These Smart Vacuums and Lawnmowers Can Be Hacked to Spy on You

The smart home trend continues as all manner of internet-connected devices make home life more efficient and convenient. But what happens when these smart gadgets get hacked?

During a presentation at the Defcon hacking conference, security researchers showed that cybercriminals can use Ecovacs smart vacuum cleaners and lawnmowers to secretly hack into their microphones and cameras for spying purposes, TechCrunch reports.

Related: Elevate your office with these work-from-home gadgets

Ecovacs’ Smart Robots Are Frighteningly Easy to Hack

After analyzing several Ecovacs products, security researchers Dennis Giese and Braelynn discovered a series of issues that could be exploited to remotely hack the robots via Bluetooth and secretly turn on their microphones and cameras.

The main vulnerability, researchers say, is that the Ecovacs robots allow anyone with a smartphone to connect. Hackers could theoretically take control of the robots from up to 425 feet (130 meters) away — and once that happens, hackers could potentially connect to the robots from even further away, since the robots are also connected to the internet via Wi-Fi.

“Their security was really, really, really, really bad,” Giese told TechCrunch ahead of the talk. It’s also possible to read Wi-Fi logins and maps of stored rooms, as well as access microphones and cameras with very little effort, all done directly through the robot’s Linux operating system, according to security researchers.

Related: Smart Tricks to Keep Your Home Network Safe

Robotic lawnmowers are more susceptible to damage than robotic vacuum cleaners

Security researchers explained that robotic lawnmowers are more vulnerable to attacks because their Bluetooth connection is always on, while robot vacuum cleaners are only active via Bluetooth when they are first turned on and after automatically restarting once a day for 20 minutes.

These smart devices don’t have any lights or indicators to let you know when their cameras and/or microphones are on, making it difficult to tell if they’re spying on you.

Some models technically play an audio file every five minutes to indicate an active camera, but hackers who know what they’re doing can easily disable that. “You can just delete the file or overwrite it with a blank file. So the warnings don’t play anymore if you access the camera remotely,” Giese said.

More Ecovacs Robot Safety Issues

In addition to the threats mentioned above, security researchers have also identified other vulnerabilities.

For example, data stored on Ecovacs’ cloud servers is retained even after a user deletes their account—including their authentication token. This means that someone could sell the vacuum cleaner after the account has been deleted, potentially spying on the next owner.

Another example is an anti-theft mechanism that forces the user to enter a PIN every time the robot is picked up. This feature was programmed carelessly at best, since the PIN is stored in plain text on the device, making it incredibly easy for hackers to read.

By the way, once an Ecovacs robot is compromised, it will be possible to hack other Ecovacs robots if they are within range.

Security researchers analyzed the following devices:

• Ecovacs Deebot 900 series
• Ecovacs Deebot N8/T8 Vacuum Cleaner
• Ecovacs Deebot N9/T9 vacuum cleaner
• Ecovacs Deebot N10/T10 Vacuum Cleaner
• Ecovacs Deebot X1 Vacuum Cleaner
• Ecovacs Deebot T20 Vacuum Cleaner
• Ecovacs Deebot X2 Vacuum Cleaner
• Ecovacs Goat G1
• Ecovacs Spybot Airbot Z1
• Ecovacs Airbot AVA Vacuum Cleaner
• Ecovacs Airbot ANDY

The researchers said they contacted Ecovacs to report the vulnerabilities but never received a response. The company also did not respond to an inquiry sent to them by TechCrunch.

Further reading: Thieves Disrupt Wi-Fi Security Cameras