At first I thought ”Well, duh!”, but the manufacturer having a remote kill switch when he network blocked his vacuum from sharing his home map data with them, as well as unprotected root access when connecting to the vacuum… urgh.
The engineer says he stopped the device from broadcasting data, though kept the other network traffic — like firmware updates — running like usual. The vacuum kept cleaning for a few days after, until early one morning when it refused to boot up.
After reverse engineering the vacuum, a painstaking process which included reprinting the devices’ circuit boards and testing its sensors, he found something horrifying: Android Debug Bridge, a program for installing and debugging apps on devices, was “wide open” to the world. “In seconds, I had full root access. No hacks, no exploits. Just plug and play,” Narayanan said.
All crappy IoT devices ever made. They aren’t used in bot nets all the time because hackers like the challenge of hacking them so much. Security simply isn’t a priority.
The ‘S’ on IoT stands for security!
At first I thought ”Well, duh!”
There was an ARS article years ago about it…
Since I dont see it mentioned, the company is
iLife
iLife makes vacuums that map your house and can be remote controlled
Just so we are clear. You should all up your name and shame game.
For real. It’s wild how often people don’t just straight up call out bad corps.
Could ya be sued, perhaps?
No
Just because it wouldn’t stick, doesn’t mean they can’t sue you and make your life more difficult. (Not saying you shouldn’t call out bad actors like that)
And when they sue its the time to come together and support the targets of their lawsuit to bring in the best of the best lawyers to take them down.
You always risk a punch in the face when standing up for yourself but that doesn’t mean you should just accept abuse.
Not even perhaps? Well, alrighty!
o7 thank you for your service
All modern robot vacuums do this. Amazon and Zillow actually buy that data too.
Oh crap. I had one. It committed suicide off the stairs
Maybe for the best.
Well, yes, that’s what those cheap “smart” devices do. Or does anyone think cheap smart would fit into that device? Rule of thumb: if a device needs internet access, it is spying on you.
!homeassistant@lemmy.world on a isolated vLAN is my goal for “Smart” devices.
Yes, but some devices simply don’t work without calling home, or have 99% of their brain in a cloud. For those cases, the vLAN does not help.
Then don’t buy those devices. If you have any excuse as to why you “can’t do that”, then there’s zero point in complaining. I’m not saying your complaints are invalid, and companies should be held accountable and criticised. But as long as people buy privacy violating products, companies will continue to violate privacy.
valetudo.cloud/
Thankfully there are groups to replace boards or flash some devices. I need to keep better bookmarks to plug them.
There’s a version of every device that doesn’t phone home. I switched to HomeAssistant a couple years ago now, and I think all of my stuff is finally local as of a few months ago, including my robot vacuum.
“Someone — or something — had remotely issued a kill command,” he wrote.
“I reversed the script change and rebooted the device,” he wrote. “It came back to life instantly. They hadn’t merely incorporated a remote control feature. They had used it to permanently disable my device.”
In short, he said, the company that made the device had “the power to remotely disable devices, and used it against me for blocking their data collection… Whether it was intentional punishment or automated enforcement of ‘compliance,’ the result was the same: a consumer device had turned on its owner.”
Treasonous malware.
If he blocked the data collection how did it get the kill command?
At this point, if you buy a smart thing you have to know it’s spyware.
My home assistant isn’t spying on me. My Zwave devices are not spying.
I wish I was so naïve
Home Assistant is open source and self-hosted and doesn’t require internet to operate. The z-wave devices connect directly to the device running Home Assistant. If you want Home Assistant to be private it absolutely can be.
This article just screams rage-bait. Not that I am against making people aware of this kind of privacy invasion, but the authors did not bother to do any fact checking.
Firstly, they mention that the vacuum was “transmitting logs and telemetry that [the guy] had never consented to share”. If you set up an app with the robot vacuum company, I’m pretty sure you’ll get a rather long terms and services document that you just skip past, because who bothers reading that?
Secondly, the ADB part is rather weird. The person probably tried to install Valetudo on it? Otherwise, I have no clue what they tried to say with “reprinting the devices’ circuit boards”. I doubt that this guy was able to reverse engineer an entire circuit board, but was surprised when seeing that ADB is enabled? This is what makes some devices rather straight forward to install custom firmware that block all the cloud shenanigans, so I’m not sure why they’re painting this as a horrifying thing. Of course, you’re broadcasting your map data to the manufacturer so that you can use their shitty app.
The part saying that it had full root access and a kill-switch is a bit worse, but still… It doesn’t have to be like this. Shout-out to the people working on the Valetudo project. If you’re interested in getting a privacy-friendly robot vacuum, have a look at their website. It requires some know-how, but once it’s done, you know for sure you don’t need to worry about a 3rd party spying on you.
I am assuming the individual described in the article is based in the US, but nevertheless, many countries do not allow spying, fraud and criminality as long as you have a TOS that says you are allowed to do so.
This is a very provincial manner of thinking and shows how deeply tolerance of corruption and criminality dominates the American mind.
Same with the kill switch, it is essentially a fraudulent scheme, a criminal activity.
Wait till you find out what your wifi can do.
Port Scanning blocker was eye opening to how many websites just wanted to check in on me.
Oh, damn! Thanks for reminding me to add that extension since I reinstalled my browser.
So how are they port scanning yiubif your behind a firewall.
Your browser is the trojan here. Install the plugin ‘Port Authority’. Then browse to ebay or IMDB for a demo.
aw he got in my head
Sure “can” do but isn’t.
Was referring to this sort of bullshit. https://www.xfinity.com/hub/smart-home/wifi-motion
Am I too dumb to understand why sending cartographer data is wrong?
His model is iLife A11 that has Lidar. He probably has an app that is used to control robot and shows cleaning progression. Vac 100% Lidar’d his entire home and sent data to create map in the app.
How in the fuck he thinks it is getting that map? If his ass so smart to find a killswitch and reverse it, how come he doesn’t grasp that map data is sent to a server though which he ca use vac app? Like in what world is it not obvious?
Not even gonna discuss about TOS he signed, or that it is general cheap brand cheap but super smart model for it’s price.
Unless some FOSS firmware and software is installed, that thing most certainly will ping back home every chance it gets.
Sidenote: My TV now is offline cause when it kept calling home (ove 60% of my pi-holes querries of all time was TV), it would freeze due to pi-hole block. Once set offline - issue is gone. I also know my robo vac is pinging, but at the same time if I block it, I’ll lose app controls which I wont do. Sadly, my vac doesn’t support Valetudo.
I think yes, to your first question. Couldn’t it just crunch the lidardata locally to feed into cartographer, I don’t understand why you don’t understand that this is the issue.
afaik the lidar data is crunched locally, then sent to the remote server for easy consumption
when those vacuums are flashed with valetudo, they can still make the map with lidar without internet connection
Exactly. So it’s pure surreptitious data exfiltration. They only reason they send the data back is because they can, and there is value for them.
I used to be on a mailing list where American companies offered money to people in the third world for menial manual tasks. Like sending pictures of random crap from different angles and such. One time I got an email offering 4 of these things and $100 and all I had to do was put one of them in my home and use it for a week and give the other 3 away. Goes without saying they’re clearly a privacy nightmare.
Talkie Toaster is here. “Howdy-doodly-do, how’s it going?”
readies my fourteen-pound lump hammer
Does anyone want any toast?
Yeah that issue has been around for at least a couple years now. Luckily my robovac doesn’t have WiFi or bluetooth
It has a clock display for time?
Why would anyone need a moving clock?
I meant on the station to schedule cleanups, e.g. recurring ones. Useful if the noise distracts you and you want it done when you’re not home kinda thing
That makes more sense.
To display time?
Nope. Just blacknwhite bezel face cover with a start button
Same. I will service and repair my goddamn 880 until it is DUST, dammit.
deleted by creator
Yes and who’s doing that with your wifi. They had to set it up.
I remember about news of some Israeli intelligence operatives who jogged around their HQ only to be outed by their tracks on Strava.
I remember army officers and cia folks, specifically. It wouldn’t surprise me that israel got caught as well.
Sheeesh, his fucking mobile phone mapped and photographed his house long ago.
Do you have any source on this? I have never seen a similar article about phones sending a 3D map of your home to the manufacturer.
I wasn’t aware about this with regards to mobile phone tbf. I know you are spied upon on your phone camera, but mapping the house with the phone? Do you mean like Dark Knight stuff?
Your phone camera is not spying on you.I mean this stuff is not hard to prove why doesn’t one of these people who think this prove it.
Mapping like that is probably mostly done through bluetooth and wifi triangulation.
So my Bluetooth is triangulation with what. The signal bouncing around.
Other bluetooth devices in your area
I picture the phone doing it the way it was done in The Dark Knight. That scene when Lucius Fox was in China and had to volunteer a phone to security.
I live in a prefabricated home that is a different color than my neighbor’s. Can I gift them one of these robots to get a blueprint of their house? It is already easily googled but I feel that making a robot do it keeps them lower on the food chain.
