DEF CON 31 - Vacuum Robot Security & Privacy Prevent yr Robot from Sucking Your Data - Dennis Giese

[@tin2001]

My mother started buying old model iRobot Roombas off eBay years ago. She has a fleet of about 6 of them... The beauty of these old models is they literally do have just optical sensors, switch based sensors and a very low power microcontroller with no internet access at all. Some of them are now well over 10 years old, and still work great (new battery packs every few years of course).

[@wendysofficial]

The formatting on KZbin mobile cut off “data” at the end of the title, turning it into “Prevent yr Robot Vacuum From Sucking Your…”, leading me to speculate that this video was gonna go in a wildly different direction.

[@gorak9000]

They'd have much higher sales if the robot went in that other direction, but just think of the privacy concerns with that one - now the info they have to sell to 3rd parties is the size of your d___ and how often you like to have it sucked!

[@wendysofficial]

@@gorak9000 that Ted Kaczynski fella had a pretty famous quote that would seem to stem from situations like you just mentioned.

[@tekboi1984]

😂😂

[@ImARichard]

If I can't have full control of a network connected -camera- optical sensor, then that -camera- optical sensor can't be on my network. Sheesh these products definitely shouldn't exist. Great talk!

[@sygad1]

I only want 2 things, STOP phoning home and easy/full integration into Home Assistant. Sell me that product and I wouldn't need to hack anything.

[@antonliakhovitch8306]

iRobot's products pretty much allow for this. The Home Assistant Integration works well and it works without the cloud, so as long as you can disable internet access for the robot on your router you're in business.

[@dennisgiese5591]

Thats what I try to tell the vendors for the past 5 years. I met with them in 2018 and told them that they can make a lot of people happy by allowing local-only control. And that I would not need to hack their stuff anymore. Roborock promised me to think about it... but it went nowhere.

[@_Mackan]

Moral of the story: Hackers will always get into physical devices

[@spot997]

And: don't use any of such, if you are hot.

[@madshorn5826]

And: Some vacuum cleaners suck. I'll see myself out... Edit: Correction ALL vacuum cleaners suck. Especially if they don't

[@jaykoerner]

Moral of the story everything is a physical device at some point, so hackers get into everything...

[@jenaf4208]

Tfw you realise that you are a physical device 😳

[@DelticEngine]

That's totally irrelevant, unless it has wireless capability to transmit information.

[@calebjpryor]

I have benefited greatly from your work and am a huuuuuuge fan of Valetudo! Please keep up the good work.

[@dennisgiese5591]

I try :)

[@harveyspecter1653]

Damn you guys are persistent 😀I rally enjoyed watching this. Good stuff guys. Thanks to your hard work these companies have to make their stuff secure.

[@dennisgiese5591]

Glad to hear. We also got Ecovacs at the 37C3 in Hamburg (see kzbin.info/www/bejne/a2exYpePm8mJnJY ). So now we got 60% of all of the vacuum robot market :)

[@harveyspecter1653]

@@dennisgiese5591 Splendid. I have 3 iRobots (1x S9+ and 2x J9+) and I was happy to find they were pretty secure although I'm sure if you get your hands on them they'd reveal all their secrets in a few minutes 😀

[@Notaustieg]

"companies can say alot of things if the day is long" hahahaha now I'm 100% hes german.

[@geniferteal4178]

Why do these things need the cloud at all?

[@asumazilla]

To add vulnerabilities to your home?

[@geniferteal4178]

@@asumazilla seems like it. Pick up the dirt and don't damage my furniture. I don't want to worry about pictures in the cloud.

[@jm56585]

probably to be accessible by devices outside of the home network without port forwarding but also so the corpos can sell the users' data

[@geniferteal4178]

@jm56585 it's a vacuum. Why can't it be self contained?

[@gorak9000]

@@geniferteal4178 Because in this day and age, nothing is self contained. Everything phones home, and will instantly break if the company (and the backend) disappears, or if they think you're being naughty. How are they going to sell your data without uploading it into their cloud first?

[@justinclark9258]

Thanks for single handedly doubling the cost of a robot vacuum

[@kaotiskhund]

Great talk. The way he talked really kept my watching. Cool stuff there.

[@bastian9872]

Huge thanks for your great work and the super interesting talk! It’s a pity cloud access and giving a lot of (private) data away is basically mandatory if you want to use a stock cleaning robot. Really, really awesome that you and Hypfer provide a well documented workaround. The Telegram support is also very helpful, although the tone is sometimes a bit rough there. Please keep up your amazing work!

[@sjoer]

And my friends tell me I'm crazy for having IoT devices on their own VLAN :D

[@-r-495]

Oh, that‘s the answer to many questions of mine concerning embedded devices. This may well work on NAS and also some routers 🧐

[@TecSanento]

Why to do they prevent the shell access that hardly - there is no risk for them, and only customers to win with a hackable device?

[@rolandvarga1609]

Great presentation! Do you know which CVE Id would be associated with the vulnerability you found in the UBoot? Thanks!

[@dennisgiese5591]

There is none, as I do not apply for them (tbh, I do not even know how, lol). Keep also in mind, that there are slightly different issues in different implementations that I abuse here.

[@LeonardoFlammia]

admirable work ! I hope you get some honor and reward for it !

[@dennisgiese5591]

There is always the problem between reporting bugs to the vendor (and getting a bounty) or disclosing it to the community (getting fame, but no bounty). So far, I have chosen the second path. Telling the vendor in advance would kill the custom firmware and root-ability of the device. The only way to support the community is to release it all at one event.

[@Xanthopteryx]

I have all my smart things connected to a separate LAN that is not able to access the other LANs i have, so even if they try sketchy stuff in the network, it can not affect my important stuff.

[@sygad1]

VLANs for the win ;-)

[@Xanthopteryx]

@@sygad1Oh yes, so handy! Also have one for visitors, and on that network, no unit can access another unit so they are safe from eachother. Also have one i can activate when i play around - a play around network so to say. All four available as wireless, but, smart home is not visible and the playaround normally closed.

[@sygad1]

@@Xanthopteryxfor extra caution, I have all my cameras and a very locked down VLAN with absolutely NO internet access. I use a VPN tunnel to access my cameras.

[@stefan0ro]

​@@Xanthopteryxwhat router do you use to do that? just curious.

[@Xanthopteryx]

​@@stefan0ro​Netgate 1100 and UniFi managed switch and their UFO. Really nice stuff but not totally intuitive for beginners. I also switch our digital TV (VLAN) straight in so no need for the operators special equipment.

[@gwalther00]

Man, I wish he were devoting even 1% of this awesome energy into hacking Litter Robots. They're locked down now and don't work with Homekit anymore.

[@dennisgiese5591]

What are Litter Robots?

[@gwalther00]

@@dennisgiese5591 a self-scooping cat litter box. Some have network connectivity.

[@illens08]

@@dennisgiese5591 they autoscoop cat litter

[@adamarzo559]

@@dennisgiese5591 Looks like its a $1000(AUD) automatic cat litter box.

[@illens08]

great talk. thanks for all your research, tho I know you must also love doing it!

[@TheNikiii07]

Is a relatively recent model even rootable (e.g. to put Valetudo) by a mortal anymore? Most tutorials have comments suggesting the rooting method's been patched..

[@Milkmans_Son]

What are they worried about, privacy problems and the resulting bad press? It seems to me a hackable device would increase sales, if anything (at least enough to counter higher return rates anyway).

[@TheAechBomb]

the average person isn't a hacker/modder, they just want something that works and that they can access from their phone

[@dennisgiese5591]

I think Chinese companies try to protect their devices against other Chinese companies. Also, the code quality is not great, so it might give them bad press if they get caught.

[@DelticEngine]

A 'white hat' take on this would be using a vacuum robot instead of a radio-controlled drone or car and run around the house with it having fun while doing something genuinely useful at the same time. A stereoscopic vacuum robot and VR glasses would also provide an interesting view of the world. If there are pets, and they are used to such as device, then with the vacuum motor off one of these could be used to quietly check up on a pet or even a child without arousing suspicion from the owner or parent. There a positive and helpful uses of such a modified device. Using a modified robot vacuum as a security robot (possibly as well as a vacuum) could also be very helpful, It could be programmed to quietly conduct surveillance of a room or even and entire floor. This could be tied in to an advanced security system with the 'robot vacuum' sent to 'investigate' a detection by the main security system.

[@Col_Panic]

I am Jack's complete lack of surprise

[@jeffcard3623]

Warranty seals are illegal and therefore pointless in the US.

[@huffuy]

17:32 -> allwinner R16

[@hustler3of4culture3]

Cobra Bora by 808 state at the end?

[@Theweerd]

Apple always do that why not the Roomba?

[@NeverGiveUpYo]

Great talk!

[@TheTylrBllmn]

These guys need an audio vendor that can mix without ringing, sheesh

[@TheJustinBurton]

Was hoping to see something about shark brands

[@luminousfractal420]

Im alright the sensor board in mine broke/disconnected, after about 2weeks. Its been running blind, still manages to map the house ok

[@dennisgiese5591]

Depending on which Shark you have, they are technically vulnerable to the same stuff. The problem is that they are mostly only available in the US, so not that interesting for the European folks (which are my biggest audience).

[@zipkiev]

I have dreame x20, and it is locking outside a chine so no cool functional like camera for me(((I hope some genius can do a custom firmware with working camera for HA.

[@dennisgiese5591]

X20 is likely a L20 (global). I do not have that device yet. I cannot bring myself over spending 1.5k$ on that device (especially if there are other devices in that price range that need "rooting").

[@user-dv5ol4oe5h]

Can x20 still work without camera option?

[@curranhouse]

Can I make my vacuum suck anything? Asking for a friend.... 😂😂

[@luminousfractal420]

Might end up with a roller jam

[@dennisgiese5591]

Dont end up in a situation like the people that used the Vorwerk Kobolt a few decades ago.

[@tiagotiagot]

Are there any good robot vacuums that don't got any of that anti-consumer bullshit and just let the owner do whatever they want with it?

[@dennisgiese5591]

no :(

[@luminousfractal420]

also dont trust "new" products from amazon. getting loads of used items as new item sales recently.

[@A38-d7y]

just don't connect them to internet. Ok, you would not be able to start it remotely, but I never needed this anyways.

[@dennisgiese5591]

ahhh, be careful with that. A lot of devices are staying in provisioning mode if you do not connect them to the internet. Anyone in range then can provision it "for you"... and access the device then...

[@luminousfractal420]

they put the timer system on the app now

[@EugeneHoverhand]

My take-away from this talk: Just buy an ordinary vacuum cleaner

[@-_o_o_-]

Ahm ahm ahm? Ahm ahm, ahm ahm! 😂

[@davidprock904]

PLEASE 🙏 PLEASE 🙏 PLEASE 🙏 STOP THE umm(s), um ok!

[@luminousfractal420]

im sure he'll be all over that after youve learned german

[@maxwel1]

Just visit a course how you avoid äh, ähm, ähm ähm. Sorry but I can’t watch this video because it feels like every third word is ähm.

[@moth.monster]

I legitimately only bought the robot vacuum I have now because someone already made it work with Home Assistant. It is rather stupid and bonks around humorously. I put googly eyes on it. I call it Sucky McSuckface.