Hackers take control of robot vacuums in multiple US cities and abuse owners, yells racist slurs

Luu Tuyen@lemmy.world to Technology@lemmy.world – 359 points –
Hackers take control of robot vacuums in multiple US cities and abuse owners
abc.net.au
50

Despite the slurs, Mr Swenson was glad that the hackers had announced their presence so loudly. It would have been much worse, he said, if they had decided to quietly observe his family inside their home. They could've peered through his robot's camera, and listened through the microphone, without him having the slightest clue.

Who says they didn't???

Even if Mr Swenson had used the same username and password on other sites, and if those credentials had been leaked online, that still should not have been enough to access the video feed or to control the robot remotely. These features are supposed to be protected by a four-digit PIN. The PIN code was only checked by the app, rather than by the server or robot.

I don't even...

On May 24, the same day that Mr Swenson's device was hacked, a Deebot X2 went rogue, and chased its owner's dog around their Los Angeles home.

The robot was being steered from afar, with abusive comments coming through the speakers.

...

Late at night, an Ecovacs robot in El Paso started spewing racial slurs at its owner until he unplugged it.

The future is stupid.

These hackers are stupid.

I dint understand how you have the intelligence and patience to learn enough to hack one of these, but the go with some unoriginal racist bullshit.

Could've actually made it fun and original.

I’ve no idea how they hacked. But most likely the vulnerability was a mistake the vacuum cleaner manufacturer did, after using second tier software to “save costs”. And they probably skimped on paying the coders, if any

Most likely someone more sophisticated found the exploit, tried to get a bug bounty , was declined by the penny pinching company, and they posted to a place people like your comment inhabit.

If I’m right, this is only the start of problems with this cleaner, because it will happen over and over?

There's different types of hacking. Finding and coding up an exploit? That takes skill

Then, they post it in a corner of the Internet somewhere to get appreciation for their achievement, or maybe even sell it on the dark web (or someone else sees it and packages it up in a state to sell/share)

Now, using the exploit? That's pretty easy. It requires some technical ability, but not much. It's just installing and configuring stuff, then using an app

So here's what I think happened. Someone found the exploit, and posted about it in a hacker community off the beaten path. One thing led to another, and somehow a group of edgelords get a hold of it. As a group, they manage to get it working, and act like edgelords

The original hacker might have been related, but real hackers are cautious or quickly caught - they probably solved the puzzle, maybe played with it a bit, then posted their findings and moved on to the next puzzle

Thank god for projects like Valetudo thar let you break your stuff away from the cloud.

Semi-related story time. I bought a Midea Cube dehumidifier for my laundry room. My dryer has been broken for years, and I've found that air drying clothes makes them last a lot longer. It's hard to air dry inside, hence the dehumidifier. My plan was to control the dehu automagically with Home Assistant along with some fans, so people could just click a button to turn all the shit on to dry their clothes.

After buying it, I realized that the dehumidifier could only be controlled via the cloud, and the cloud control was unreliable as fuck. With the exception of tech people, nobody is willing to deal with my flaky bullshit. If the button doesn't work consistently, my partner, her other partner, and my FIL aren't going to bother. Luckily, a very industrious person made this thing that let me rip out the hardware responsible for cloud connectivity and replace it with a cheap microcontroller. Now, my dehumidifier talks to my Home Assistant server directly via MQTT and it just fucking works.

Give me local-only control or fuck off, I'll take control myself. It's not much to demand, and shit like what this article describes absolutely deepens my conviction around local-only control.

Super cool! Apparently the same guy developed both Valetudo and the Midea dehumidifier project you linked.

I thought the deal I got on my KuKluxKlean was too good to be true!

Is this the one that specializes in picking up soiled Kleenex wipes on the ground? The one whose icon is peppy and targets incels?

"Why do they have to make everything about race? It's like they're obsessed. Nobody cares what color you are!"

Also these racists: "Hmm. You know what's a good use of my time? Going out of my way to hack a Roomba so I can call my neighbor the N-Word."

Why do these things need to be internet connected in the first place?

To harvest your data and sell it to anyone who'll pay for it; including racists, hackers, and criminals.

I want them wifi connected at least so I can set my own schedule or control with Home Assistant. They don't need to connect to any server except my own.

I would think Bluetooth or plugging it in once in a blue moon for a firmware/schedule update like the good old days would be far preferable to anything that could connect them to the internet. I’d much rather air gapped and slightly inconvenient than internet enabled spyware all over my house.

Maybe I'm giving them too much credit, but if you want to bring national news attention to poor security without doing real damage, racial slurs are probably the most sure fire way to do so.

You know, vegans get a lot of hate for telling everyone they are vegan, yet I've never heard a vegan doing this and yelling about veganism. It's almost like racists are so much more violent and outspoken about it, including in kid's game lobbies and now with fucking vacuums. I have never seen vegans yell "VEGAN!" online repeatedly... and even if they did, that's substantially less harm anyway than racist bullshit. I never want to hear people complain about vegans talking about veganism ever again when this shit is part of everyday society and not surprising at all.

And ps I am not vegan.

I realize the irony in this opening statement, but as someone who's been vegan a long time and never brings it up unless directly asked I can say that this people who are vocal about it tend to be the new vegans who are gonna drop out in six months because they just so happened to have a 1 in 6,000,000,000 person medical condition that makes it literally impossible for them to be vegan, which they discovered for the first time right after bbq season started back up. Definitely not just because they have a different outlook now, no sir.

How do you not bring it up before planning food out with someone? Sorry, I don't believe you. Im forced to bring it up very early in relationships because food comes up pretty darn fast, even for casual acquaintances

Well a couple things, if possible I call ahead and see if anything can be modified, and if not I find some reason to bail. If it's spontaneous, I benefit from, frankly, being a pretty heteronormative man so I can always manage to get beer and a large side. I really only have to let people know ahead of time if it's some kind of work event, in which case the staff member in charge of us attending the event handles it but I'm not in that situation a lot. Of course, most of the time I'm eating it with people who already know me well so they already know I'm vegan.

TBF I know only one militant vegan and she's been outspoken about it for years. I eat meat, I either just tell her to fuck off or ask if all her cocaine is ethically sourced. She's used to it.

But yeah, all the other vegans I've known are really chill.

Again, even if a vegan is spamming the word "vegan" in public spaces (which they almost never do like people joke about), it's leagues better than racist slurs which society has just like, tolerated? In public spaces as being inevitable for several years, notably online and in games

Finally a feel-good story makes the news

Me in shop: I want to buy a robot vacuum cleaner. Do you have one of those sweary ones?

What did you expect from "The Internet of Things"?

Also, now I'm just imagining the vacuums gaining sentience and actually becoming racist.

But racist against like really specific ethnicities and peoples. Like it goes off on a rant about the Jutes and Paraguayans for seemingly no reason.

Fortunately they don't know how to open doors, so they're not organizing together in public (yet)

The first time I heard this story, I immediately thought of what this guy did. I think it would've been an awesome addon if it was just cursing, and not doing racial slurs or spying.

We have a deebot but its a dumber model, no internet connection no app no cameras. Just a remote with some rudimentary pathfinding and it does the job.

I would only trust selfhosted and foss stuff for anything in my home.

The "smart"ification of stuff has got to stop. Nobody asked for wireless connected robots that don't let you connect to your own server even. Maybe if these worked with home assistant this wouldnt have happened, because home assistant devs are more competent that big corporations.

Thanks a lot for the inspiration. Now I wanna hack into all IOT devices that have a camera and microphone. Maybe even speakers, so I can blackmail the owners immediately after filming their intercourse. 👹

If you want my sex tape that bad, all you gotta do is ask.

Why is it always "if you want my sex tape" and not "if you want to make a sex tape"

Ok honestly that was funnier in my head, but maybe someone else can see where I was going and make it funny

If I don't have to star in it, better for me. Win win.

No see that's half the fun! I didn't get in shape and enjoy acting on a small stage to let the talent go to waste!

Plus the acting isn't the difficult part for me, don't need weird camera techniques either.

::: spoiler spoiler The difficult part is keeping the blood supply every time I stand up or move, fainting is a fear too :::

He'll also have to come and help, unless he just wants to watch you go at it alone.

I'm gonna need a lot of help, as I don't actually have the motivation to make a sex tape.