ABC News hacks into popular robot vacuum, watches owner through camera

https://www.abc.net.au/news/2024-10-04/robot-vacuum-hacked-photos-camera-audio/104414020

by puffl • 2 years ago

316 136 2 years ago

abc.net.au

I specifically bought a robot vacuum with less sensors (no camera) for this reason. Why does it need camera if bump sensors and Lidar already works, it's asking for trouble.

dikkechill2• 2 years ago

How did you do your research and which one did you eventually buy?

iammiles• 2 years ago

This sounds like the Roborock S series. I went with lidar over camera because it can run in any lighting condition and I don’t have a need for poop detection.

Rebelgecko3• 2 years ago

Not OP, but I'm a big fan of the Vacuum Wars YouTube channel (they have text summaries on their website too)

MBCook• 2 years ago

Some manufacturers use cameras instead of LiDAR (iRobot, for example).

Others use both. LiDAR for walls, cameras for object identification below the LiDAR plane, directly in front of the robot. That’s how the fancy ones avoid socks or cables or other small things.

supportengineer• 2 years ago

This might be OK for a vacuum cleaner, but nobody in their right mind would choose cameras over LiDAR for important applications.

Rebelgecko3• 2 years ago

Lidar doesn't work for some things- my Roborock S7 has trouble if there's a USB cable on the ground or a lamp's power cord isn't tucked all the way up against the wall. Supposedly the camera models are better at avoiding certain obstacles, which is good if you have a pet or housemate who sometimes poops inside and you don't want that getting mopped all over the floor.

That's a compelling use case for me but considering how many of these vacuums have had privacy issues, I stuck with Lidar (people cast aspersions on the Chinese companies but US manufacturers have track records that don't inspire confidence either - just ask the Roomba employees who got their naked pics leaked online)

Scoundreller4• 2 years ago

just wrap your cables in retroreflective tape?

s1mon• 2 years ago

"good if you have a pet or housemate who sometimes poops inside"

I have a pet (cat) that unfortunately poops just outside her box most of the time, despite a lot of different ideas and approaches with the help of our vet. She's old and has lower back pain issues. It ends up on a litter mat or the wooden floor, so it's not that hard to clean up.

If I had a housemate that pooped inside not in the toilet, they would need to be even less able to manage their shit, so to speak, and more loved than our cat, or they would be out of here very fast.

tzs• 2 years ago

In addition to what others have said, I believe some use an upward facing camera to help with mapping.

Ceilings tend to be less cluttered than floors so it is easier to figure out the shapes of rooms and their relationships by looking at the ceiling than by looking at the floor.

ncr100• 2 years ago

Ecovacs notified in December 2023

“Ecovacs has always prioritised product and data security, as well as the protection of consumer privacy,” they said in a statement.

Still not fixed, today.

Mobile Webcam exploit at 100 meters.

ChrisArchitect• 2 years ago

ABC Australia

Title: We hacked a robot vacuum — and could watch live through its camera

dikkechill2• 2 years ago

I found the open source Valetudo (https://github.com/Hypfer/Valetudo) project quite interesting, as it sits between the vendor firmware and (cloud) connectivity. The project is made possible due to Dennis Giese's research.

It currently supports Dreame, Xiaomi, Roborock and some others. But not Ecovacs. And not sure it prevents this type of Bluetooth vulnerabilities.

Tier3r• 2 years ago

No truck on this robot vacuum race because I don't own one, but one an incredible name.

FloatArtifact• 2 years ago

I specifically shopped for vacuum using that website and it wasn't too bad to set up.

pkulak• 2 years ago

Same. Had to spend a bunch of time on Telegram finding a breakout board in NA, but once I did that, it was just a matter of following directions. It’s my favorite piece of tech at the moment, and it cost me 180 bucks brand new.

xkcd-sucks• 2 years ago

+1 for Valetudo, not only does it work, but it is also maintained and keeps getting better. Moreover old vacuums are still maintained as new ones are added

dugite-code• 2 years ago

Yup, my first gen roborock is still trundling along quite happily because of Valetudo. Would be nice if the base ubuntu was updatable but as it's offline except for a connection to a homeassistant instance it's probably safer than 99% of IOT devices

cassianoleal• 2 years ago

For (some) Ecovacs, there's Bumper [0]. Not exactly the same as Valetudo but serves a similar purpose.

[0] https://github.com/bmartin5692/bumper

FredFS4563• 2 years ago

Dennis works closely with the Valetudo developer. On one of the Valetudo Telegram channels, they announced the following:

As you might know, we looked into Ecovacs as an alternative for Dreame&Roborock. However, we found security and privacy being completely broken. If you have a X2, a Goat lawnmower, or newer than 2023 devices, you might want to turn them off for now. There is a BLE RCE, that lets an unauthenticated attacker send a payload via Bluetooth, that gets executed as root on the device. It does not appear that Ecovacs wants to fix that. More information: https://twitter.com/lorenzofb/status/1822002515279270079 https://techcrunch.com/2024/08/09/ecovacs-home-robots-can-be...

pj_mukh2• 2 years ago

Wow.

Can Valetudo provide artificially blocked cloud features? For example the Roborock S5 doesn't have persistent maps, though it would be trivial to just keep one loaded in the cloud, but Roborock would rather you upgrade to an S7.

Would that work?

darknavi• 2 years ago

I have two Roborock S5s running Valetudo with persistent maps. Works well and integrates into Home Assistant.

Quail40563• 2 years ago

Only v1 does not have persistent maps, as it is not supported by the firmware. Valetudo only supports whatever the firmware supports already.

hedora• 2 years ago

I have some modern (mapping) roombas laying around. Any idea what they could be useful for?

If it involves vacuuming, mopping, or returning to their docks, they are pretty useless.

XorNot• 2 years ago

Huh I have an Ecovacs vacuum I hope this leads to a cloud cut exploit so I can run it locally.

The biggest disappointment has been Tuya patched the exploits which let tuya-cloudcutter work without dismantling devices.

I don't know how we do it, but I want a world where IoT is required to be independent of cloud and flashable.

amatecha2• 2 years ago

You can check here: https://valetudo.cloud/pages/general/supported-robots.html

Uhhh, actually, I guess there aren't any Ecovacs models yet supported by Valetudo, unfortunately :\

gosub100• 2 years ago

Would there be a market for a VPN-style zeroconf networking "protocol" (that maybe sits on top of TCP) that would work with a yubikey and NFC? The effect would be that if you didn't, at some point, swipe the yubikey (or other token) on the IoS (internet of shit) device, and on the router/smart phone/PC, then you just get encrypted data.

I think this would be intuitive to many people, physically touching the security wand on the devices you want to connect, and voila. Of course, this wouldn't work for the companies selling you this junk where they insert themselves and their paywall in between.

I'm just wondering if TLS could be (ab)used for this use case.

SoftTalker• 2 years ago

Reinforces my gut instinct that I don't want any of these "smart" devices in my home. Aside from being spys, it takes 10 minutes to vacuum the floor with a standard vaccum cleaner. I spent more time than that guiding the Roomba that we had, getting it unstuck from corners or wires, emptying its pitifully small dust cup, making sure all potential obstacles are picked up, etc. Chucked it in the trash after a month or so.

WheatMillington• 2 years ago

I love our robot vac. Not because it's faster or better than me, but because it's labour-free, and I can run it every day after the kids go to bed and have nice clean floors.

However I also agree about not putting smart spy devices in my home - mine is a very basic cheap model with no cameras or wireless connectivity. Absolutely INSANE to have any type of connected camera inside your home. Even baby monitor cameras, such a huge vulnerability for so little utility.

Rebelgecko3• 2 years ago

My Roborock is probably the best <$500 purchase I've ever made. I'm actually tempted to get a fancier one with auto emptying just to avoid having to dump the bin once or twice a week

Alupis7• 2 years ago

A robot vacuum will literally change your life.

It seems silly, because as the parent said, it doesn't take long to vacuum normally, but it's one chore struck off the list and becomes something you rarely have to think about anymore.

Coming home to a freshly vacuumed house is a great feeling. With a robot vac, you get to have that feeling every single day.

Robot vacuums aren't as effective at vacuuming as a human would be, but it also doesn't matter. Whatever it missed today, it'll get tomorrow.

Yes, you need to adjust somewhat your living style. If you leave a lot of clothing on the floor, or have cables just laying about, the robot vac will find them and get stuck. You should clean those up anyway - but within the robot vac-owning community it's often a joke that you have to "roomba-proof" your house.

The upsides outweigh the downsides by far.

kardos• 2 years ago

mine is a very basic cheap model with no cameras or wireless connectivity.

What brand is it? So many these days have both cameras and wireless

nox101• 2 years ago

Absolutely INSANE to have any type of connected camera inside your home

so no smartphones for you?

stronglikedan• 2 years ago

it takes 10 minutes to vacuum the floor with a standard vaccum cleaner.

Sure, if you live in a studio, but a lot of people don't.

BeetleB3• 2 years ago

Aside from being spys, it takes 10 minutes to vacuum the floor with a standard vaccum cleaner.

Robot vacuums often pick up things I miss, because they tend to be thorougher.

getting it unstuck from corners or wires

Yes, this is annoying. Not everyone has stuff that these vacuums will get stuck in.

making sure all potential obstacles are picked up,

If you have small clutter on the floor, you probably need to pick it up anyway if you vacuum yourself.

Robot vacuums are for people who have a track record of not vacuuming :-) If you have the discipline to vacuum on your own, then there's no need for a robot one.

whywhywhywhy2• 2 years ago

Think mine is one of my favorite purchases ever, turned something that used to take me close to two hours into something I don’t even have to do.

Bought a lidar one too (BotVac) so never had to worry about camera feeds and it’s smart about navigating the rooms, not even connected to the net.

cpuguy83• 2 years ago

Agree on smart devices, but I also have 3 kids and just want to have clean floors every day.

Also, Roomba is absolute trash compared to any other brand. Replaced my Roomba with a different brand a few months ago and it's a totally different experience.

kelnos2• 2 years ago

I get a lot of value out of my Roomba. It takes me quite a bit longer than 10 minutes to vacuum manually. Whenever I want the Roomba to do its thing, I spend 5 minutes picking things up off the floor (mostly cat toys that I'd have to pick up anyway if I were vacuuming manually) that would trip it up, and then I start it up and ignore it. Sure, it takes longer to vacuum than I would, but aside from the initial 5 minutes of effort, I don't have to do anything. I do also have the model that goes back to the base station to empty its own bin; not having that would be annoying.

Even my sister ended up buying one after I talked about it with her. She was looking for a way to make her daily nighttime kid cleanup ritual less work. Same deal with her: it takes longer for it to do its job than if she were doing it herself, but while it's vacuuming she can clean something else, and be ready for bed earlier than she'd otherwise be.

shiroiushi• 2 years ago

Aside from being spys,

This isn't a problems if you use open-source replacement firmware like Valetudo (https://valetudo.cloud/).

andrei_says_2• 2 years ago

My space is a bit larger, I hate vacuuming and have never had a manual vacuum I don’t find too loud too inefficient and too large.

I run the robot when I’m outside and have it do two passes which results in very good results. I get tremendous enjoyment from knowing a machine is doing the work I absolutely hate, with quality results. Would absolutely buy again.

ta12435• 2 years ago

I don't do much "smart home" stuff, but could someone explain the value of allowing your vacuum cleaner talk to the internet? Does it use cloud resources to process stuff remotely like I believe Alexa does?

insane_dreamer• 2 years ago

I'm guessing it transmits telemetry to help the manufacturer improve the robot's spatial awareness algorithm (and images for the same reason), and users probably consent to this without realizing it when they "agree" to the 15-page TOS

ta12435• 2 years ago

OK, I was going for value to the customer. Obviously selling your data to the highest bidder is a given nowadays.

larrik• 2 years ago

To control it via app. Scheduling and such.

ssl-33• 2 years ago

Perhaps.

But it has its own little robot brain, and I have a pocket supercomputer along with a LAN to connect betwixt these two things.

I know that realtime clock modules are useful for scheduling and are not free, but that doesn't mean that a device needs to call home in order to start sweeping the floor at a particular time.

ajsnigrutin2• 2 years ago

Drives around, lidar draws a floor plan with all the obstacles, you can then mark zones (don't vacuum here, do extra vacuuming over there,...), set up schedules (vacuum the hallway daily, bedroom every two days, ...), etc.

But lidar is not a camera and exposes much less than a video feed does... why does a vacuum need a camera is a different question.

BeetleB3• 2 years ago

I have an old school Roomba - no Internet/Wifi capability. None of what you said is that helpful.

Obstacles: Not sure what kind...? It's either a large enough obstacle that it will bounce off and continue vacuuming, or small enough that you should probably pick up.

Zones: Solved with the virtual walls that come with the old style Roombas.

Schedules: My Roomba has it - no need for networking.

whywhywhywhy2• 2 years ago

why does a vacuum need a camera is a different question.

Cheaper than a lidar, although I’d never buy a camera one.

ta12435• 2 years ago

So expose this on an webserver on the device itself, advertise it via mdns, have the app talk to it directly from the same network, or via a custom IP for people with more complex needs.

Jach• 2 years ago

Apparently some of them feature two-way communication so you can for example talk to your pets.

Scoundreller4• 2 years ago

I'm looking for one that barks to non-pets

Loughla2• 2 years ago

That seems like a really good way to get my dog to absolutely savage a smart speaker.

stavros4• 2 years ago

Almost all modern devices use internet access for one thing: Because, in the modern internet, it's basically impossible to reliably initiate a p2p connection.

amatecha2• 2 years ago

Most of them don't allow any amount of app control whatsoever unless they have an internet connection. LAN-only app interaction is apparently basically non-existent in this market, for some reason. You can usually use them without giving a wifi connection, but then you can do nothing more than "push a button on the robot to start cleaning the house" and it just runs an automatic/default scheme -- no customization.

Basically the reality is, because you're held hostage by the very few manufacturers making these also gating most functionality behind "let us surveil your entire home permanently".

RomanUhliar• 2 years ago

It's literally the perfect house surveillance device though. Camera on a moving robot which is connected to a network, ha

Scoundreller4• 2 years ago

Or a thing to get triggered whenever there's a suspected burglar. Doesn't even need to get it right all the time, just can't get it wrong. Nobody ever suspects the vacuum cleaner!

Does anyone sell one that barks? Or makes it sound like 2-3 angry people are having a conversation about guns from different points of a room?

brcmthrowaway• 2 years ago

This is naked Australian government propaganda to make people fear China

yawnxyz2• 2 years ago

Does this mean they found an exploit in the Bluetooth mechanism? How were they able to pair with any protected bluetooth device (was hoping for more info on that)

FredFS4563• 2 years ago

Technical details here https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecova...

Quail40563• 2 years ago

based on the slides, any device can pair with the robot. They implemented the security based on the payload, not the BLE protocol.

yawnxyz2• 2 years ago

that... sounds like a really terrible idea?! Even my JBL refuses to connect half the time

LeoPanthera• 2 years ago

"popular robot vacuum" huh? I really hate clickbait headlines. I know about the HN rule to not change the title, but I really wish there was an exception for clickbait.

It's an Ecovacs vacuum. Not an irobot, as most people were probably thinking.

tredre3• 2 years ago

iRobot had the same kind of issues with leaked camera photos. Sure, the distinction might help. But Roombas are in no way more secure/less intrusive.

andrensairr• 2 years ago

To be fair, the sharer may have just been quoting the ABC's own words. Clickbait is their MO of late, and their app is the worst for it. The website used to be better.

EDIT: the link in the app phrases it "The world's largest home robotics company has a problem - its vacuum cleaners can be hacked from afar".

bigiain4• 2 years ago

The ABC News website (the Australian one) has been doing A/B testing on headlines for years. It's super common to see two or three different versions of the headline in the first hour or so after an article's publication, and then settle onto the presumably best click thru one. It used to show up pretty obviously when the url didn't match the headline, but I'm not sure if that's still true after their recent (awful) website redesign.

the_gorilla• 2 years ago

There should definitely be a clickbait exception to that. Sure, "YOU WON'T BELIEVE what robot vacuum ABC hacked" might be work better if you want an unaltered title, but it's objectively worse in every way.

bdcravens• 2 years ago

Could also be a Shark or a Roborock - both brands are also pretty popular

Maybe it's just me, but when I hear "popular X" rather than a brand name or "the most popular X" I generally skip past the number one most likely option in my mind

Quail40563• 2 years ago

iRobot is since COVID not the market leader anymore. After Amazon did not buy them, they might disappear at some point. If you look at their products, they did not really release anything innovative recently. Based on the numbers, Ecovacs might have a bigger market share than iRobot.

JimTheMan• 2 years ago

As always, I am super proud of the Australian Broadcasting Corporation and their consistent balanced (for the most part) good work.

magarnicle• 2 years ago

A national treasure, but I've stopped reading their news in the last year due to the clickbait headlines.

FredFS4563• 2 years ago

Link to Dennis's website with slides for a talk he did on this topic:

https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecova...

textlapse5• 2 years ago

Why is it that a smart device (robovacuum or proximity sensor etc) etc require the same technology as a streaming webcam?

In other words, are there any HW-level privacy-preserving CCDs (for lack of a better word) that provide an image in a format that can't be snooped in? Like say, I need an 'image' that I use to detect certain objects - I don't really need a 1920x1080 24bit RGB image @ 30Hz?

In fact, with such a mechanism, certain other metrics (performance, better object detection) could also improve in addition to privacy?

teruakohatu• 2 years ago

Some of them sell it as a feature and let you drive your robovac around like a FPV drone. Hardly worth the spying implications.

gwbas1c3• 2 years ago

that provide an image in a format that can't be snooped in

There's no way to make information that can only be used in the way you want it to.

I would assume that the image is handled in software: IE, the vacuum runs software that uses the image as one of its many inputs to decide where to steer the vacuum. Doing this as hardware-only is technically possible, but in practice, it's probably so difficult to implement it that way that it may be impractical. (For example, how can you remotely update the vacuum to fix a bug in the algorithm if it's burned into a chip?)

Edit: I should point out that the vacuum is probably using a standard, off-the-shelf, camera part. They could consider figuring out how to blur the image (by manipulating the lens during manufacturing,) but I wouldn't make any assumptions about their algorithms to assert that this is practical.

textlapse5• 2 years ago

What I am talking about is a bit different: imagine if the CCD produced a non MxN color image. Maybe think of it as scrambled data that has just the right level of detail for the machine to do its thing but not something where you can get back the full color image via any means.

I am not saying the actual CCD is different but it’s something akin to a filter between the HW and the rest of the system to prevent full color image access.

Izkata2• 2 years ago

I would assume that the image is handled in software: IE, the vacuum runs software that uses the image as one of its many inputs to decide where to steer the vacuum.

They mainly use lidar for navigating the room, the front camera is to help identify obstacles so they're not run over. They also advertise using the camera and a two-way microphone with remote control through the app, so you can look around your home or talk to your pets while you're away.

fwip• 2 years ago

You could try smearing Vaseline on the lens.

bigiain4• 2 years ago

Back when I was playing with DIY Drones, there were a bunch of projects using optical mouse sensors to do visual position hold at low altitudes. There was a fairly well known way to swap out the lens, then you'd get a 16x16 or 32x32 pixel "image" stream, which was good enough to do feature detection and at the same time made that feature detection way less computationally expensive than hi resolution video feeds.

I strongly suspect anything a robot vac does with cameras could easily be done with super low resolution sensors. Even if you needed to put 2 of them in stereo to get depth perception that maybe you could compute from HD video.

winrid• 2 years ago

Of course the researcher has to have htop open!

Btw has anyone done an analysis of Bobsweep (Canadian company) vaca? They kind of position themselves now as "privacy focused".

roydivision• 2 years ago

Why is the device connected to the Internet? And why does it have a camera?

andrei_says_2• 2 years ago

I have an different model, but:

Control of the device requires an iOS/android app and communication takes place via the internet.

My model has a camera in order to map its surroundings.

The app makes a map of the space, separated in rooms, and thus possible to request or schedule the cleanup of a specific room or zone. I often start the cleaning process while not at home.

vultour• 2 years ago

Because the morons making the product think you need to use it while away from home, which is also conveniently allowing them to send data to their servers all the time. I personally never do, so a bluetooth connection would be sufficient, but they don't give you a choice.

greenimpala• 2 years ago

I would love to upgrade my ten year old Roborock running Valetudo. But I'm not sure they've been able to figure out a way to root the new machines.

I point blank refuse to have a computer on wheels with cameras and microphones roaming my house with a direct connection to China. It really blows my mind that the majority of people seem to think that's fine.

Jemm• 2 years ago

Why does a vacuum need a microphone?

w10-1• 2 years ago

As a refresher...

These exploits promise to be the rule, not the exception -- and not (just) because this company might have to comply with its national imperatives.

Assuming companies get paid for deploying hackable devices, it gives them an unfair competitive advantage relative to ethical companies (who would have higher prices).

Given the information asymmetry (promoting the devices as simply reliable vs the difficulty and complexity of hacking them), this advantage is protectable.

Thus if, or since, the market gives enduring advantages to this kind of exploitation, we can expect exploitation to be the rule, and product/technical leaders will be selected who comply.

A key aspect (noted in the article) is the capture of technical standards organizations by the companies they monitor. Usually this is good (keeping standards more realistic, timely, and relevant). But that means one can't rely on those organizations to protect end users (whether business or consumer).

The alternative of government politicized regulators would kill technology advancement, leading to a race to less-regulated jurisdictions (protected by fair-trade rules). The same is true of product liability schemes.

So exploitation is the rule, and technology can't regulate itself or be regulated.

Meanwhile, technology reaches into every aspect of work and play.

Entrepreneurs who solve this problem would create tremendous value (yes, some of which could be captured).

ABC News hacks into popular robot vacuum, watches owner through camera

Related Stories