12 ms·
Man accidentally gains control of 7k robot vacuums
- metalman 9mo agoaccidentaly a god, a sucky kinda god, but a god none the less " I command thee to make vanish the minor sins of this world my minions"
- deleted 9mo ago[deleted]
- ghgr 9mo ago> [...] the same credentials that allowed him to see and control his own device also provided access to live camera feeds, microphone audio [...] Sorry what? Why would a vacuum cleaner even need a microphone?
- onli 9mo agoControl by voice? Not that absurd.
- Telemakhos 9mo agoAudio and video surveillance via robot vacuum is a feature: you can control the vacuum, see and hear the world from its perspective, and spy on your cats. I wish I were kidding. https://youtu.be/TltYXEDoong?t=412 https://youtu.be/TltYXEDoong?t=412
- yunnpp 9mo agoWho is "you" in that sentence?
- Gander5739 9mo agoOne.
- NooneAtAll3 9mo agocontrol what? "get out of my room"?
- thinkingemote 9mo agoAs an impractical idea, echo location popped into my head.
- jonplackett 9mo agoCompanies this inept really need to get fined. Like how many layers of people had to have OKed having the same password for all of them? It’s incompetence on an impressive scale.
- wolrah 9mo agoAgreed, this sort of thing should at minimum be considered gross negligence at this point, but because regular consumers who buy these products rarely see and almost never understand these news articles it doesn't really impact sales so the company doesn't care. If this discovery was guaranteed to result in meaningful fines companies would get their act together pretty quickly. 7000 counts of negligent exposure of private data (camera/mic feeds) should in a just world be millions of dollars in fines at the least and arguably criminal charges for management.
- jonplackett 9mo agoExactly. If GDPR fines can be so high, then something like this that is pretty much intentionally leaking personal data should be in the same ballpark.
- hinkley 9mo agoJust one underpaid dude.
- deleted 9mo ago[deleted]
- RHSeeger 9mo ago> In order for the Romo, or really any modern autonomous vacuum, to function it needs to constantly collect visual data from the building it is operating in. I specifically bought one without a camera or mic.
- sverhagen 9mo agoHow do you know? For sure, I mean?
- brookst 9mo agoI mean your coffee maker could be a one-off spy device with nation-state backing. But it seems unlikely.
- dylan604 9mo agophew, yet another reason it pays off to not be a coffee drinker.
- Tempest1981 9mo ago:) I'm sticking with my Aeropress
- Marsymars 9mo agoI'm sitting here drinking an Aeropress-made coffee as I type this, but thinking about how the kettle I used to boil the water is wifi-connected. (Although the smarts are limited to firmware updates, there's no control of the kettle or useful data collected from the kettle.)
- iamtedd 9mo agoA kettle needs firmware updates?
- exegete 9mo ago“Accidentally” is not accurate. He used AI to inspect the source and found credentials that work in all devices. He also never gained control of anyone else’s devices. He never used the exploit.
- 55555 9mo agoI didn't read the article but based on the title and subheading I assume they say "accidentally" because he was trying to reverse engineer the communication protocol to use his own device and he did not expect to find something as dumb as master credentials that would work on others' devices.
- wolrah 9mo ago"Accidentally" as in his intent was to gain control of his own device but instead discovered what would in a just world be considered criminal levels of either incompetence or indifference to the most basic levels of security in the entire product line.
- MostlyStable 9mo agoAnyone who's somewhat technically inclined should, in my opinion, only be buying valetudo [0] compatible vacuums and replacing the default software as soon as possible. [0] https://valetudo.cloud/ https://valetudo.cloud/
- ericpauley 9mo agoI found the “Why Not Valetudo” page on that site extremely persuasive. I would consider myself technically inclined. I also own a robot vacuum so I can spend more time doing important things that leverage my skills. Valetudo does not serve this mission. Very impressive, but I disagree that this is the clear best choice for anywhere close to anyone.
- misnome 9mo agoAlso, the first line in "Why Valetudo?" > First of all, please do not try to convince people to use Valetudo. A good realist position for such a project to take.
- Aurornis 9mo agoThat is very refreshing. Many geek hobbies like 3D printing and home automation are becoming full of unnecessarily smug evangelization if you're not using hivemind approved software and tools, even if it requires a lot more work to do. It's nice to a see a project encourage their userbase to be realistic about what it is and refrain from trying to force it on everyone as the only acceptable way to use a robot vaccuum.
- throw10920 9mo ago> Many geek hobbies like 3D printing and home automation are becoming full of unnecessarily smug evangelization if you're not using hivemind approved software and tools, even if it requires a lot more work to do. A mix between gatekeeping and tribalism. Reasonable people realize that others who want to enjoy a hobby do not have to do the hobby the same way as they do, or make the "right" choices.
- charles_f 9mo agoOriginal story: https://www.theverge.com/tech/879088/dji-romo-hack-vulnerability-remote-control-camera-access-mqtt https://www.theverge.com/tech/879088/dji-romo-hack-vulnerabi... Accompanying discussion on hn https://news.ycombinator.com/item?id=47047808 https://news.ycombinator.com/item?id=47047808
- Cthulhu_ 9mo agoThank you, the guidelines are clear that the original source should be linked.
- Betelbuddy 9mo agoHis code sucks...
- Betelbuddy 9mo agoTough crowd. Even the robots got the suction reference.
- fuzzfactor 9mo agoWell some robots like these are on the cutting edge of autonomous sucking.
- dlenski 9mo ago> he soon discovered that the same credentials that allowed him to see and control his own device also provided access to live camera feeds, microphone audio, maps, and status data from nearly 7,000 other vacuums across 24 countries. This is extremely similar to what I accidentally discovered and disclosed about Mysa smart thermostats last year: the same credentials could be used to access, inspect, and control all of them, anywhere in the world. See https://news.ycombinator.com/item?id=43392991 https://news.ycombinator.com/item?id=43392991
- morkalork 9mo agoIs this cutting corners on manufacturing/assembly where they're skipping installing a unique set of keys on each device?
- Neywiny 9mo agoI think it's about being a configuration management nightmare. If every device has a unique password, you need the decoder ring for serial number to password. However, not all processors have unique IDs. So you either need to find a way to reliably serialize each board during manufacturing and hope it stays (like a sticker/laser/printer/etc) or add a serial number chip which is cost and complexity. It's not impossible, it's just extra work that usually goes unrewarded.
- HFguy 9mo agoI'm a long way from embedded development. But I was under the impression a lot of microcontrollers these days have some ID capability built in, even some relatively low-end ones. This strikes me more as laziness than anything.
- peterus 9mo agoThis is true, for example many stm32 series have a 96 bit unique id which is derived from the lot number, wafer id and position [1]. Even the low cost stm32g0b1 series I am using has them, but they are missing from some older series. [1] https://community.st.com/t5/stm32-mcus/how-to-obtain-and-use-the-stm32-96-bit-uid/ta-p/621443 https://community.st.com/t5/stm32-mcus/how-to-obtain-and-use...
- TheRealPomax 9mo agoSurely this also requires reporting DJI to the authorities for gross negligence? This is not an oopsie, this is deploying a surveillance network without telling anyone.
- thenthenthen 9mo agoThis is a DJI company? Ouch. [edit] ah it is right in the title of the og article. Wow. Just wow. In China we just use a broom, so maybe it is an oversight (aka no one uses this overprices crap)
- Someone1234 9mo agoIt is gross negligence, but to which authorities are you reporting them to and which criminal violations are you claiming they broke?
- TheRealPomax 9mo agoEvery single one relevant to where you live? If you're in the US, the US. "Good fucking luck and lol" and all that, but do it anyway. In the EU? Your country has agencies for this, as does the EU as a whole. Perform your civic duties, they still count in the EU. Somewhere else? I don't know man, the author sure seems to live in either of those two regions. You know where to report things if you live on Earth and use the internet.
- niccl 9mo agoI invoke Hanlon's Razor [0]. Never attribute to malice that which is adequately explained by stupidity 0: https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
- TheRealPomax 9mo agoI reject this razor on the basis that the author is more than clearly not stupid.
- shevy-java 9mo agoWell - imagine how many cat furs can be vacuumed with this!
- trelane 9mo ago"sneak peak" Sigh https://slate.com/culture/2012/01/stealth-mountain-the-twitter-bot-devoted-to-a-single-grammatical-error.html https://slate.com/culture/2012/01/stealth-mountain-the-twitt...
- sowbug 9mo agoOne advantage of AI-generated copy is it generally doesn't make mistakes like this. The only mistake I've noticed, besides inexplicably lapsing into Chinese mid-sentence, is parallel construction errors, like "This product is fast, lightweight, and won't break the bank!"
- MarkusQ 9mo ago> parallel construction errors, like "This product is fast, lightweight, and won't break the bank!" I'm failing to see the error. That seems like perfectly sound, vernacular English.
- sowbug 9mo agoThe first two of the three are adjectives, each connected to the subject by the one "is," and the third is a verb phrase not using the "is." Ideally they'd be all adjectives using the "is," or all phrases supplying their own verbs. Not the worst error in the world, but it stands out in LLM text that is otherwise remarkably nit-free.
- MarkusQ 9mo agoBut is it even an error? You are parsing it as a single list, but it could just as well be parsed as "subj ((is {a,b}) and vp-predicate)". I guess you could argue that the first list needs an "and"? That's fair I suppose.
- sowbug 9mo ago(We have descended into one of the deeper circles of grammar hell. I will remind you that you're free to leave at any time.) Yes, exactly. English grammar actually doesn't require the "and" to end a list (leaving it out is called "asyndeton" if you're curious). A good example is Lincoln's Gettysburg Address: "... and that government of the people, by the people, for the people, shall not perish from the earth." So after all this, there actually is a way to analyze the example that is strictly valid. But most people would look askance at the standalone sentence "This product is fast, lightweight." That is, I suppose, unless someone like Abraham Lincoln worked it into his next speech.
- rdiddly 9mo agoWell it only took until the 2nd paragraph, and the words "DJI’s remote cloud servers" for me to be forehead-slappingly disgusted again. Obviously proper diligence wasn't followed with this product, and obviously this is going to be something we've all heard before, but why does a vacuum need to talk to a server at all? And also, to go even further back, is there anything more leopards-ate-my-face than a compromised robo-vacuum? I have never understood the appeal of these things. Except as satire. Pushing a vacuum around takes minutes, once a month, all the more so when you live in a 3m x 3m box with 12 roommates, and is badly needed exercise for a lot of pathetic little nerd noodle-arms.
- VladVladikoff 9mo ago>once a month We vacuum and mop our kitchen and dining room daily. It gets dirty, especially when you have young kids.
- kelnos 9mo agoI get the frustration, but this is how pretty much all of the connected home devices on the market work. Sure, there are local-only versions of many of these things, but that sort of design is in the minority both in number of products and in sales. And it makes sense: most people want this stuff to just work, and be accessible when they aren't at home on their WiFi network. The only reasonable way to do that these days is to have a central server that both the devices and the control apps connect to. Very few users (and yes I am one of them) are going to set up a local control server and figure out how to securely set up remote access to it. It's a crappy situation that leads to security incidents like this one, but that's just where we are right now. Regarding cleaning frequency: no need to repeat what the sibling commenter said, but I will say I suspect your cleaning needs are much lower than those of the average person.
- Marsymars 9mo ago> Pushing a vacuum around takes minutes, once a month, all the more so when you live in a 3m x 3m box with 12 roommates That's a lot of assumptions. I budget an hour every couple of weeks to vacuum the entire house (kitchen more frequently, but that's quick). When we had pets, which we'll probably have again in the future, this had to be done weekly.
- deleted 9mo ago[deleted]
- Ylpertnodi 9mo agoTerrible writing in the article. >It retails for around $2,000 and is roughly the size of a large terrier or a small fridge when docked at its base station. So, large terriers, and small [presumably 'smart'] fridges can have docking stations?
- dep_b 9mo agoInternet connections on devices are an anti feature to me. I need something to work reliably without internet. And then maybe add some extras through internet access through open and secure protocols, so I can always write my own implementation.
- fnands 9mo agoThe dishwasher at my office has WiFi. Why do companies insist on connecting every single device to the internet? Fortunately it's mostly an optional feature, so still works just fine without it, but in general it's a pretty strong signal to me to not buy that product.
- thegrey_one 9mo agoI thought this was pretty much a known fact by now. To make more money. They sell the data, or monetize it somehow. They disguise doing it under all kinds of "features" which indeed might be useful for some people. What should ring your alarm bells is any device that needs you to make an account, at least once when setting it up. That's valuable data, who/where/email/phone number etc. If you cannot fully use the product without at least one initial access to the internet, your data will be monetized, that's the reason you're not able of using it, they need to get something out of you. Of-course there's features that don't work, or make any sense, without internet access. But if you cannot wash your clothes without an account/initial access to the internet...that's sus.
- autoexec 9mo agoIn addition to collecting and selling every scrap of you your private data they can get their hands on, having 24 hour access to the internet also means that at any time they can push updates that disable features you paid for so that they can start charging you a monthly fee to regain access to them. Any CEO whose company engages in spying and theft should be criminally charged and thrown behind bars just as you or I would be for those same acts, but right now companies can do pretty much anything they want to you and if they do happen to face any consequence it'll just be a slap on the wrist that costs them a fraction of the profit they made ripping you off and violating your privacy.
- kderbyma 9mo agoHe couldve cleaned up....
- Nevermark 9mo agoHow long before there is a claw controlled network of robot/device spies and soldiers?
- jrochkind1 9mo agoI don't knowingly have any live cameras or microphones in my home other than my laptop and phone (I know those are big "buts", but still), and I plan to keep it that way. I remind myself of this no matter how much convenience I may be missing out on. (Getting a TV without em is kinda hard!) Planning in advance, same for any AR stuff, not in my life, I'm sticking to it.
- testing22321 9mo agoI have a roomba It has never been connected to wifi and I’ve never used a phone app for it (I don’t have a phone) It works perfectly.
- NooneAtAll3 9mo agoa room a?
- testing22321 9mo agoSorry, autocorrect. Roomba
- CableNinja 9mo agoUnless you watch actual TV theres no reason to buy an actual TV in my opinion. You can get nicely large monitors and displays for pretty cheap, and a minipc or even a stick pc and youre good to go. Both of my 'TV's are big monitors with some lenovo minipcs running debian. Hardwired, but i could wifi them if i want. Zero tracking, zero bullshit.
- Arch485 9mo agoI've just accepted that Microsoft, Google, and Meta all have a constant wiretap in my office (on account of my Windows PC, Android smartphone, and Meta VR headset). It's rather dystopian to just know and accept this, but there's really no alternative if you want to participate in modern society at a normal capacity (sans the VR headset, that really isn't a necessity). Something something, keep your enemies closer, right?
- shrubble 9mo agoDue to the wonders of technology, you can now do the equivalent of the Steven Wright joke: “In my house there's this light switch that doesn't do anything. Every so often I would flick it on and off just to check. Yesterday, I got a call from a woman in Germany. She said, 'Cut it out.'” At scale, over the Internet.
- mghackerlady 9mo agoI once did something similar for car wash doors. there's a car wash door company out there that has a control panel accessible over VNC and uses the same defaults for every one they set up, so I used to connect to random ones and open and shut the car wash doors for the fun of it. The best part was when someone noticed and tried to shut it only for me to open it again, resulting in a battle where neither of us knew anything more than someone or something keeps undoing my actions
- Razengan 9mo agoThis should be a supervillain origin story.
- cogogo 9mo agoAbout 10 years ago I was at a startup that used one of the upstart 401k providers of the time. Logged in one day and could see several of my coworkers’ accounts. Really bad class of bug. Still not clear to me how they could have screwed up account atomicity so poorly but assume it was something to do with how they managed orgs. I was pretty mad about it but also tried to play ball and not make too much of a fuss because I learned some pretty private things without meaning to and didn’t want to inadvertently make them public. Should have been more vocal.
- rkagerer 9mo agoI tend to err on the side of discretion as well. It's more professional. Though over the years, I've learned to calibrate that discretion proportional to how much of a good-faith effort the counterparty involved seems to be making. If they clearly don't give a shit that they're incompetent, they can expect my megaphone to blare.
- fc417fc802 9mo ago> didn’t want to inadvertently make them public Screenshot, redact, mass email everyone. Problem solved. Financial institutions don't deserve any leeway with security issues when it comes to their reputation. Handling your money securely and privately is the totality of their reason for existence.
- coin 9mo agoPlease don't edit the title
- rtchau 9mo agoFor a brief, beautiful moment, one man came close to sucking more than any other person in human history.
- deleted 9mo ago[deleted]
- mattmaroon 9mo agoI bet he had the world's cleanest floor.
- userbinator 9mo agoThe robot in question is the DJI Romo, an autonomous home vacuum that first launched in China last year and is currently expanding to other countries. It retails for around $2,000 and is roughly the size of a large terrier or a small fridge when docked at its base station. Unfortunately it doesn't fly.... although if it did, that would've made this even scarier.
- dwoldrich 9mo agoConsumers are not voting with their wallets, they do not care. Surveillance for profit will be illegal. Time for the Internet Bill of Rights. Trust me, it's coming. tyfyattm
- petterroea 9mo agoChina simply isn't interested in or understands privacy at the moment. I have some experience with cross border relations with them and getting them to sign and then care about data processing agreements we need for gdpr is something for sure... My understanding is that there is no malice or incompetence, it's usually just "who cares"
- echelon 9mo agoChinese engineers are knowingly surveilled by the state with no recourse. Commercial offerings of all shapes and sizes have cameras and microphones. It's just new tech. In the US, Five Eyes, and abroad, there is at least some ceremony around calling this bad even though a similar apparatus is installed. (Supposedly with "checks and balances", but who knows?) People in Western countries almost unanimously find corporate spying creepy. (Though ad tech has snuck in via convenience and invisibility.) We find cameras a hard line. The TikTok and Twitch generation has different attitudes about always-on cameras, though.
- surprisetalk 9mo agohttps://taylor.town/roombas-with-fart-spray https://taylor.town/roombas-with-fart-spray
- suzzer99 9mo agoI have my Roomba programmed to start at 5pm every day. Multiple times now it's come to life at 7pm, gone straight to my bedroom, stayed for for 5-10 minutes, then come back home to its dock and gone back to sleep. I have no idea what's going on.
- qnleigh 9mo agoDoes it even vacuum while it's in there? From what you wrote, it sounds like it just comes in, sits menacingly at the side of your bed, and then leaves...
- suzzer99 9mo agoI was in the living room and didn't follow it into the bedroom. It didn't sound like it ever turned on the vacuum. It has a mapping mode (I assume) where it drives around and doesn't vacuum.
- jackgavigan 9mo agoiRobot is now Chinese-owned.
- fix4fun 9mo agoMy first think after reading title was "Silicon Valley" series (2014) and episode with Gilfoyle and taking control of smart fridges ;) Sorry. A but out of topic, but I had to mention ;)
- hilbert42 9mo agoI give up. Privacy's hopeless as none care. When so many are prepared to chuck privacy to the wind and connect a roving camera in their homes to an internet server that's not under their contol there's no hope. The few who do care are swamped by the numbers. Anyway, what's all the fuss about (those affected couldn't give a damn about their privacy)?
- NalNezumi 9mo agoAs part of my thesis work almost 10 years ago I worked on a robot vacuum cleaner, (working on their sensor data) and one smart hardware implementation they had was that they had separated the computer vision module from the main board. This way, only processed vision data would be physically sent to the main board. This constituted of mostly just "line segments", almost like a sparse point cloud, to detect obstacles and edges. They argued that this was more privacy safe because there's no way for the main module to access any raw vision data. It did however make the SLAM part harder to make work. In hindsight, a good decision. I got one as a thank you for thesis work and it's still running just fine (with battery and brushes replaced once) and good to know that with the years of software update it still can't check me walking around in underwears in my apartment
- altacc 9mo agoI'm obviously wondering which company this is but understand the anonymity. I have a LIDAR vacuum to avoid cameras and from connecting to its debug socket could see the point cloud enough to know that it was very granular.
- logankeenan 9mo agoWhich brand did you get? I’ve always been hesitant to get one, I’d like one that I could reduce the amount of data sent out to the cloud
- Retz4o4 9mo agoGet https://valetudo.cloud/ https://valetudo.cloud/
- fainpul 9mo agoIf one's goal was to force companies to implement better security for their products, it would probably be more efficient to cause maximum reputational damage to the companies, instead of just "responsibly disclosing" vulnerabilities. It would temporarily suck for consumers, having their devices exploited and their privacy abused, but it would lead to wider awareness of the problem, shaming of the companies, financial and legal pressure, and hopefully change things in the long run. Disclaimer: This is not a call to action to do illegal things. Your decisions are your own.
- mihaaly 9mo agoPaying almost a thousand - or more! - to have an overcomplicated device filled with sensors put into your most private sphere voulnerable to adverse elements unnecessarily (had a perfect dumb robot vacuum doing its job loaned to us once, but no-one sells such when they can sell bullshit for 4 times more, idiots buy it regardless), that is not smart.... Consumidiotsm, is the term comes to mind. Eating up crap, is the analogy from non-technical contexts. The side effect is, that buying properly made not overcomplicated and tedious to maintain (update, refresh, pair, disgnose, update and configure connected harware, click away pushy self-promotions, the way it is not exposing you to the manufacturer or everyone) products is tedious (loosing saved efforts). Poor others just want simple and robust, not fragile and risky tech-crap doing the core thing are left out. (Robotic vacuum is a great concept! The available implementations in the other hand are rubish!)
- ruffrey 9mo agoAt what point do these security flaws come with a criminal level of negligence? This isn't intended to be an inflammatory or angry comment. It is a genuine question.
- susarn 9mo ago[dead]