Shark vacuum robots have an unpatched flaw that could let attackers access cameras, WiFi passwords, and home maps, researcher claims.

Researcher Tokay0 says SharkNinja failed to fix the issue more than 90 days after private disclosure.

The flaw involves AWS IoT certificates, with 673,000 exposed SharkNinja devices observed in one AWS region.

all 14 comments

sorted by: hot top controversial new old
[–] 11 points 3 months ago

But... Why does a vacuum cleaner need wifi access?

  • source
  • [–] 10 points 3 months ago (2 children)

    https://valetudo.cloud/

    Don’t buy IOT devices you can’t control. If it’s not usable via valetudo or is offline capable don’t get it. Tell your friends and family the same. Own your technology, limit your attack surfaces.

  • source
  • hideshow 2 child comments
  • [–] 10 points 3 months ago* (last edited 3 months ago) (2 children)

    Not shocked. I bought one four years ago, had a ton of issues. After many attempts they send me a new one with the exact same issues. So I have two and neither one works. I’d rather clean the floors myself than fight it.

    Their software is garbage, their hardware is garbage.

    Anyway based on that experience, I have no doubt their software is full of exploits and issues.

    Not to reduce the impact of this article but it does point out:

    Attackers need physical device access first, limiting the risk mainly to technically skilled people with a Shark device.

  • source
  • hideshow 2 child comments
  • [–] 2 points 3 months ago

    To get to the certificate with which you THEN can attack devices remotely. I.e. the attacker needs one device. And the skill to extract the certificate and the willingness to abuse it.

    One of each and then the 613k devices in the tested region are exposed.

  • source
  • parent
  • [–] 19 points 3 months ago* (3 children)

    A new fear has been unlocked... Shark Ninjas!

  • source
  • hideshow 3 child comments
  • [–] 3 points 3 months ago

    Hopefully this means more Valetudo compatible devices 🤘

  • source
  • [–] 1 point 3 months ago (1 child)

    My vacuum is staring at me.

  • source
  • hideshow 1 child comment