the Valetudo Telegram channels, they announced the following: > As you might know, we looked into Ecovacs as an alternative for Dreame&Roborock. However, we found security and privacy being completely broken. If you have a X2, a Goat lawnmower, or newer than 2023 devices, you might want to turn them off for now. There is a BLE RCE, that lets an unauthenticated attacker send a payload via Bluetooth, that gets executed as root on the device. It does not appear that Ecovacs wants to fix that. More information: https://twitter.com/lorenzofb/status/1822002515279270079 https://twitter.com/lorenzofb/status/1822002515279270079 https://techcrunch.com/2024/08/09/ecovacs-home-robots-can-be-hacked-to-spy-on-their-owners-researchers-say/ https://techcrunch.com/2024/08/09/ecovacs-home-robots-can-be...
- pj_mukh 2y ago
  Wow. Can Valetudo provide artificially blocked cloud features? For example the Roborock S5 doesn't have persistent maps, though it would be trivial to just keep one loaded in the cloud, but Roborock would rather you upgrade to an S7. Would that work?
  - darknavi 2y ago
    I have two Roborock S5s running Valetudo with persistent maps. Works well and integrates into Home Assistant.
    - pj_mukh 2y ago
      Amazing
    - jve 2y ago
      Someone advertise me why vacuum cleaner needs internet? I have xiaomi unit and I haven't connected it to an app, so it has no connectivity. It does it's job - cleans house 1st floor. Is it useful to target specific places to clean? Ok, that is a feature that would be useful but I can live without. Remotely starting? Fancy feature not sure I need - you can aswell start it when leaving the house. Maybe useful for some people when wanting to cleanup after guests remotely, but then again who knows what's dropped on floor there.
      - kaibee 2y ago
        > Someone advertise me why vacuum cleaner needs internet? It doesn't. And it isn't like hosting a web-portal is some kinda alien technology that can only be done in the cloud. There's absolutely no reason that a robot vacuum couldn't serve its own web interface.
  - Quail4056 2y ago
    Only v1 does not have persistent maps, as it is not supported by the firmware. Valetudo only supports whatever the firmware supports already.
- hedora 2y ago
  I have some modern (mapping) roombas laying around. Any idea what they could be useful for? If it involves vacuuming, mopping, or returning to their docks, they are pretty useless.
XorNot 2y ago
Huh I have an Ecovacs vacuum I hope this leads to a cloud cut exploit so I can run it locally. The biggest disappointment has been Tuya patched the exploits which let tuya-cloudcutter work without dismantling devices. I don't know how we do it, but I want a world where IoT is required to be independent of cloud and flashable.
- amatecha 2y ago
  You can check here: https://valetudo.cloud/pages/general/supported-robots.html https://valetudo.cloud/pages/general/supported-robots.html Uhhh, actually, I guess there aren't any Ecovacs models yet supported by Valetudo, unfortunately :\
gosub100 2y ago
Would there be a market for a VPN-style zeroconf networking "protocol" (that maybe sits on top of TCP) that would work with a yubikey and NFC? The effect would be that if you didn't, at some point, swipe the yubikey (or other token) on the IoS (internet of shit) device, and on the router/smart phone/PC, then you just get encrypted data. I think this would be intuitive to many people, physically touching the security wand on the devices you want to connect, and voila. Of course, this wouldn't work for the companies selling you this junk where they insert themselves and their paywall in between. I'm just wondering if TLS could be (ab)used for this use case.
stretchwithme 2y ago
[flagged]
- WheatMillington 2y ago
  Have you looked at the privacy record of some of the large US tech companies? Not exactly confidence inspiring. But carry on with the casual racism.
  - rd 2y ago
    Not everything is racism. This is xenophobia. Using words incorrectly takes away their meaning.
SoftTalker 2y ago
Reinforces my gut instinct that I don't want any of these "smart" devices in my home. Aside from being spys, it takes 10 minutes to vacuum the floor with a standard vaccum cleaner. I spent more time than that guiding the Roomba that we had, getting it unstuck from corners or wires, emptying its pitifully small dust cup, making sure all potential obstacles are picked up, etc. Chucked it in the trash after a month or so.
- WheatMillington 2y ago
  I love our robot vac. Not because it's faster or better than me, but because it's labour-free, and I can run it every day after the kids go to bed and have nice clean floors. However I also agree about not putting smart spy devices in my home - mine is a very basic cheap model with no cameras or wireless connectivity. Absolutely INSANE to have any type of connected camera inside your home. Even baby monitor cameras, such a huge vulnerability for so little utility.
  - Rebelgecko 2y ago
    My Roborock is probably the best <$500 purchase I've ever made. I'm actually tempted to get a fancier one with auto emptying just to avoid having to dump the bin once or twice a week
    - blakes 2y ago
      The auto-empty is absolutely worth it. If you want to be very thrifty, get an i7+ from eBay, or a refurbished J5/J7.
      - throwup238 2y ago
        It’s also indispensable if you have pets. Cat and dog hair fills the robot up fast.
        IG_Semmelweiss 2y ago
ta1243 2y ago
I don't do much "smart home" stuff, but could someone explain the value of allowing your vacuum cleaner talk to the internet? Does it use cloud resources to process stuff remotely like I believe Alexa does?
- insane_dreamer 2y ago
  I'm guessing it transmits telemetry to help the manufacturer improve the robot's spatial awareness algorithm (and images for the same reason), and users probably consent to this without realizing it when they "agree" to the 15-page TOS
  - ta1243 2y ago
    OK, I was going for value to the customer. Obviously selling your data to the highest bidder is a given nowadays.
- larrik 2y ago
  To control it via app. Scheduling and such.
  - ssl-3 2y ago
    Perhaps. But it has its own little robot brain, and I have a pocket supercomputer along with a LAN to connect betwixt these two things. I know that realtime clock modules are useful for scheduling and are not free, but that doesn't mean that a device needs to call home in order to start sweeping the floor at a particular time.
    - Loughla 2y ago
      Honestly I think you're overestimating most people. The concept of a LAN is a non-starter for many folks. My measure are my in-laws. They like technology but don't understand it. My mother in law does not know what LAN means or how to access it. These things phone home for the apps that lets normal people like that run them.
RomanUhliar 2y ago
It's literally the perfect house surveillance device though. Camera on a moving robot which is connected to a network, ha
- Scoundreller 2y ago
  Or a thing to get triggered whenever there's a suspected burglar. Doesn't even need to get it right all the time, just can't get it wrong. Nobody ever suspects the vacuum cleaner! Does anyone sell one that barks? Or makes it sound like 2-3 angry people are having a conversation about guns from different points of a room?
brcmthrowaway 2y ago
This is naked Australian government propaganda to make people fear China
LeoPanthera 2y ago
"popular robot vacuum" huh? I really hate clickbait headlines. I know about the HN rule to not change the title, but I really wish there was an exception for clickbait. It's an Ecovacs vacuum. Not an irobot, as most people were probably thinking.
- tredre3 2y ago
  iRobot had the same kind of issues with leaked camera photos. Sure, the distinction might help. But Roombas are in no way more secure/less intrusive.
- andrensairr 2y ago
  To be fair, the sharer may have just been quoting the ABC's own words. Clickbait is their MO of late, and their app is the worst for it. The website used to be better. EDIT: the link in the app phrases it "The world's largest home robotics company has a problem - its vacuum cleaners can be hacked from afar".
  - bigiain 2y ago
    The ABC News website (the Australian one) has been doing A/B testing on headlines for years. It's super common to see two or three different versions of the headline in the first hour or so after an article's publication, and then settle onto the presumably best click thru one. It used to show up pretty obviously when the url didn't match the headline, but I'm not sure if that's still true after their recent (awful) website redesign.
- the_gorilla 2y ago
  There should definitely be a clickbait exception to that. Sure, "YOU WON'T BELIEVE what robot vacuum ABC hacked" might be work better if you want an unaltered title, but it's objectively worse in every way.
- bdcravens 2y ago
  Could also be a Shark or a Roborock - both brands are also pretty popular Maybe it's just me, but when I hear "popular X" rather than a brand name or "the most popular X" I generally skip past the number one most likely option in my mind
JimTheMan 2y ago
As always, I am super proud of the Australian Broadcasting Corporation and their consistent balanced (for the most part) good work.
- magarnicle 2y ago
  A national treasure, but I've stopped reading their news in the last year due to the clickbait headlines.
FredFS456 2y ago
Link to Dennis's website with slides for a talk he did on this topic: https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecova...
textlapse 2y ago
Why is it that a smart device (robovacuum or proximity sensor etc) etc require the same technology as a streaming webcam? In other words, are there any HW-level privacy-preserving CCDs (for lack of a better word) that provide an image in a format that can't be snooped in? Like say, I need an 'image' that I use to detect certain objects - I don't really need a 1920x1080 24bit RGB image @ 30Hz? In fact, with such a mechanism, certain other metrics (performance, better object detection) could also improve in addition to privacy?
- teruakohatu 2y ago
  Some of them sell it as a feature and let you drive your robovac around like a FPV drone. Hardly worth the spying implications.
- gwbas1c 2y ago
  > that provide an image in a format that can't be snooped in There's no way to make information that can only be used in the way you want it to. I would assume that the image is handled in software: IE, the vacuum runs software that uses the image as one of its many inputs to decide where to steer the vacuum. Doing this as hardware-only is technically possible, but in practice, it's probably so difficult to implement it that way that it may be impractical. (For example, how can you remotely update the vacuum to fix a bug in the algorithm if it's burned into a chip?) Edit: I should point out that the vacuum is probably using a standard, off-the-shelf, camera part. They could consider figuring out how to blur the image (by manipulating the lens during manufacturing,) but I wouldn't make any assumptions about their algorithms to assert that this is practical.
  - textlapse 2y ago
    What I am talking about is a bit different: imagine if the CCD produced a non MxN color image. Maybe think of it as scrambled data that has just the right level of detail for the machine to do its thing but not something where you can get back the full color image via any means. I am not saying the actual CCD is different but it’s something akin to a filter between the HW and the rest of the system to prevent full color image access.
winrid 2y ago
Of course the researcher has to have htop open! Btw has anyone done an analysis of Bobsweep (Canadian company) vaca? They kind of position themselves now as "privacy focused".
roydivision 2y ago
Why is the device connected to the Internet? And why does it have a camera?
- andrei_says_ 2y ago
  I have an different model, but: Control of the device requires an iOS/android app and communication takes place via the internet. My model has a camera in order to map its surroundings. The app makes a map of the space, separated in rooms, and thus possible to request or schedule the cleanup of a specific room or zone. I often start the cleaning process while not at home.
- vultour 2y ago
  Because the morons making the product think you need to use it while away from home, which is also conveniently allowing them to send data to their servers all the time. I personally never do, so a bluetooth connection would be sufficient, but they don't give you a choice.
greenimpala 2y ago
I would love to upgrade my ten year old Roborock running Valetudo. But I'm not sure they've been able to figure out a way to root the new machines. I point blank refuse to have a computer on wheels with cameras and microphones roaming my house with a direct connection to China. It really blows my mind that the majority of people seem to think that's fine.
Jemm 2y ago
Why does a vacuum need a microphone?
w10-1 2y ago
As a refresher... These exploits promise to be the rule, not the exception -- and not (just) because this company might have to comply with its national imperatives. Assuming companies get paid for deploying hackable devices, it gives them an unfair competitive advantage relative to ethical companies (who would have higher prices). Given the information asymmetry (promoting the devices as simply reliable vs the difficulty and complexity of hacking them), this advantage is protectable. Thus if, or since, the market gives enduring advantages to this kind of exploitation, we can expect exploitation to be the rule, and product/technical leaders will be selected who comply. A key aspect (noted in the article) is the capture of technical standards organizations by the companies they monitor. Usually this is good (keeping standards more realistic, timely, and relevant). But that means one can't rely on those organizations to protect end users (whether business or consumer). The alternative of government politicized regulators would kill technology advancement, leading to a race to less-regulated jurisdictions (protected by fair-trade rules). The same is true of product liability schemes. So exploitation is the rule, and technology can't regulate itself or be regulated. Meanwhile, technology reaches into every aspect of work and play. Entrepreneurs who solve this problem would create tremendous value (yes, some of which could be captured).
elitistphoenix 2y ago
His homepage: https://dontvacuum.me/ https://dontvacuum.me/
killingtime74 2y ago
I specifically bought a robot vacuum with less sensors (no camera) for this reason. Why does it need camera if bump sensors and Lidar already works, it's asking for trouble.
- aaron695 2y ago
  [dead]
- dikkechill 2y ago
  How did you do your research and which one did you eventually buy?
  - iammiles 2y ago
    This sounds like the Roborock S series. I went with lidar over camera because it can run in any lighting condition and I don’t have a need for poop detection.
  - Rebelgecko 2y ago
    Not OP, but I'm a big fan of the Vacuum Wars YouTube channel (they have text summaries on their website too)
- MBCook 2y ago
  Some manufacturers use cameras instead of LiDAR (iRobot, for example). Others use both. LiDAR for walls, cameras for object identification below the LiDAR plane, directly in front of the robot. That’s how the fancy ones avoid socks or cables or other small things.
  - supportengineer 2y ago
    This might be OK for a vacuum cleaner, but nobody in their right mind would choose cameras over LiDAR for important applications.
    - NRv9tR 2y ago
ncr100 2y ago
Ecovacs notified in December 2023 > “Ecovacs has always prioritised product and data security, as well as the protection of consumer privacy,” they said in a statement. Still not fixed, today. Mobile Webcam exploit at 100 meters.
ChrisArchitect 2y ago
ABC Australia Title: We hacked a robot vacuum — and could watch live through its camera

316 points by puffl 2y ago

Does this mean they found an exploit in the Bluetooth mechanism? How were they able to pair with any protected bluetooth device (was hoping for more info on that)

FredFS456 2y ago
Technical details here https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecova...
Quail4056 2y ago
based on the slides, any device can pair with the robot. They implemented the security based on the payload, not the BLE protocol.
- yawnxyz 2y ago
  that... sounds like a really terrible idea?! Even my JBL refuses to connect half the time

dikkechill 2y ago

I found the open source Valetudo (https://github.com/Hypfer/Valetudo https://github.com/Hypfer/Valetudo) project quite interesting, as it sits between the vendor firmware and (cloud) connectivity. The project is made possible due to Dennis Giese's research. It currently supports Dreame, Xiaomi, Roborock and some others. But not Ecovacs. And not sure it prevents this type of Bluetooth vulnerabilities.

Tier3r 2y ago
No truck on this robot vacuum race because I don't own one, but one an incredible name.
FloatArtifact 2y ago
I specifically shopped for vacuum using that website and it wasn't too bad to set up.
- pkulak 2y ago
  Same. Had to spend a bunch of time on Telegram finding a breakout board in NA, but once I did that, it was just a matter of following directions. It’s my favorite piece of tech at the moment, and it cost me 180 bucks brand new.
  - matheusmoreira 2y ago
    The breakout board is the reason I haven't bought and hacked one of these robots yet. I have to source the PCB and then solder the components myself. I've never done this before and learning this is taking up significant amounts of my free time. Personally I would rather get a manufactured PCB that would no doubt be better built. I respect their "learn to solder" stance but it's a fact that a lot more people would be involved in the project if it wasn't required.
xkcd-sucks 2y ago
+1 for Valetudo, not only does it work, but it is also maintained and keeps getting better. Moreover old vacuums are still maintained as new ones are added
- dugite-code 2y ago
  Yup, my first gen roborock is still trundling along quite happily because of Valetudo. Would be nice if the base ubuntu was updatable but as it's offline except for a connection to a homeassistant instance it's probably safer than 99% of IOT devices
cassianoleal 2y ago
For (some) Ecovacs, there's Bumper [0]. Not exactly the same as Valetudo but serves a similar purpose. [0] https://github.com/bmartin5692/bumper https://github.com/bmartin5692/bumper
FredFS456 2y ago
Dennis works closely with the Valetudo developer. On one of the Valetudo Telegram channels, they announced the following: > As you might know, we looked into Ecovacs as an alternative for Dreame&Roborock. However, we found security and privacy being completely broken. If you have a X2, a Goat lawnmower, or newer than 2023 devices, you might want to turn them off for now. There is a BLE RCE, that lets an unauthenticated attacker send a payload via Bluetooth, that gets executed as root on the device. It does not appear that Ecovacs wants to fix that. More information: https://twitter.com/lorenzofb/status/1822002515279270079 https://twitter.com/lorenzofb/status/1822002515279270079 https://techcrunch.com/2024/08/09/ecovacs-home-robots-can-be-hacked-to-spy-on-their-owners-researchers-say/ https://techcrunch.com/2024/08/09/ecovacs-home-robots-can-be...
pj_mukh 2y ago
Wow. Can Valetudo provide artificially blocked cloud features? For example the Roborock S5 doesn't have persistent maps, though it would be trivial to just keep one loaded in the cloud, but Roborock would rather you upgrade to an S7. Would that work?
- darknavi 2y ago
  I have two Roborock S5s running Valetudo with persistent maps. Works well and integrates into Home Assistant.
  - pj_mukh 2y ago
    Amazing
  - jve 2y ago
    Someone advertise me why vacuum cleaner needs internet? I have xiaomi unit and I haven't connected it to an app, so it has no connectivity. It does it's job - cleans house 1st floor. Is it useful to target specific places to clean? Ok, that is a feature that would be useful but I can live without. Remotely starting? Fancy feature not sure I need - you can aswell start it when leaving the house. Maybe useful for some people when wanting to cleanup after guests remotely, but then again who knows what's dropped on floor there.
    - kaibee 2y ago
      > Someone advertise me why vacuum cleaner needs internet? It doesn't. And it isn't like hosting a web-portal is some kinda alien technology that can only be done in the cloud. There's absolutely no reason that a robot vacuum couldn't serve its own web interface.
- Quail4056 2y ago
  Only v1 does not have persistent maps, as it is not supported by the firmware. Valetudo only supports whatever the firmware supports already.
hedora 2y ago
I have some modern (mapping) roombas laying around. Any idea what they could be useful for? If it involves vacuuming, mopping, or returning to their docks, they are pretty useless.

XorNot 2y ago

Huh I have an Ecovacs vacuum I hope this leads to a cloud cut exploit so I can run it locally. The biggest disappointment has been Tuya patched the exploits which let tuya-cloudcutter work without dismantling devices. I don't know how we do it, but I want a world where IoT is required to be independent of cloud and flashable.

amatecha 2y ago
You can check here: https://valetudo.cloud/pages/general/supported-robots.html https://valetudo.cloud/pages/general/supported-robots.html Uhhh, actually, I guess there aren't any Ecovacs models yet supported by Valetudo, unfortunately :\

gosub100 2y ago

Would there be a market for a VPN-style zeroconf networking "protocol" (that maybe sits on top of TCP) that would work with a yubikey and NFC? The effect would be that if you didn't, at some point, swipe the yubikey (or other token) on the IoS (internet of shit) device, and on the router/smart phone/PC, then you just get encrypted data. I think this would be intuitive to many people, physically touching the security wand on the devices you want to connect, and voila. Of course, this wouldn't work for the companies selling you this junk where they insert themselves and their paywall in between. I'm just wondering if TLS could be (ab)used for this use case.

stretchwithme 2y ago

[flagged]

WheatMillington 2y ago
Have you looked at the privacy record of some of the large US tech companies? Not exactly confidence inspiring. But carry on with the casual racism.
- rd 2y ago
  Not everything is racism. This is xenophobia. Using words incorrectly takes away their meaning.

SoftTalker 2y ago

Reinforces my gut instinct that I don't want any of these "smart" devices in my home. Aside from being spys, it takes 10 minutes to vacuum the floor with a standard vaccum cleaner. I spent more time than that guiding the Roomba that we had, getting it unstuck from corners or wires, emptying its pitifully small dust cup, making sure all potential obstacles are picked up, etc. Chucked it in the trash after a month or so.

WheatMillington 2y ago
I love our robot vac. Not because it's faster or better than me, but because it's labour-free, and I can run it every day after the kids go to bed and have nice clean floors. However I also agree about not putting smart spy devices in my home - mine is a very basic cheap model with no cameras or wireless connectivity. Absolutely INSANE to have any type of connected camera inside your home. Even baby monitor cameras, such a huge vulnerability for so little utility.
- Rebelgecko 2y ago
  My Roborock is probably the best <$500 purchase I've ever made. I'm actually tempted to get a fancier one with auto emptying just to avoid having to dump the bin once or twice a week
  - blakes 2y ago
    The auto-empty is absolutely worth it. If you want to be very thrifty, get an i7+ from eBay, or a refurbished J5/J7.
    - throwup238 2y ago
      It’s also indispensable if you have pets. Cat and dog hair fills the robot up fast.
      - IG_Semmelweiss 2y ago

ta1243 2y ago

I don't do much "smart home" stuff, but could someone explain the value of allowing your vacuum cleaner talk to the internet? Does it use cloud resources to process stuff remotely like I believe Alexa does?

insane_dreamer 2y ago
I'm guessing it transmits telemetry to help the manufacturer improve the robot's spatial awareness algorithm (and images for the same reason), and users probably consent to this without realizing it when they "agree" to the 15-page TOS
- ta1243 2y ago
  OK, I was going for value to the customer. Obviously selling your data to the highest bidder is a given nowadays.
larrik 2y ago
To control it via app. Scheduling and such.
- ssl-3 2y ago
  Perhaps. But it has its own little robot brain, and I have a pocket supercomputer along with a LAN to connect betwixt these two things. I know that realtime clock modules are useful for scheduling and are not free, but that doesn't mean that a device needs to call home in order to start sweeping the floor at a particular time.
  - Loughla 2y ago
    Honestly I think you're overestimating most people. The concept of a LAN is a non-starter for many folks. My measure are my in-laws. They like technology but don't understand it. My mother in law does not know what LAN means or how to access it. These things phone home for the apps that lets normal people like that run them.

RomanUhliar 2y ago

It's literally the perfect house surveillance device though. Camera on a moving robot which is connected to a network, ha

Scoundreller 2y ago
Or a thing to get triggered whenever there's a suspected burglar. Doesn't even need to get it right all the time, just can't get it wrong. Nobody ever suspects the vacuum cleaner! Does anyone sell one that barks? Or makes it sound like 2-3 angry people are having a conversation about guns from different points of a room?

brcmthrowaway 2y ago

This is naked Australian government propaganda to make people fear China

LeoPanthera 2y ago

"popular robot vacuum" huh? I really hate clickbait headlines. I know about the HN rule to not change the title, but I really wish there was an exception for clickbait. It's an Ecovacs vacuum. Not an irobot, as most people were probably thinking.

tredre3 2y ago
iRobot had the same kind of issues with leaked camera photos. Sure, the distinction might help. But Roombas are in no way more secure/less intrusive.
andrensairr 2y ago
To be fair, the sharer may have just been quoting the ABC's own words. Clickbait is their MO of late, and their app is the worst for it. The website used to be better. EDIT: the link in the app phrases it "The world's largest home robotics company has a problem - its vacuum cleaners can be hacked from afar".
- bigiain 2y ago
  The ABC News website (the Australian one) has been doing A/B testing on headlines for years. It's super common to see two or three different versions of the headline in the first hour or so after an article's publication, and then settle onto the presumably best click thru one. It used to show up pretty obviously when the url didn't match the headline, but I'm not sure if that's still true after their recent (awful) website redesign.
the_gorilla 2y ago
There should definitely be a clickbait exception to that. Sure, "YOU WON'T BELIEVE what robot vacuum ABC hacked" might be work better if you want an unaltered title, but it's objectively worse in every way.
bdcravens 2y ago
Could also be a Shark or a Roborock - both brands are also pretty popular Maybe it's just me, but when I hear "popular X" rather than a brand name or "the most popular X" I generally skip past the number one most likely option in my mind

JimTheMan 2y ago

As always, I am super proud of the Australian Broadcasting Corporation and their consistent balanced (for the most part) good work.

magarnicle 2y ago
A national treasure, but I've stopped reading their news in the last year due to the clickbait headlines.

FredFS456 2y ago

Link to Dennis's website with slides for a talk he did on this topic: https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecovacs.html https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecova...

textlapse 2y ago

Why is it that a smart device (robovacuum or proximity sensor etc) etc require the same technology as a streaming webcam? In other words, are there any HW-level privacy-preserving CCDs (for lack of a better word) that provide an image in a format that can't be snooped in? Like say, I need an 'image' that I use to detect certain objects - I don't really need a 1920x1080 24bit RGB image @ 30Hz? In fact, with such a mechanism, certain other metrics (performance, better object detection) could also improve in addition to privacy?

teruakohatu 2y ago
Some of them sell it as a feature and let you drive your robovac around like a FPV drone. Hardly worth the spying implications.
gwbas1c 2y ago
> that provide an image in a format that can't be snooped in There's no way to make information that can only be used in the way you want it to. I would assume that the image is handled in software: IE, the vacuum runs software that uses the image as one of its many inputs to decide where to steer the vacuum. Doing this as hardware-only is technically possible, but in practice, it's probably so difficult to implement it that way that it may be impractical. (For example, how can you remotely update the vacuum to fix a bug in the algorithm if it's burned into a chip?) Edit: I should point out that the vacuum is probably using a standard, off-the-shelf, camera part. They could consider figuring out how to blur the image (by manipulating the lens during manufacturing,) but I wouldn't make any assumptions about their algorithms to assert that this is practical.
- textlapse 2y ago
  What I am talking about is a bit different: imagine if the CCD produced a non MxN color image. Maybe think of it as scrambled data that has just the right level of detail for the machine to do its thing but not something where you can get back the full color image via any means. I am not saying the actual CCD is different but it’s something akin to a filter between the HW and the rest of the system to prevent full color image access.

winrid 2y ago

Of course the researcher has to have htop open! Btw has anyone done an analysis of Bobsweep (Canadian company) vaca? They kind of position themselves now as "privacy focused".

roydivision 2y ago

Why is the device connected to the Internet? And why does it have a camera?

andrei_says_ 2y ago
I have an different model, but: Control of the device requires an iOS/android app and communication takes place via the internet. My model has a camera in order to map its surroundings. The app makes a map of the space, separated in rooms, and thus possible to request or schedule the cleanup of a specific room or zone. I often start the cleaning process while not at home.
vultour 2y ago
Because the morons making the product think you need to use it while away from home, which is also conveniently allowing them to send data to their servers all the time. I personally never do, so a bluetooth connection would be sufficient, but they don't give you a choice.

greenimpala 2y ago

I would love to upgrade my ten year old Roborock running Valetudo. But I'm not sure they've been able to figure out a way to root the new machines. I point blank refuse to have a computer on wheels with cameras and microphones roaming my house with a direct connection to China. It really blows my mind that the majority of people seem to think that's fine.

Jemm 2y ago

Why does a vacuum need a microphone?

w10-1 2y ago

As a refresher... These exploits promise to be the rule, not the exception -- and not (just) because this company might have to comply with its national imperatives. Assuming companies get paid for deploying hackable devices, it gives them an unfair competitive advantage relative to ethical companies (who would have higher prices). Given the information asymmetry (promoting the devices as simply reliable vs the difficulty and complexity of hacking them), this advantage is protectable. Thus if, or since, the market gives enduring advantages to this kind of exploitation, we can expect exploitation to be the rule, and product/technical leaders will be selected who comply. A key aspect (noted in the article) is the capture of technical standards organizations by the companies they monitor. Usually this is good (keeping standards more realistic, timely, and relevant). But that means one can't rely on those organizations to protect end users (whether business or consumer). The alternative of government politicized regulators would kill technology advancement, leading to a race to less-regulated jurisdictions (protected by fair-trade rules). The same is true of product liability schemes. So exploitation is the rule, and technology can't regulate itself or be regulated. Meanwhile, technology reaches into every aspect of work and play. Entrepreneurs who solve this problem would create tremendous value (yes, some of which could be captured).

elitistphoenix 2y ago

His homepage: https://dontvacuum.me/ https://dontvacuum.me/

killingtime74 2y ago

I specifically bought a robot vacuum with less sensors (no camera) for this reason. Why does it need camera if bump sensors and Lidar already works, it's asking for trouble.

aaron695 2y ago
[dead]
dikkechill 2y ago
How did you do your research and which one did you eventually buy?
- iammiles 2y ago
  This sounds like the Roborock S series. I went with lidar over camera because it can run in any lighting condition and I don’t have a need for poop detection.
- Rebelgecko 2y ago
  Not OP, but I'm a big fan of the Vacuum Wars YouTube channel (they have text summaries on their website too)
MBCook 2y ago
Some manufacturers use cameras instead of LiDAR (iRobot, for example). Others use both. LiDAR for walls, cameras for object identification below the LiDAR plane, directly in front of the robot. That’s how the fancy ones avoid socks or cables or other small things.
- supportengineer 2y ago
  This might be OK for a vacuum cleaner, but nobody in their right mind would choose cameras over LiDAR for important applications.
  - NRv9tR 2y ago

ncr100 2y ago

Ecovacs notified in December 2023 > “Ecovacs has always prioritised product and data security, as well as the protection of consumer privacy,” they said in a statement. Still not fixed, today. Mobile Webcam exploit at 100 meters.

ChrisArchitect 2y ago

ABC Australia Title: We hacked a robot vacuum — and could watch live through its camera