ABC News hacks into popular robot vacuum, watches owner through camera
abc.net.au
abc.net.au
It currently supports Dreame, Xiaomi, Roborock and some others. But not Ecovacs. And not sure it prevents this type of Bluetooth vulnerabilities.
I respect their "learn to solder" stance but it's a fact that a lot more people would be involved in the project if it wasn't required.
> As you might know, we looked into Ecovacs as an alternative for Dreame&Roborock. However, we found security and privacy being completely broken. If you have a X2, a Goat lawnmower, or newer than 2023 devices, you might want to turn them off for now. There is a BLE RCE, that lets an unauthenticated attacker send a payload via Bluetooth, that gets executed as root on the device. It does not appear that Ecovacs wants to fix that. More information: https://twitter.com/lorenzofb/status/1822002515279270079 https://techcrunch.com/2024/08/09/ecovacs-home-robots-can-be...
Can Valetudo provide artificially blocked cloud features? For example the Roborock S5 doesn't have persistent maps, though it would be trivial to just keep one loaded in the cloud, but Roborock would rather you upgrade to an S7.
Would that work?
I have xiaomi unit and I haven't connected it to an app, so it has no connectivity. It does it's job - cleans house 1st floor.
Is it useful to target specific places to clean? Ok, that is a feature that would be useful but I can live without.
Remotely starting? Fancy feature not sure I need - you can aswell start it when leaving the house. Maybe useful for some people when wanting to cleanup after guests remotely, but then again who knows what's dropped on floor there.
It doesn't. And it isn't like hosting a web-portal is some kinda alien technology that can only be done in the cloud. There's absolutely no reason that a robot vacuum couldn't serve its own web interface.
If it involves vacuuming, mopping, or returning to their docks, they are pretty useless.
> “Ecovacs has always prioritised product and data security, as well as the protection of consumer privacy,” they said in a statement.
Still not fixed, today.
Mobile Webcam exploit at 100 meters.
However I also agree about not putting smart spy devices in my home - mine is a very basic cheap model with no cameras or wireless connectivity. Absolutely INSANE to have any type of connected camera inside your home. Even baby monitor cameras, such a huge vulnerability for so little utility.
Made me realize the importance of defining your use case as narrowly as possible, when buying home appliances.
It seems silly, because as the parent said, it doesn't take long to vacuum normally, but it's one chore struck off the list and becomes something you rarely have to think about anymore.
Coming home to a freshly vacuumed house is a great feeling. With a robot vac, you get to have that feeling every single day.
Robot vacuums aren't as effective at vacuuming as a human would be, but it also doesn't matter. Whatever it missed today, it'll get tomorrow.
Yes, you need to adjust somewhat your living style. If you leave a lot of clothing on the floor, or have cables just laying about, the robot vac will find them and get stuck. You should clean those up anyway - but within the robot vac-owning community it's often a joke that you have to "roomba-proof" your house.
The upsides outweigh the downsides by far.
For me at least, my robot vac stops well short of that.
But the feeling of smugness I get while I sit on the couch doomscrolling or watching Netflix, while being able to tell myself "Look at me, I'm an adult! I'm doing the chores!!!" as my extremely dumb non wifi robot randomly bumps around my lounge room is priceless. Totally worth the couple of hundred bucks I paid for it, and the minor rearranging I had to do to make my apartment suitable for it to roam around.
It'd say that's a tangible improvement to your life. Less mundane chores, more leisure time to unwind after a long day.
Permanently removing something from the "todo" list is always a significant positive.
But also, this for me is way more than just "one more thing off the todo list", it's the smugness of "That todo list item is being handled WHILE I'M SITTING ON THE COUCH STUFFING AROUND! HOW GOOD AM I???" :-)
(I acknowledge this is a fairly childish reaction, I'm sure I'll grow up and get over it one one day, I'm only 57 after all...)
Not taking away from the benefits of automation and getting a bit of extra free time (nobody is thinking how cool it is to handwash all our clothes all the time, do we), but if you would say that instead you could do 10-15 mins meditation, learn something new or have a longer run outside, now that would be an improvement. Those passive activities you mention are one of the worst one how to spend extra gained time (albeit very popular due to easy access and addictivity).
Just my take on some chores, I honestly believe making the life too easy has some negative consequences later and that's how I raise my kids, contrary to many other parents.
Run the robot daily (while you're at work or something).
What brand is it? So many these days have both cameras and wireless
If a network connection is a non-starter, your choices are way more limited. It looks like the eufy 11s doesn't have any sort of app / wi-fi support.
I think OP's issue with Roomba is simply that it was a Roomba (depending on when they tried it); I did a lot of searching before deciding on the Q Revo, and it seems like iRobot had been relying on the Roomba brand name for some time and until very recently was still playing catch-up. Not sure they have caught up when it comes to navigation and the control app.
so no smartphones for you?
Sure, if you live in a studio, but a lot of people don't.
Robot vacuums often pick up things I miss, because they tend to be thorougher.
> getting it unstuck from corners or wires
Yes, this is annoying. Not everyone has stuff that these vacuums will get stuck in.
> making sure all potential obstacles are picked up,
If you have small clutter on the floor, you probably need to pick it up anyway if you vacuum yourself.
Robot vacuums are for people who have a track record of not vacuuming :-) If you have the discipline to vacuum on your own, then there's no need for a robot one.
Bought a lidar one too (BotVac) so never had to worry about camera feeds and it’s smart about navigating the rooms, not even connected to the net.
Also, Roomba is absolute trash compared to any other brand. Replaced my Roomba with a different brand a few months ago and it's a totally different experience.
Even my sister ended up buying one after I talked about it with her. She was looking for a way to make her daily nighttime kid cleanup ritual less work. Same deal with her: it takes longer for it to do its job than if she were doing it herself, but while it's vacuuming she can clean something else, and be ready for bed earlier than she'd otherwise be.
This isn't a problems if you use open-source replacement firmware like Valetudo (https://valetudo.cloud/).
I run the robot when I’m outside and have it do two passes which results in very good results. I get tremendous enjoyment from knowing a machine is doing the work I absolutely hate, with quality results. Would absolutely buy again.
Others use both. LiDAR for walls, cameras for object identification below the LiDAR plane, directly in front of the robot. That’s how the fancy ones avoid socks or cables or other small things.
https://bdtechtalks.com/2021/06/28/tesla-computer-vision-aut...
Everyone else uses LIDAR in some form. Tesla's cameras can and have been fooled on many occasions.
If the algorithms are fed with incorrect data, they will produce incorrect results - such as driving full-speed into a parked, white colored, semi-truck.
I'll let you stew on that one for a minute...
Then that means the vision processing isn't far along yet to be viable for a car. There is no fundamental reason why it couldn't work though. With either stereoscopic vision or more temporal processing you could obviously detect when things are only painted on a wall surface, with both there really is no excuse to still fail except limited processing power.
https://www.theverge.com/2024/5/7/24151497/tesla-lidar-lumin...
That's a compelling use case for me but considering how many of these vacuums have had privacy issues, I stuck with Lidar (people cast aspersions on the Chinese companies but US manufacturers have track records that don't inspire confidence either - just ask the Roomba employees who got their naked pics leaked online)
I have a pet (cat) that unfortunately poops just outside her box most of the time, despite a lot of different ideas and approaches with the help of our vet. She's old and has lower back pain issues. It ends up on a litter mat or the wooden floor, so it's not that hard to clean up.
If I had a housemate that pooped inside not in the toilet, they would need to be even less able to manage their shit, so to speak, and more loved than our cat, or they would be out of here very fast.
Ceilings tend to be less cluttered than floors so it is easier to figure out the shapes of rooms and their relationships by looking at the ceiling than by looking at the floor.
These exploits promise to be the rule, not the exception -- and not (just) because this company might have to comply with its national imperatives.
Assuming companies get paid for deploying hackable devices, it gives them an unfair competitive advantage relative to ethical companies (who would have higher prices).
Given the information asymmetry (promoting the devices as simply reliable vs the difficulty and complexity of hacking them), this advantage is protectable.
Thus if, or since, the market gives enduring advantages to this kind of exploitation, we can expect exploitation to be the rule, and product/technical leaders will be selected who comply.
A key aspect (noted in the article) is the capture of technical standards organizations by the companies they monitor. Usually this is good (keeping standards more realistic, timely, and relevant). But that means one can't rely on those organizations to protect end users (whether business or consumer).
The alternative of government politicized regulators would kill technology advancement, leading to a race to less-regulated jurisdictions (protected by fair-trade rules). The same is true of product liability schemes.
So exploitation is the rule, and technology can't regulate itself or be regulated.
Meanwhile, technology reaches into every aspect of work and play.
Entrepreneurs who solve this problem would create tremendous value (yes, some of which could be captured).
But it has its own little robot brain, and I have a pocket supercomputer along with a LAN to connect betwixt these two things.
I know that realtime clock modules are useful for scheduling and are not free, but that doesn't mean that a device needs to call home in order to start sweeping the floor at a particular time.
The concept of a LAN is a non-starter for many folks. My measure are my in-laws. They like technology but don't understand it. My mother in law does not know what LAN means or how to access it.
These things phone home for the apps that lets normal people like that run them.
They don't need to know terms like LAN or MDNS or Bonjour or whatever.
If that's not accurate enough due to drift, then it can also rejigger the clock during subsequent runs of the app.
And that's probably good enough.
It's just a robo-vac -- nobody is going to be late for work or even annoyed if it drifts a bit and a sequence starts at 7:02:37 instead of 7:00:00.
But lidar is not a camera and exposes much less than a video feed does... why does a vacuum need a camera is a different question.
Obstacles: Not sure what kind...? It's either a large enough obstacle that it will bounce off and continue vacuuming, or small enough that you should probably pick up.
Zones: Solved with the virtual walls that come with the old style Roombas.
Schedules: My Roomba has it - no need for networking.
I doubt their "smartness" will figure out that it may get stuck under those chairs. But even if it did, I wouldn't allow it to communicate home.
Cheaper than a lidar, although I’d never buy a camera one.
Basically the reality is, because you're held hostage by the very few manufacturers making these also gating most functionality behind "let us surveil your entire home permanently".
Does anyone sell one that barks? Or makes it sound like 2-3 angry people are having a conversation about guns from different points of a room?
In other words, are there any HW-level privacy-preserving CCDs (for lack of a better word) that provide an image in a format that can't be snooped in? Like say, I need an 'image' that I use to detect certain objects - I don't really need a 1920x1080 24bit RGB image @ 30Hz?
In fact, with such a mechanism, certain other metrics (performance, better object detection) could also improve in addition to privacy?
There's no way to make information that can only be used in the way you want it to.
I would assume that the image is handled in software: IE, the vacuum runs software that uses the image as one of its many inputs to decide where to steer the vacuum. Doing this as hardware-only is technically possible, but in practice, it's probably so difficult to implement it that way that it may be impractical. (For example, how can you remotely update the vacuum to fix a bug in the algorithm if it's burned into a chip?)
Edit: I should point out that the vacuum is probably using a standard, off-the-shelf, camera part. They could consider figuring out how to blur the image (by manipulating the lens during manufacturing,) but I wouldn't make any assumptions about their algorithms to assert that this is practical.
I am not saying the actual CCD is different but it’s something akin to a filter between the HW and the rest of the system to prevent full color image access.
Information theory says this is impossible. https://anishathalye.com/inverting-photodna/
Really I think I am imagining homomorphic encryption style techniques.
I do worry that companies essentially use the webcam as their main profit margin (sell ads!) with a rubbish trash compactor added as a mere ‘free service’.
Honestly, it just makes more sense to follow good security practices. Protecting the Bluetooth interface is much more practical than what you propose.
FWIW: Military jets encrypt transmission on the wire between chips and components. But, they have to worry about a lot more than casual Bluetooth snooping.
I am more worried about the robovac companies really being an ad supported spying company with robovac as a mere shipping vehicle.
They mainly use lidar for navigating the room, the front camera is to help identify obstacles so they're not run over. They also advertise using the camera and a two-way microphone with remote control through the app, so you can look around your home or talk to your pets while you're away.
I strongly suspect anything a robot vac does with cameras could easily be done with super low resolution sensors. Even if you needed to put 2 of them in stereo to get depth perception that maybe you could compute from HD video.
https://dontvacuum.me/talks/HITCON2024/HITCON-CMT-2024_Ecova...
Title: We hacked a robot vacuum — and could watch live through its camera
I point blank refuse to have a computer on wheels with cameras and microphones roaming my house with a direct connection to China. It really blows my mind that the majority of people seem to think that's fine.
The biggest disappointment has been Tuya patched the exploits which let tuya-cloudcutter work without dismantling devices.
I don't know how we do it, but I want a world where IoT is required to be independent of cloud and flashable.
Uhhh, actually, I guess there aren't any Ecovacs models yet supported by Valetudo, unfortunately :\
Btw has anyone done an analysis of Bobsweep (Canadian company) vaca? They kind of position themselves now as "privacy focused".
I think this would be intuitive to many people, physically touching the security wand on the devices you want to connect, and voila. Of course, this wouldn't work for the companies selling you this junk where they insert themselves and their paywall in between.
I'm just wondering if TLS could be (ab)used for this use case.
Control of the device requires an iOS/android app and communication takes place via the internet.
My model has a camera in order to map its surroundings.
The app makes a map of the space, separated in rooms, and thus possible to request or schedule the cleanup of a specific room or zone. I often start the cleaning process while not at home.
It's an Ecovacs vacuum. Not an irobot, as most people were probably thinking.
EDIT: the link in the app phrases it "The world's largest home robotics company has a problem - its vacuum cleaners can be hacked from afar".
Maybe it's just me, but when I hear "popular X" rather than a brand name or "the most popular X" I generally skip past the number one most likely option in my mind