- > he soon discovered that the same credentials that allowed him to see and control his own device also provided access to live camera feeds, microphone audio, maps, and status data from nearly 7,000 other vacuums across 24 countries.
This is extremely similar to what I accidentally discovered and disclosed about Mysa smart thermostats last year: the same credentials could be used to access, inspect, and control all of them, anywhere in the world.
See https://news.ycombinator.com/item?id=43392991
by NalNezumi
1 subcomments
- As part of my thesis work almost 10 years ago I worked on a robot vacuum cleaner, (working on their sensor data) and one smart hardware implementation they had was that they had separated the computer vision module from the main board.
This way, only processed vision data would be physically sent to the main board. This constituted of mostly just "line segments", almost like a sparse point cloud, to detect obstacles and edges. They argued that this was more privacy safe because there's no way for the main module to access any raw vision data. It did however make the SLAM part harder to make work.
In hindsight, a good decision. I got one as a thank you for thesis work and it's still running just fine (with battery and brushes replaced once) and good to know that with the years of software update it still can't check me walking around in underwears in my apartment
- Internet connections on devices are an anti feature to me. I need something to work reliably without internet. And then maybe add some extras through internet access through open and secure protocols, so I can always write my own implementation.
by MostlyStable
2 subcomments
- Anyone who's somewhat technically inclined should, in my opinion, only be buying valetudo [0] compatible vacuums and replacing the default software as soon as possible.
[0] https://valetudo.cloud/
- About 10 years ago I was at a startup that used one of the upstart 401k providers of the time. Logged in one day and could see several of my coworkers’ accounts. Really bad class of bug. Still not clear to me how they could have screwed up account atomicity so poorly but assume it was something to do with how they managed orgs.
I was pretty mad about it but also tried to play ball and not make too much of a fuss because I learned some pretty private things without meaning to and didn’t want to inadvertently make them public. Should have been more vocal.
- If one's goal was to force companies to implement better security for their products, it would probably be more efficient to cause maximum reputational damage to the companies, instead of just "responsibly disclosing" vulnerabilities.
It would temporarily suck for consumers, having their devices exploited and their privacy abused, but it would lead to wider awareness of the problem, shaming of the companies, financial and legal pressure, and hopefully change things in the long run.
Disclaimer: This is not a call to action to do illegal things. Your decisions are your own.
- For a brief, beautiful moment, one man came close to sucking more than any other person in human history.
- Due to the wonders of technology, you can now do the equivalent of the Steven Wright joke:
“In my house there's this light switch that doesn't do anything. Every so often I would flick it on and off just to check. Yesterday, I got a call from a woman in Germany. She said, 'Cut it out.'”
At scale, over the Internet.
- At what point do these security flaws come with a criminal level of negligence? This isn't intended to be an inflammatory or angry comment. It is a genuine question.
by charles_f
1 subcomments
- Original story: https://www.theverge.com/tech/879088/dji-romo-hack-vulnerabi...
Accompanying discussion on hn https://news.ycombinator.com/item?id=47047808
- I have my Roomba programmed to start at 5pm every day. Multiple times now it's come to life at 7pm, gone straight to my bedroom, stayed for for 5-10 minutes, then come back home to its dock and gone back to sleep. I have no idea what's going on.
- > In order for the Romo, or really any modern autonomous vacuum, to function it needs to constantly collect visual data from the building it is operating in.
I specifically bought one without a camera or mic.
- “Accidentally” is not accurate. He used AI to inspect the source and found credentials that work in all devices. He also never gained control of anyone else’s devices. He never used the exploit.
by jrochkind1
3 subcomments
- I don't knowingly have any live cameras or microphones in my home other than my laptop and phone (I know those are big "buts", but still), and I plan to keep it that way.
I remind myself of this no matter how much convenience I may be missing out on. (Getting a TV without em is kinda hard!)
Planning in advance, same for any AR stuff, not in my life, I'm sticking to it.
by TheRealPomax
3 subcomments
- Surely this also requires reporting DJI to the authorities for gross negligence? This is not an oopsie, this is deploying a surveillance network without telling anyone.
by jonplackett
3 subcomments
- Companies this inept really need to get fined.
Like how many layers of people had to have OKed having the same password for all of them? It’s incompetence on an impressive scale.
- I give up. Privacy's hopeless as none care. When so many are prepared to chuck privacy to the wind and connect a roving camera in their homes to an internet server that's not under their contol there's no hope. The few who do care are swamped by the numbers.
Anyway, what's all the fuss about (those affected couldn't give a damn about their privacy)?
by userbinator
0 subcomment
- The robot in question is the DJI Romo, an autonomous home vacuum that first launched in China last year and is currently expanding to other countries. It retails for around $2,000 and is roughly the size of a large terrier or a small fridge when docked at its base station.
Unfortunately it doesn't fly.... although if it did, that would've made this even scarier.
- Consumers are not voting with their wallets, they do not care. Surveillance for profit will be illegal. Time for the Internet Bill of Rights. Trust me, it's coming. tyfyattm
- > [...] the same credentials that allowed him to see and control his own device also provided access to live camera feeds, microphone audio [...]
Sorry what? Why would a vacuum cleaner even need a microphone?
by surprisetalk
0 subcomment
- https://taylor.town/roombas-with-fart-spray
- He couldve cleaned up....
- This should be a supervillain origin story.
- How long before there is a claw controlled network of robot/device spies and soldiers?
by shevy-java
0 subcomment
- Well - imagine how many cat furs can be vacuumed with this!
by mattmaroon
0 subcomment
- I bet he had the world's cleanest floor.
- "sneak peak"
Sigh
https://slate.com/culture/2012/01/stealth-mountain-the-twitt...
- Well it only took until the 2nd paragraph, and the words "DJI’s remote cloud servers" for me to be forehead-slappingly disgusted again.
Obviously proper diligence wasn't followed with this product, and obviously this is going to be something we've all heard before, but why does a vacuum need to talk to a server at all?
And also, to go even further back, is there anything more leopards-ate-my-face than a compromised robo-vacuum? I have never understood the appeal of these things. Except as satire. Pushing a vacuum around takes minutes, once a month, all the more so when you live in a 3m x 3m box with 12 roommates, and is badly needed exercise for a lot of pathetic little nerd noodle-arms.
- Please don't edit the title
by petterroea
1 subcomments
- China simply isn't interested in or understands privacy at the moment. I have some experience with cross border relations with them and getting them to sign and then care about data processing agreements we need for gdpr is something for sure...
My understanding is that there is no malice or incompetence, it's usually just "who cares"
- My first think after reading title was "Silicon Valley" series (2014) and episode with Gilfoyle and taking control of smart fridges ;) Sorry. A but out of topic, but I had to mention ;)
- Paying almost a thousand - or more! - to have an overcomplicated device filled with sensors put into your most private sphere voulnerable to adverse elements unnecessarily (had a perfect dumb robot vacuum doing its job loaned to us once, but no-one sells such when they can sell bullshit for 4 times more, idiots buy it regardless), that is not smart....
Consumidiotsm, is the term comes to mind. Eating up crap, is the analogy from non-technical contexts. The side effect is, that buying properly made not overcomplicated and tedious to maintain (update, refresh, pair, disgnose, update and configure connected harware, click away pushy self-promotions, the way it is not exposing you to the manufacturer or everyone) products is tedious (loosing saved efforts). Poor others just want simple and robust, not fragile and risky tech-crap doing the core thing are left out.
(Robotic vacuum is a great concept! The available implementations in the other hand are rubish!)
by Betelbuddy
1 subcomments
- His code sucks...
- [dead]
by Ylpertnodi
0 subcomment
- Terrible writing in the article.
>It retails for around $2,000 and is roughly the size of a large terrier or a small fridge when docked at its base station.
So, large terriers, and small [presumably 'smart'] fridges can have docking stations?
- accidentaly a god, a sucky kinda god, but a god none the less
" I command thee to make vanish the minor sins of this world my minions"
Hacker News