Vacuum bricked after user blocks data collection – user mods it to run anyway

https://www.tomshardware.com/tech-industry/big-tech/manufacturer-issues-remote-kill-command-to-nuke-smart-vacuum-after-engineer-blocks-it-from-collecting-data-user-revives-it-with-custom-hardware-and-python-scripts-to-run-offline

by toomanyrichies • 9 months ago

371 131 9 months ago

tomshardware.com

sema4hacker• 9 months ago

I wish I had the abilities of the engineer, plus the time he could devote to the problem.

MostlyStable• 9 months ago

There is a significantly easier option (although still more work than just buying a vacuum and using it as the manufacturer intended): get one of the Valetudo supported vacuums[0]. This firmware replacement blocks telemetry and allows for near complete feature parity with the original firmware, and flashing is (usually) relatively simple. Certainly much simpler than the process described here.

[0] https://valetudo.cloud/pages/general/supported-robots.html

erulabs• 9 months ago

Thankful for people like this - with kids and family and work I’d probably have had this sit bricked for a year in my garage before finding time to tinker with it. Now I can just never buy any iLife product ever.

We should probably update this story to link directly to the hackers blog, they deserve the credit! https://codetiger.github.io/blog/the-day-my-smart-vacuum-tur...

goku125• 9 months ago

I wish I had the abilities of the engineer, plus the time he could devote to the problem.

Ability is a matter of patience and persistence. And both are the results of motivation. Anyone can learn anything as long as they really want it. (barring disabilities like depression that destroy motivation. But some people use even that as an opportunity to learn new skills that in turn help them recover.) But Time is an entirely different matter. You can find time if you really want to, but life has other priorities too - including time doing nothing (rest). Finding the extra time in between all that will depend on your craftiness. That's the true skill here.

m463• 9 months ago

I block this nonsense before it gets to the cash register.

HiPhish3• 9 months ago

That's always a good idea, but how many people have the resources to research these details? First of all you have to be aware that this issue even exists. Then you have to scrape the corners of the internet for whether an appliance has any anti-features, because no manufacturer will ever write "collects unsolicited data about you, we will break the appliance if you refuse us your personal information" on the box. And finally you need to be able to afford the time and patience for the whole process.

I don't own a smart vacuum cleaner because the trouble is not worth it to me. However, I can see smart vacuum cleaners being very good for elderly or disabled people, or someone who has very limited free time and could let the robot clean the house on its own while the owner is out. It is really disgusting that scumbag manufacturers are exploiting those people.

pfdietz• 9 months ago

The simplest way is to just not buy any IoT devices.

jacquesm• 9 months ago

I don't. I take it home, open the package and return it as defective.

You see the same everywhere. Lawnmowers even. A goat is more user friendly.

charcircuit2• 9 months ago

I suspect this is not the full story. Why would someone waste their time manually disabling a device? That makes me think that this device was doing something malicous to their servers, enough to trip an alert.

xupybd• 9 months ago

Not really. They probably flagged this as someone modifying the device and thought it could be someone reverse engineering it.

Mashimo7• 9 months ago

Might just be a "could not contact server for X days in a row" thing.

close04• 9 months ago

To "encourage" the owner to re-enable the connectivity. Google threatens to ban your Youtube account if you block ads. Companies will go out of their way to nudge, push, or force you to keep the data collection (or ads) gravy train going.

Telaneo2• 9 months ago

Why would someone waste their time manually disabling a device?

What what makes you think it was manual?

That makes me think that this device was doing something malicous to their servers, enough to trip an alert.

Sounds like a them problem, and not a problem that should affect the consumer (beyond losing functionality directly tied to the server, which bricking of any kind goes far beyond)

charcircuit2• 9 months ago

What what makes you think it was manual?

The article said that someone from the company logged in to his device and edited a file on it to disable it. Even if it was automatic someone would manually have to write a script to login and edit a file.

dylan6042• 9 months ago

"From there, he built a Raspberry Pi joystick to manually drive the vacuum, proving that there was nothing wrong with the hardware."

He should make these and sell them. It would be worth it to just drive it in "discovery" mode and give it the exact path to follow while cleaning. The constant inability to learn the floor plan is beyond annoying.

HiPhish3• 9 months ago

Depending on where he lives this might be illegal. Yes, we live in a cyberpunk dystopia where the manufacturer can break what you bought and then send you to jail for repairing it. You can read more about it here: https://consumerrights.wiki/w/Digital_Millennium_Copyright_A...

This shit is absolutely dystopian. The law must not just be reversed, manufacturers need to be taken to court for shoddy software. Insecure data collection and transmission should be treated the same as having unsafe electrical wiring. It is a defect that needs to be either fixed or the product recalled. As long as manufacturers are not just allowed to but rewarded for selling defective products this won't change. I expect the moment unsolicited data collection becomes a liability manufacturers will drop it like a hot potato.

analog312• 9 months ago

>>>> I expect the moment unsolicited data collection becomes a liability manufacturers will drop it like a hot potato.

Possession of the data needs to be illegal.

Here's how it could work. It's similar to how copyrights for music are enforced. A person whose data are found in someone's files or server can sue for "statutory" damages, which are levied on a per-offense basis.

1shooner2• 9 months ago

There's an exemption from Section 1201 for "Computer programs that control devices designed primarily for use by consumers for diagnosis, maintenance, or repair of the device or system".

kjkjadksj• 9 months ago

This is why lidar based robot vacuums are superior over random walk vacuums.

more_corn2• 9 months ago

That’s a fantastic idea. The blind bumbling has always irritated me too.

habibur• 9 months ago

https://news.ycombinator.com/item?id=45503560

which points to the actual blog of the author on github, instead of a news coverage of it.

booleanbetrayal• 9 months ago

Never connected my Roomba to the internet and it has worked fine for the past several years. It insists that I should connect to it via the app to resolve the occasional minor issue, but I would always ignore those. It's starting to show its wear and it's probably time for a new vacuum. I'm not sure if I'll be able to bootstrap one without connectivity, nowadays. Any good recommendations out there?

MrZander• 9 months ago

You might be interested in this project https://valetudo.cloud/

They have a list of supported vacuums

whatsupdog• 9 months ago

Valetudo is the best out there. I rooted my Roborock, and connected it my home assistant. It's super useful without having to send data to the cloud. The only thing is the developers are severely limited by how many vacuums they can support. I recently bought a Dreame X50 and it's still not supported.

testing22321• 9 months ago

Buy a used one the same as your current one. Find one with little use and you’ll be good for many more years.

bitwize• 9 months ago

Probably a felony under the DMCA.

I'm reminded of when AWS us-east-1 went down and all the beds made by EightSleep (business model: Juicero for beds) became disabled. EightSleep put all the significant control for their beds in the cloud, doubtless because they couldn't or didn't know how to hire embedded engineers, and the only devs they could find were node.js flunkies who only knew how to do cloud. Looks like the makers of this vacuum did the same thing; they didn't know how or didn't want to build just enough smarts to do the localization and mapping itself, and said "fuck it, we'll do it in the cloud".

observationist• 9 months ago

That's awfully generous. Forcing phone-home, remote control, data harvesting features to be always-on creates a huge amount of data that can be sold for a lot of money. It gets all the wrong people excited about investing and normalizing the level of intrusion into your privacy, with some faceless corporation harvesting gigabytes of data per month from the most intimate and vulnerable physical location in nearly anyone's life.

fron• 9 months ago

"Never attribute to incompetence that which can be attributed to malice" or something.

Clearly automatic beds have some degree of embedded software. The decision to put the controls in the cloud was certainly a conscious one.

goku125• 9 months ago

"Never attribute to incompetence that which can be attributed to malice" or something.

Isn't that the inverse of the Hanlon's razor? But I agree - the Occam's razor says that the inverse Hanlon's razor is most likely the case here.

cyberax• 9 months ago

And what the company did is a felony under CFAA.

StillBored• 9 months ago

Yes, I was thinking he needs an attorney to file suit against them for intentionally damaging his property, and then charge them for the 'repair' which would be the months he probably spent fixing it at a top grade engineering salary.

brenainn• 9 months ago

A good time to point out https://github.com/Hypfer/Valetudo.

I haven't tried it personally because my particular model of vacuum has some complicated and potentially destructive procedure to get the required access, but there's quite a few models where it can be installed easily.

darknavi• 9 months ago

I have it on two of my Roborocks and it rocks.

rendaw• 9 months ago

Recently discussed: https://news.ycombinator.com/item?id=45642571

goku125• 9 months ago

... because my particular model of vacuum has some complicated and potentially destructive procedure to get the required access

This right there is the root of the entire problem. We had IBM PC clones that you could recover and keep running for decades by easily replacing expansion cards, HDDs, RAM sticks, peripherals and even circuit components like caps, ICs and batteries. We used to partition our 50 GB HDD into a dozen little partitions and multiboot every conceivable OS out there. Now we have an oligarchic dystopia where even RAMs and batteries are soldered on and bonded with single-use resins instead of age-old screws. Even if you get through, you can't salvage or swap ICs because they're paired individually at device level. You can't reach the boot partition without a Ph.D in RevEng and a risk of still bricking the device 3 out of 4 times. And that's all for technological progress and security, they say! Those claims have as much credibility as their claims to making an honest living. It's weasel-speak, not engineering insight.

Modifying the device that you paid for should never be this complicated. Those greedy corpos are usurping the consumer's rights and wealth, plain and simple.

witx• 9 months ago

From my understanding (I might be wrong) the images are pre-built by the owner of the project right? I remember there being a form you fill and you receive a download link.

If that's the case what guarantees do I have there's no "funny business" on the image?

michalhosna2• 9 months ago

You can then cut the robot off the internet completely.

Which you cant do with the 1st party apps. This alone is enough for me.

The private builder is not great, but the reason are understandable, it is what it is.

Saris• 9 months ago

It runs entirely on LAN, ie; you just go to the vacuums IP address in a browser to control it. So you can block internet access for it if you're worried with no negative effects.

michalhosna2• 9 months ago

I am super happy with Valetudo.

Since the robots got cameras and microphones, it's a no-go for me to have it in my home connected to some cloud.

It's little bit challenging to orient oneself in the project (tip: read a couple of the last release notes), but once you do, it's great.

I bought a new robot vacuum that was specifically recommended by the Valetudo project (Dreame L10s Pro Ultra Heat). The rooting was straightforward and non-destructive. The robot works great.

And the usage is much better even for non-developer people (i.e. my wife), as the UI is simple, not constantly changing under your hands, no ads, no upseling. It's a tool as it should be.

StarGrit13• 9 months ago

Whenever I read about robovac. I wonder gow good are these robot vacs really?

Maybe it is just me, but surely would be less effort to hire a cleaner and they can do more than just vacuuming.

Jeremy1026• 9 months ago

Sure, but a cleaner coming twice is the same cost of a robot vacuum that will work for a couple of years, typically. They do an okay enough job, but they need to run daily, sometimes twice a day, to really keep up considering it's limitations.

StarGrit13• 9 months ago

It really depends on how big your properties is. A cleaner here could be done in less than an hour and there is no cleaner charging £150 an hour.

bastawhiz• 9 months ago

When I bought my Roomba in 2013, it cost as much total as I pay my cleaning ladies to come once every two weeks. If your floors get dirty easily, it's not really going to get them spotless, but it'll get them far cleaner than they'd otherwise be.

StarGrit13• 9 months ago

But the cleaners do more than the floors. Vacuuming takes me about 20 minutes once a week. I don't really see the point when I live in a 2 bed apartment.

_carbyau_• 9 months ago

People obviously find them useful. But I will reiterate a sibling comments recommendation, get one that can run Valetudo : https://github.com/Hypfer/Valetudo

StarGrit13• 9 months ago

I am not interested in getting one at all.

SoftTalker2• 9 months ago

I think it’s one of the most idiotic devices anyone could own. Buy a normal vacuum cleaner for half the price, spend 10 minutes a week vacuuming your apartment, and you won’t come home and find that your cleaning robot spent the afternoon choking on a shoelace.

raphman• 9 months ago

"most idiotic devices anyone could own"

Ever been to Chesterton's Fence?

Hypothetically, some people who own such an idiotic device might have pets that bring in lots of dirt from the fields, lose lots of hair, and get a little bit agitated by the normal vacuum cleaner but more or less ignore the robot vacuum.

Mashimo7• 9 months ago

But what if I'm too lazy to vacuum 10 minutes a week and don't want to do it?

koyote2• 9 months ago

Buy a normal vacuum cleaner for half the price, spend 10 minutes a week vacuuming your apartment

You obviously don't have a pet or a baby.

Make that 15 minutes of vacuuming AND mopping 3 times a day for a baby. Suddenly it seems very attractive to have a clean house while not having to find the time during the baby's sleep and nap time to do it manually.

You could argue the same for a dishwasher: I used to only use a single fork, glass and pot (eat out of the pot). A dishwasher seemed like the most idiotic device anyone could own if that's all you need to rinse every day. Until of course you add more people to that equation...(and maybe cook more than just pasta)

ethin2• 9 months ago

IMO a company should lose all control over technology once you've purchased it. Doesn't matter if it's "smart" or not. If the company wants to do something like telemetry, they can buy a license from you for that data. See how they like it when the tables are flipped.

blueboo• 9 months ago

Can't you trivially reframe the initial purchase as being subsidized by that license? Your $200 smart knife sharpener would be $300 if it weren't recording audio 24/7 (for VAD, surely!)

I don't like it either but here we are

0xffff22• 9 months ago

Sure, that's basically how Kindle pricing works ($X with ads, or $X+$Y without ads) and it's infinitely better having the choice. If Amazon ever gets rid of the without ad version they will lose me as a customer overnight.

Likewise, there are a whole lot of products that don't have an "unsubsidized" version that I simply refuse to purchase (or have purchased and returned after confirming that they will not work when locked in IOT jail where they can't talk to the internet.)

throwuxiytayq• 9 months ago

We’ve lived with companies that didn’t need to take pics of my dick while I’m shitting to subsidize their operation for as long as companies were a thing. Anyone saying this dick pic status quo is inevitable and necessary is too VC-brained to be allowed to run a company.

godelski2• 9 months ago

I think you frame it that way you need to offer the other version.

I do wonder how many people would buy non-spy versions of devices given the option. More specifically, what that differential in price would be too. At worst it would be interesting to have a price explicitly stating what our data is worth. Many people actually internalize that it's not that valuable, but doing this would make it explicit.

krageon• 9 months ago

It's not, things haven't gotten that much relatively cheaper (have you looked at phones? The biggest pieces of spyware you can buy?). This is a line corporations like to feed us so we feel guilty about being bad instead of putting that where it belongs: every CEO.

devn0ll• 9 months ago

I do not think the value difference is $100 ;-) In fact, the longer you use it, the more money they can make off of you. (In that sense, that $200 is already WAY too expensive to start ;-) )

So yeah, reversing this would make the most sense. The default is: local data only and not connected. They need to pay me to get data.

Just like car companies, phones, etc, should be forced to do that as well.

immibis• 9 months ago

They should be forced to present both options, and the price difference must equal the revenue they actually make from spying.

Tade0• 9 months ago

Then I invite them to offer such a product. I would love to buy e.g. YouTube premium, but as far as I know they still collect my data for advertising purposes, they just don't show the ads.

I want to buy privacy, but it's not offered.

amelius2• 9 months ago

Yes, but then it should be sold as such.

If you're buying a service and not a product, then the consumer has a right to know!

philistine• 9 months ago

That has been the way things work since the early 2000s. PCs started to come loaded with junk malware, and what those malware makers were willing to pay was the only profit the PC makers were making. Modern smart TVs are exactly at the same place; everybody is adamant that the only profit in TVs is with the sale of the usage data.

hinkley• 9 months ago

This could be the sort of thing that a Nielsen takes care of, just like viewing data for TV.

deafpolygon2• 9 months ago

... a Liam Nielsen with a particular set of skills?

Zigurd• 9 months ago

Advocating regulation against dark patterns is tantamount to summoning the antichrist. All the money will run away to Galt's Gulch, or maybe Texas.

rrruuuusssstttt• 9 months ago

Keep telling yourself that.

userbinator2• 9 months ago

First of all, it's Android Debug Bridge, which gives him full root access to the vacuum, wasn't protected by any kind of password or encryption.

Good. You bought it, you own it.

(I have no skin in this game --- my vacuum is as dumb as they come, and can be fixed with basic machine shop tools.)

goku125• 9 months ago

(I have no skin in this game --- my vacuum is as dumb as they come, and can be fixed with basic machine shop tools.)

The real question is, is that still an option? If it is, then for how long? Sadly, there are several other product lines that have entirely crossed that line a while ago.

334f905d22bc19• 9 months ago

If the day ever comes where this is not an option anymore, then I will just clean my house with a broom. Same thing goes for washing machines. If I can't buy one without internet, then I will clean my clothes by hand.

Smart things are the worst shit ever. They make everything take longer, given the debugging/upgrading overhead. Not buying into that. What would be smart, would be a washing machine that cleans, dries, sorts and folds my clothes. Without talking to facebook. I would buy into that, but I don't need to share my washing machine status on instagram

userbinator2• 9 months ago

There's a reason the vintage appliance community exists, and is growing. Replacement parts are still available for my decades-old vacuum cleaner, and even if they weren't, they're basic electromechanical parts that I could make or substitute easily.

CGamesPlay• 9 months ago

Sounds like the "remote kill switch" was probably "log buffer was full", given that it comes back to life when used on a different network.

markus_zhang• 9 months ago

Thanks for sharing. Removed this company from my list.

amelius2• 9 months ago

Wouldn't a blacklist make more sense than a whitelist?

Sharlin2• 9 months ago

These days? Probably not.

Sharlin2• 9 months ago

How did we let things get to this point? (A rhetorical question.)

noir_lord• 9 months ago

When smart devices started becoming common I looked at them and made the decision that it was a hard no from me - I didn't trust that they'd secure the data properly, I didn't trust the privacy aspect and I really didn't trust that they'd continue to support the product for the life of the hardware.

Here we are 10-15 years later and I see no reason to change that view in the slightest.

It surprises the none-techies I know that I don't have any smart devices in my home because they assume I would been a computer geek but its because I'm a computer geek that I don't.

My hoover is a switch connected to an electric motor, I can service it with a phillips screwdriver.

Even my TV is just a fedora box connected to a regular Samsung TV (which has never been on the network and never will).

stevenicr• 9 months ago

I wish every product like this had giant warnings on the box, in the online listing, etc.

I bought a robot vac (after owning an early roomba for some time) - Opened it up, ready to use it - instructions said download the app to make it work.

It's back in it's box somewhere around here and never used.

Vacuum bricked after user blocks data collection – user mods it to run anyway

Related Stories