In case anyone’s interested, there’s actually open-source self-hosted robot vacuum firmware for select models
This is great, but outside the security aspects of things. What else can this firmware do that I can’t with say, the roborock? Am I giving up functions?
Unfortunately you’ll have to do your own research, I only know this exists and have never used it because my vacuum is incompatible.
I mean, this has been known about for pretty much all smart vacuums.
But who the fuck is going to use the layout of your house for anything?
I feel the same way, I dont care really care about them knowing my house layout, but they shouldn’t. We cant let companies get away with infringing on our freedoms and privacy.
The secret police
If you have a robot vacuum, and the robot vacuum makes a persistent map (as opposed to the older “dumber” models that just bounce around randomly), they all send that map back to some remote server. In fact, most of those robots won’t even enable the mapping feature unless they’re connected to the Internet (which is absolute bullshit considering most of those robots generate, process, and store that map locally, so there’s literally no reason to send it off somewhere).
So your options are to just use the robot without ever connecting it to the Internet and be happy with the reduced featureset, root the robot and install Valetudo on it, or just vacuum manually. But until manufacturers are forced to let us actually own the smart devices they sell is, under no circumstances should you ever let one touch the Internet.
Wait till you find out what your wifi can do.
Port Scanning blocker was eye opening to how many websites just wanted to check in on me.
Oh, damn! Thanks for reminding me to add that extension since I reinstalled my browser.
So how are they port scanning yiubif your behind a firewall.
Your browser is the trojan here. Install the plugin ‘Port Authority’. Then browse to ebay or IMDB for a demo.
aw he got in my head
Sure “can” do but isn’t.
At this point, if you buy a smart thing you have to know it’s spyware.
My home assistant isn’t spying on me. My Zwave devices are not spying.
I wish I was so naïve
Home Assistant is open source and self-hosted and doesn’t require internet to operate. The z-wave devices connect directly to the device running Home Assistant. If you want Home Assistant to be private it absolutely can be.
I’ve been looking into robotic lawnmowers, and they’re basically the same. The more primitive ones have a hall effect sensor under their snout feeling for a wire you bury around the edge of your yard, and do the “go until you hit something, turn a random amount, repeat until low battery, follow perimeter to dock” or they require phoning home in some way, shape or form.
Meanwhile, some guy’s got an open source system that runs on a Raspberry Pi on the mower itself.
I guess I’m willing to believe that some of the LIDAR or camera-only guided mowers need some serious processing power to create the maps they use for guidance around the yard, and that’s more practical to do on the company’s servers than on the device itself…except not really; we’ve got decently powerful ARM SoCs that don’t cost much, don’t take a lot of power to run, and can do that job. The reality is, you can’t get a pedometer app for a smart phone that doesn’t broadcast sensor telemetry to two continents these days.
Since I dont see it mentioned, the company is
iLife
iLife makes vacuums that map your house and can be remote controlled
Just so we are clear. You should all up your name and shame game.
For real. It’s wild how often people don’t just straight up call out bad corps.
All modern robot vacuums do this. Amazon and Zillow actually buy that data too.
o7 thank you for your service
Oh crap. I had one. It committed suicide off the stairs
On paper all of this stuff is a great idea that would make our appliances more functional.
In reality, the best case scenario is that it’s sold to our corporate overlords so they can slap an ad on your refrigerator and sell you more plastic waste.
Worst case, it’s sold to ICE or some other fascist regime.
Worst case, it’s sold to ICE or some other fascist regime.
Every single government that has a contract with Palantir for Gotham or even whatever the fuck they’re doing with the UK NHS data, is reason enough to know this kind of shit is a bad idea. The entire existence of Palantir makes this kind of shit a bad idea by default.
Even if they’re not using lavender or where’s daddy (yet), I do not want them to have a detailed layout of my home, in addition to all the other information already being collected.
If the day comes when any government needs to crush civil unrest, Palantir gives them an easy button to weaponize your data against you.
Every gadget spies on you if you think about it.
I remember about news of some Israeli intelligence operatives who jogged around their HQ only to be outed by their tracks on Strava.
I remember army officers and cia folks, specifically. It wouldn’t surprise me that israel got caught as well.
“Someone — or something — had remotely issued a kill command,” he wrote.
“I reversed the script change and rebooted the device,” he wrote. “It came back to life instantly. They hadn’t merely incorporated a remote control feature. They had used it to permanently disable my device.”
In short, he said, the company that made the device had “the power to remotely disable devices, and used it against me for blocking their data collection… Whether it was intentional punishment or automated enforcement of ‘compliance,’ the result was the same: a consumer device had turned on its owner.”
Treasonous malware.
If he blocked the data collection how did it get the kill command?
Outgoing vs Incoming
In addition, Narayanan says he uncovered a suspicious line of code broadcasted from the company to the vacuum, timestamped to the exact moment it stopped working. “Someone — or something — had remotely issued a kill command,” he wrote.
“I reversed the script change and rebooted the device,” he wrote. “It came back to life instantly. They hadn’t merely incorporated a remote control feature. They had used it to permanently disable my device.”
In short, he said, the company that made the device had “the power to remotely disable devices, and used it against me for blocking their data collection… Whether it was intentional punishment or automated enforcement of ‘compliance,’ the result was the same: a consumer device had turned on its owner.”
They kill switched it remotely. Yikes.
All IoT devices do this to keep you from blocking their data collection. They won’t work reliably without a regular ping home. They lock up if they can’t phone home frequently enough.
Haven’t had one yet. Block all IOT devices from internet all work fine.
More likely it killed itself after not being in contact with home base. Since it worked fine elsewhere
I used to be on a mailing list where American companies offered money to people in the third world for menial manual tasks. Like sending pictures of random crap from different angles and such. One time I got an email offering 4 of these things and $100 and all I had to do was put one of them in my home and use it for a week and give the other 3 away. Goes without saying they’re clearly a privacy nightmare.
At first I thought ”Well, duh!”, but the manufacturer having a remote kill switch when he network blocked his vacuum from sharing his home map data with them, as well as unprotected root access when connecting to the vacuum… urgh.
The engineer says he stopped the device from broadcasting data, though kept the other network traffic — like firmware updates — running like usual. The vacuum kept cleaning for a few days after, until early one morning when it refused to boot up.
After reverse engineering the vacuum, a painstaking process which included reprinting the devices’ circuit boards and testing its sensors, he found something horrifying: Android Debug Bridge, a program for installing and debugging apps on devices, was “wide open” to the world. “In seconds, I had full root access. No hacks, no exploits. Just plug and play,” Narayanan said.
All crappy IoT devices ever made. They aren’t used in bot nets all the time because hackers like the challenge of hacking them so much. Security simply isn’t a priority.
The ‘S’ on IoT stands for security!
A few years ago I noticed an annoyance with a soundbar I had. After allowing it onto my WiFi network so we could stream music to it, it still broadcast the setup WiFi network.
While dorking around one day, I ran a port scan on my network and the soundbar reported port 22 (ssh) was open. I was able to log in as root and no password.
After a moment of “huh, that’s terrible security.” I connected to the (publicly open) setup network, ssh’d in, and copied the wpa_supplicant.conf file from the device to verify it had my WiFi info available to anyone with at least my mediocre skill level. I then factory reset the device, never to entrust it with any credentials again.Is it just me, or is having ADB exposed physically not that big a deal?
Tend to agree, security is always the goal but if someone is in my house hacking my vacuum, I have bigger issues. The no-notice remote kill is the bigger issue to me.
The much bigger concern is that the pathway used to send the remote kill command could very easily be utilized by nefarious actors.
To do what, wear out one section of carpet faster than the rest of your house?
It could overcharge and overheat the battery, leading to explosion or at least fire.
If a hacker can get into the device remotely it can be an entry point to your home network.
Remote “kill”
Where does it end? First it wears down your carpets and then we’re in Maximum Overdrive.
It finds a sharp corner to rub against and hones itself into a stabby bot.
It is not good. But in most cases just adb doesnt grand root access. That’s just bad.
NO! It’syour device, you should have root! The fact that the manufacturer gives their product owners root is a good thing, not bad!
I will die on this fucking hill.
I agree with you. But granting root straight from adb with 0 auth is not good.
But on this threat model? Why would it not be good?
It has to physically accessed on the PCB itself from what I gather.
There are 2 “threats” from what I see:
-
someone at the distribution facility pops it open and has the know how to install malware on it (very very unlikely)
-
someone breaks into your home unnoticed and has the time to carefully take apart your vacuum and upload pre-prepared malware instead of just sticking an IP camera somewhere. If this actually happens, the owner has much much bigger problems and the vacuum is the least of their worries.
The homeowner is the other person that can access it and it is a big feature in that case.
-
At first I thought ”Well, duh!”
There was an ARS article years ago about it…
Yeah that issue has been around for at least a couple years now. Luckily my robovac doesn’t have WiFi or bluetooth
It has a clock display for time?
Nope. Just blacknwhite bezel face cover with a start button
Why would anyone need a moving clock?
I meant on the station to schedule cleanups, e.g. recurring ones. Useful if the noise distracts you and you want it done when you’re not home kinda thing
That makes more sense.
To display time?
