 |
| Security Risks in Ecovacs Robots: Hackers Can Take Control of Vacuums and Lawn Mowers to Spy on Users Image credit: Ecovacs |
Researchers Uncover Severe Security Flaws in Ecovacs Robots
Security researchers Dennis Giese and Braelynn have discovered alarming vulnerabilities in several Ecovacs robot models, including vacuum and lawn mower robots. These security flaws could allow malicious hackers to take control of the devices and use their cameras and microphones to spy on users. Giese and Braelynn are set to present their findings at the Def Con hacking conference, where they will detail how these vulnerabilities can be exploited via Bluetooth to remotely access and control the robots.
Bluetooth Exploits and Remote Control Risks
The primary issue uncovered by the researchers is a Bluetooth vulnerability that allows hackers to take over an Ecovacs robot from up to 450 feet away. Once they gain control, hackers can connect to the device remotely through its Wi-Fi connection. This enables them to access sensitive data such as Wi-Fi credentials, saved room maps, and even the device’s cameras and microphones. Giese explained, “You send a payload that takes a second, and then it connects back to our machine... we can access cameras, microphones, whatever.”
Unresponsive Company and Unaddressed Vulnerabilities
Despite reaching out to Ecovacs to report these critical vulnerabilities, the researchers never received a response and believe that the issues remain unresolved. Ecovacs also did not respond to requests for comment from TechCrunch, raising concerns that these security flaws could still be exploited by hackers.
Privacy Concerns: Robots as Potential Spies
Many of the newer Ecovacs robots are equipped with cameras and microphones, making them particularly concerning targets for hackers. Once compromised, these robots can be turned into surveillance devices without the user’s knowledge, as they lack any hardware indicator to show when cameras and microphones are active. Although some models theoretically play an audio warning every five minutes when the camera is on, Giese noted that hackers could easily delete or overwrite this file, making the camera usage undetectable.
A dog on a couch in someone's house seen through the camera of a hacked Ecovacs device.Additional Security Issues in Ecovacs Devices
Beyond the risk of hacking, the researchers identified several other security issues with Ecovacs robots. For instance, data stored on the robots remains on Ecovacs’ cloud servers even after a user deletes their account, and authentication tokens also persist, potentially allowing continued access to the device. Additionally, the anti-theft mechanism in lawn mower robots, which requires a PIN to be entered if the device is picked up, stores the PIN in plaintext, making it easy for hackers to bypass.
Vulnerabilities Across Multiple Ecovacs Models
Giese and Braelynn analyzed a range of Ecovacs devices, including the Deebot 900 Series, Deebot N8/T8, Deebot N9/T9, Deebot N10/T10, Deebot X1, Deebot T20, Deebot X2, Goat G1, Spybot Airbot Z1, Airbot AVA, and Airbot ANDY. They found that once one device is compromised, others within range can also be hacked, potentially creating a widespread security threat.
0 Comments