Man Accidentally Gains Control of 7,000 Robot Vacuums (popsci.com) 51
A software engineer tried steering his robot vacuum with a videogame controller, reports Popular Science — but ended up with "a sneak peak into thousands of people's homes."
While building his own remote-control app, Sammy Azdoufal reportedly used an AI coding assistant to help reverse-engineer how the robot communicated with DJI's remote cloud servers. But he soon discovered that the same credentials that allowed him to see and control his own device also provided access to live camera feeds, microphone audio, maps, and status data from nearly 7,000 other vacuums across 24 countries.
The backend security bug effectively exposed an army of internet-connected robots that, in the wrong hands, could have turned into surveillance tools, all without their owners ever knowing. Luckily, Azdoufal chose not to exploit that. Instead, he shared his findings with The Verge, which quickly contacted DJI to report the flaw... He also claims he could compile 2D floor plans of the homes the robots were operating in. A quick look at the robots' IP addresses also revealed their approximate locations.
DJI told Popular Science the issue was addressed "through two updates, with an initial patch deployed on February 8 and a follow-up update completed on February 10."
The backend security bug effectively exposed an army of internet-connected robots that, in the wrong hands, could have turned into surveillance tools, all without their owners ever knowing. Luckily, Azdoufal chose not to exploit that. Instead, he shared his findings with The Verge, which quickly contacted DJI to report the flaw... He also claims he could compile 2D floor plans of the homes the robots were operating in. A quick look at the robots' IP addresses also revealed their approximate locations.
DJI told Popular Science the issue was addressed "through two updates, with an initial patch deployed on February 8 and a follow-up update completed on February 10."
The answer is obvious (Score:5, Interesting)
Robot vacuums do NOT need to communicate with a cloud server
The cloud is a trap
Run away
multi layered scam (Score:3)
Why wrestle with connecting your phone directly to your home devices through some ad hoc networking, when you can simply attach everything to a [highly insecure] central server and have a simple app that basically amounts to a little more than an HTTP request.
Plus when you shut down your back end services, all your old customers are fucked and have to buy new products.
Re: multi layered scam (Score:3)
Bluetooth is straightforward. Not even a little bit ad hoc.
Re: multi layered scam (Score:2)
Limited number of connected devices. And phones have limited range on their BT. And finally, the addressing limitations with BT makes it really a pain to make client-server applications as compared to a simple webpage.
But otherwise BT is great. (Except for audio streaming, absolute mess of a standard. But that doesn't apply here)
Re: multi layered scam (Score:2)
I'd still use wifi, but have a home server for managing the vacuum cleaner. Like a raspberry in the charger.
Re: (Score:2)
That's the consumer point of view.
From the vendor, cloud requirements ensure control and access to data they can mine or sell for additional profit.
That ought to be illegal, but consumer protection laws haven't really caught on with such things yet. Techies have been screaming about it for decades, but it seems that we've gone from being seen as whackjobs to simply being ignored.
Personally, I have a robot vacuum and I block it from Internet access - which means it doesn't do floor mapping and the vendor lo
Re: (Score:2)
That ought to be illegal, but consumer protection laws haven't really caught on with such things yet.
Yes, that's what's going on... the laws just haven't caught up in over twenty years because lawmakers move slow. It can't possibly be a deliberate lack of oversight to appease corporations who benefit from the information gathering.
Re: (Score:2)
It depends. If the cats of the world decide to rise up in revolution (which, given the quality of catfood, is entirely plausible), then being able to control all the vacuum cleaners would be the only defence.
Re: The answer is obvious (Score:2)
Re: The answer is obvious (Score:2)
It likely needs constant communication with a computer though, and people are stupid so it's easier to just do the cloud vs having the homeowner leave a computer on and installing software.
I'm working on the assumption that the onboard electronics are very inexpensive and it's the server that makes the maps and decides when and where to vacuum.
Re: (Score:2)
It likely needs constant communication with a computer though,
Why? My V1.0 Roomba doesn't.
Re: The answer is obvious (Score:2)
My early Roomba would trap itself fairly regularly.
Re: The answer is obvious (Score:2)
I don't think the cloud can fix that.
Re: The answer is obvious (Score:1)
Re: (Score:2)
My early Roomba would trap itself fairly regularly.
Don't worry, in future all robot vacuum cleaners will connect to real humans in Pakistan to get them out of trouble, just like the self driving taxis.
Re: (Score:1)
Who the hell shuts their computer down daily?
The power savings are a few cents a day (woohoo), not to mention when you need it 5 minutes later for something, now you have to start it up again. Do you also turn off your internet modem when you're not home? Do you turn the furnace/AC down when you're not home (only to have to crank it up when you get home, making it run longer and use more power)?
Re: (Score:2)
They don't strictly "need" to. But consumers demand they do. They are the ones questioning why they can't access the control interface for their robot from outside the house, or why they would need to do something as "ridiculous" as enable wifi on their phones to access their home network.
The cloud is a solution to the problem that many people are a combination of stupid, or just creatures that put comfort and convenience above all else, and as such virtually all robot vacuums are cloud connected.
Re: And mark my words the elona will be (Score:3)
Winning by any means necessary has been the plan for decades. Mandate for Leadership (9 publications between 1981-2023). Chapter 29 of "Project 2025: Mandate for Leadership" describes how a conservative President can use his limited authority over the FEC to provide strategic influence over election outcomes. Specifically through vetted appointments (a process described in an earlier chapter). Then under the control of a trusted appointee, the President then directs the DOJ to defer to the FEC in all interp
Re: (Score:1)
We learn from a Google deposition that they're being piloted remotely rather than self-driven
No we didn't. Are any other things you say also gross mischaracterizations/misinterpretations of the facts?
Re: (Score:1)
*waves to everyone's buddy, rsilvergun's dual personality*
Re: A white hat hacker did the same thing with Tes (Score:2)
"We learn from a Google deposition that they're being piloted remotely"*
*citation needed
My guess is you learned the wrong thing.
Opportunity missed! (Score:3)
Man Finds Out He Sucks 7000 Times More Than Other People
This could have you been your headline slashdot but you let it get away!
Re: (Score:2)
...also provided access to live camera feeds...
This is an opportunity for some VacuFans site specializing in amateur voyeur foot-fetish content. Let people opt-in for the cameras only and think of the unique perspective these things must have. Cash money. Probably.
Grandmas IPO story. With milk and cookies. (Score:5, Insightful)
The backend security bug effectively exposed an army of internet-connected robots that, in the wrong hands, could have turned into surveillance tools..
Or one might argue that a 7,000-strong node comprised of all manner of deep-seeded surveillance hardware was purpose-built to be a surveillance tool.
(I mean for shits sake how often do we accidentally stumble across a network like that? Even PRISM is turned on right now.)
Wrong framing. (Score:3)
FTFA:
Home owners are grappling with the privacy cost of smart homes
People have been decrying privacy invasions since the beginning of the deployment of telemetry. What's happening now is the chickens have come home to roost and suddenly people are in disbelief that it could somehow happen to them, like they were somehow exempt.
To everyone who is playing stupid games: you are bound to win a stupid prize.
Ms. Azdoufal says... (Score:5, Funny)
"For 20 years I've tried to no avail to get him to run just ONE vacuum cleaner ONCE! Now he's running 7,000 across the globe? I quit!"
Yep, but keep trusting DJI (Score:2)
Nope, nothing to see here. Move along.
Re: (Score:2)
This bug would allow anybody to access the surveillance network, but even if it were bug-free, obviously DJI would have total access. It's not hidden, that's how their bots work. As a matter of fact, that's how a lot of things work -- cars, TVs, phones, you name it.
If you didn't want to be surveilled, it would take quite a bit of effort and expertise to avoid it, and there's quite a few products you wouldn't be able to use at all.
I'm not at all in favor of it, but that's the way our world works now, and it'
Client Secrets passed around on Client Apps (Score:2)
They are everywhere.
Remove the cert pinning, setup a mitm and watch your smart bbq toaster bucket leak secrets like mad.
It'd be fun if it weren't depressing (because you just got laid off for being overpaid in lieu of an offshore team that "delivers on time" and is cheap)
Of course, not bitter, just progressing poorly through the acceptance phase =D
Peak, Peek, Pique (Score:3, Funny)
"peak" is not the correct spelling in that context, it is of course "pique".
ok, "peek".
Re: (Score:2)
Now you're nitpicking...
Re: (Score:1)
Perquisite? Hehe... prerequisite is the word you're looking for.
Vlad... pique (a feeling of irritation or resentment resulting from a slight, especially to one's pride)
Re: (Score:1)
Huh... you got me with that one.
Second word I've never heard I've learned on here... the other one was salp.
Manual control of robot vacuum (Score:2)
Re: Manual control of robot vacuum (Score:1)
My guess is... (Score:2)
...that he has now a very clean house.
Not exploit that... (Score:2, Insightful)
Main gained control of 7,000 vacuums (Score:2)
But now he's clean.
If you think that's scary I have two words for you (Score:2)
Amazon Sidewalk
We are not stupid (Score:2)
The backend security bug effectively exposed an army of internet-connected robots
Let's make it really clear here... this WAS NOT a bug. It was intentionally done that way. Chinese companies LOVE stealing anything and everything so they made backdoors to allow themselves access to things they've already sold.