Hackers could break into Ecovacs vacuums and search their owners’ homes. Security researchers suggest that both the brand’s vacuums and lawn mowers can be hacked via Bluetooth.
Robotic vacuum cleaners are equipped with cameras to create a map of the room. Some examples give you the opportunity to monitor what is happening in your home. Unfortunately, you are not alone: Security experts Dennis Giese and Braelynn analyzed several Ecovacs devices and discovered that there are several vulnerabilities that hackers can exploit. In this way, they can access cameras and microphones thanks to Bluetooth technology.
Ecovacs Robotic Vacuum Cleaners
The problem is that the vulnerability allows you to connect your phone to the Ecovacs robot (via Bluetooth) and then have complete control over the device. This means you can listen and watch at home. The initial hacking must be done via Bluetooth at a maximum distance of 130 meters from the robot, but once you have access, you can view images and listen to audio anytime, anywhere. After all, robotic vacuums and lawnmowers are connected via WiFi.
Jez says Techcrunch Security is really bad. And perhaps worse, the company didn’t respond when experts brought up the issue. As a result, they don’t expect the vulnerabilities to have been patched. Furthermore, the data on the bots seems to remain on Ecovacs’ cloud servers, even after you delete your account. If you sell your smart robot vacuum cleaner, you might be able to spy on the buyer: even the authentication code is still stored in the cloud.
Access to cameras and microphones
Hacking is a widespread problem. “It sends a payload that lasts one second, then it connects back to our device. So, this can, for example, connect to a server on the Internet. From there we can control the robot remotely. We can use Wi-Fi to read the data, we can do everything.” [opgeslagen ruimte]”Reading cards. We can do that because we use the robot’s Linux controls. We have access to cameras, microphones, everything else.” Hackers can also disable the system that warns when a camera is on.
There is a mitigating circumstance, especially for people with Ecovacs robot vacuums. Bluetooth is always on in lawnmowers, and in vacuums only for 20 minutes after the device is turned on, plus once a day when it is rebooted. So hackers have to strike at a specific time with robot vacuums, making hacking much more difficult.
Learn more about robots and subscribe to our newsletter.