top 100 comments

sorted by: hot top controversial new old
[–] 294 points 1 year ago* (30 children)

At first I thought ”Well, duh!”, but the manufacturer having a remote kill switch when he network blocked his vacuum from sharing his home map data with them, as well as unprotected root access when connecting to the vacuum… urgh.

The engineer says he stopped the device from broadcasting data, though kept the other network traffic — like firmware updates — running like usual. The vacuum kept cleaning for a few days after, until early one morning when it refused to boot up.

After reverse engineering the vacuum, a painstaking process which included reprinting the devices’ circuit boards and testing its sensors, he found something horrifying: Android Debug Bridge, a program for installing and debugging apps on devices, was “wide open” to the world. “In seconds, I had full root access. No hacks, no exploits. Just plug and play,” Narayanan said.

  • source
  • hideshow 30 child comments
  • [–] 152 points 1 year ago (5 children)

    All crappy IoT devices ever made. They aren't used in bot nets all the time because hackers like the challenge of hacking them so much. Security simply isn't a priority.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 194 points 1 year ago (4 children)

    The 'S' on IoT stands for security!

  • source
  • parent
  • hideshow 4 child comments
  • [+] -21 points 1 year ago (3 children)

    There isn’t an s in IoT silly.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 52 points 1 year ago* (3 children)

    A few years ago I noticed an annoyance with a soundbar I had. After allowing it onto my WiFi network so we could stream music to it, it still broadcast the setup WiFi network.

    While dorking around one day, I ran a port scan on my network and the soundbar reported port 22 (ssh) was open. I was able to log in as root and no password.
    After a moment of “huh, that’s terrible security.” I connected to the (publicly open) setup network, ssh’d in, and copied the wpa_supplicant.conf file from the device to verify it had my WiFi info available to anyone with at least my mediocre skill level. I then factory reset the device, never to entrust it with any credentials again.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 18 points 1 year ago (2 children)

    Name and shame, what make and model was it?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 13 points 1 year ago* (1 child)

    It was a TCL Alto 9+.

    A quick internet search reveals that this issue was known about at least three years ago.

    Another model, the 8i was reported to have a root password of “12345678” - which is partially how I got the idea to start seeing if I could gain root.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    TCL

    The Chinese company that steals corporate secrets (I kicked a bunch of their devs once when they were trying to take pictures of prototypes and copy source code on USB keys) and send everything to China? Who would have thought.

  • source
  • parent
  • [–] 65 points 1 year ago (18 children)

    Is it just me, or is having ADB exposed physically not that big a deal?

  • source
  • parent
  • hideshow 18 child comments
  • [–] 112 points 1 year ago (6 children)

    Tend to agree, security is always the goal but if someone is in my house hacking my vacuum, I have bigger issues. The no-notice remote kill is the bigger issue to me.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 18 points 1 year ago (5 children)

    The much bigger concern is that the pathway used to send the remote kill command could very easily be utilized by nefarious actors.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 14 points 1 year ago (4 children)

    To do what, wear out one section of carpet faster than the rest of your house?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 15 points 1 year ago (10 children)

    It is not good. But in most cases just adb doesnt grand root access. That's just bad.

  • source
  • parent
  • hideshow 10 child comments
  • [–] 50 points 1 year ago (9 children)

    NO! It'syour device, you should have root! The fact that the manufacturer gives their product owners root is a good thing, not bad!

    I will die on this fucking hill.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 8 points 1 year ago (1 child)

    I agree with you. But granting root straight from adb with 0 auth is not good.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago

    But on this threat model? Why would it not be good?

    It has to physically accessed on the PCB itself from what I gather.

    There are 2 "threats" from what I see:

    • someone at the distribution facility pops it open and has the know how to install malware on it (very very unlikely)

    • someone breaks into your home unnoticed and has the time to carefully take apart your vacuum and upload pre-prepared malware instead of just sticking an IP camera somewhere. If this actually happens, the owner has much much bigger problems and the vacuum is the least of their worries.

    The homeowner is the other person that can access it and it is a big feature in that case.

  • source
  • parent
  • [–] -3 points 1 year ago (6 children)

    yes and no.. i agree with the sentiment, but with root you can extract wifi credentials and various other secrets… you shouldn’t be able to get these things even when you have physical access to the device… the root access itself isn’t the problem

  • source
  • parent
  • hideshow 6 child comments
  • [–] 3 points 1 year ago* (5 children)

    If I broke into your home, why TF would I carefully take apart your robot vacuum in order to copy your wifi credentials‽

    Also, WTF other "secrets" are you storing on your robot vacuum‽

    This is not a realistic attack scenario.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 2 points 1 year ago (4 children)

    you’re on programming.dev so i assume you know that secrets is a generic term to cover things like your cloud account login (whatever form that may take - a password, token, api key, etc) for the robot vacuum service and you’re being intentionally obtuse

    it’s a realistic attack scenario for some people - think celebrities etc, who might be being targeted… if someone knows what type of vacuum you have, it’s not “carefully take apart” - it’d take 30s, and then you have local network access which is an escalation that can lead to significantly more surveillance like security cameras, and devices with unsecured local access

    just because it doesn’t apply to you doesn’t mean it doesn’t apply to anyone… unsecured or default password root access, even with physical access, is considered a security issue

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago* (3 children)

    Listen, if someone gets physical access to a device in your home that's connected to your wifi all bets are off. Having a password to gain access via adb is irrelevant. The attack scenario you describe is absurd: If someone's in a celebrity's home they're not going to go after the robot vacuum when the thermostat, tablets, computers, TV, router, access point, etc are right there.

    If they're physically in the home, they've already been compromised. The fact that the owner of a device can open it up and gain root is irrelevant.

    Furthermore, since they have root they can add a password themselves! Something they can't do with a lot of other things in their home that they supposedly "own" but don't have that power (but I'm 100% certain have vulnerabilities).

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (2 children)

    they're not going to go after the robot vacuum when the thermostat, tablets, computers, TV, router, access point, etc are right there.

    … and all of those things should be equally protected

    they’re going to go for the easiest thing to extract information or escalate

    since they have root they can add a password themselves!

    the most absurd thing is assuming that an end-user is going do add a root password to a serial interface

    i’m not saying end users shouldn’t be able to gain root somehow, simply that it shouldn’t be wide open by default… there should be some process, perhaps involving a unique password per device

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    Having a unique password per device is best practices. IoT vendors should be doing that regardless of whether or not they're giving the end user root.

    There's supposed to be a regulation demanding an IoT "nutrition label" that has that very thing in its list of items. I wonder what happened to that?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    Having a unique password per device is best practices.

    yup that’s all i’m getting at… this vacuum has unprotected access to ADB, which another user likened to root access, and i just think that in circumstances that are root-like, even physical access shouldn’t grant unprotected root

  • source
  • parent
  • [–] 169 points 1 year ago (11 children)

    Since I dont see it mentioned, the company is

    iLife

    iLife makes vacuums that map your house and can be remote controlled

    Just so we are clear. You should all up your name and shame game.

  • source
  • hideshow 11 child comments
  • [–] 43 points 1 year ago (5 children)

    For real. It's wild how often people don't just straight up call out bad corps.

  • source
  • parent
  • hideshow 5 child comments
  • [–] -5 points 1 year ago (4 children)
  • [–] 10 points 1 year ago (3 children)
  • [–] 5 points 1 year ago (1 child)

    Just because it wouldn't stick, doesn't mean they can't sue you and make your life more difficult. (Not saying you shouldn't call out bad actors like that)

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    And when they sue its the time to come together and support the targets of their lawsuit to bring in the best of the best lawyers to take them down.

    You always risk a punch in the face when standing up for yourself but that doesn't mean you should just accept abuse.

  • source
  • parent
  • [–] 79 points 1 year ago

    iLife A11 smart vacuum

  • source
  • [–] 79 points 1 year ago (6 children)

    In addition, Narayanan says he uncovered a suspicious line of code broadcasted from the company to the vacuum, timestamped to the exact moment it stopped working. “Someone — or something — had remotely issued a kill command,” he wrote.

    “I reversed the script change and rebooted the device,” he wrote. “It came back to life instantly. They hadn’t merely incorporated a remote control feature. They had used it to permanently disable my device.”

    In short, he said, the company that made the device had “the power to remotely disable devices, and used it against me for blocking their data collection… Whether it was intentional punishment or automated enforcement of ‘compliance,’ the result was the same: a consumer device had turned on its owner.”

    They kill switched it remotely. Yikes.

  • source
  • hideshow 6 child comments
  • [–] 11 points 1 year ago (4 children)

    All IoT devices do this to keep you from blocking their data collection. They won’t work reliably without a regular ping home. They lock up if they can’t phone home frequently enough.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 7 points 1 year ago* (last edited 1 year ago) (2 children)

    Tapo's sockets don't - in fact they explicitly have a 'local only' function. All you lose is control outside your home network.

    Tuya on the other hand will start leeching off the fucking Bluetooth of your pairing device if you hobble them.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (1 child)

    tapo cameras do. mine all went offline and factory reset themselves after not having internet access or even accounts for several months, all at the same time.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 38 points 1 year ago (3 children)

    “Someone — or something — had remotely issued a kill command,” he wrote.

    “I reversed the script change and rebooted the device,” he wrote. “It came back to life instantly. They hadn’t merely incorporated a remote control feature. They had used it to permanently disable my device.”

    In short, he said, the company that made the device had “the power to remotely disable devices, and used it against me for blocking their data collection… Whether it was intentional punishment or automated enforcement of ‘compliance,’ the result was the same: a consumer device had turned on its owner.”

  • source
  • hideshow 3 child comments
  • [–] 38 points 1 year ago (5 children)

    At this point, if you buy a smart thing you have to know it's spyware.

  • source
  • hideshow 5 child comments
  • [–] 3 points 1 year ago* (2 children)

    My home assistant isn't spying on me. My Zwave devices are not spying.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 32 points 1 year ago* (1 child)

    On paper all of this stuff is a great idea that would make our appliances more functional.

    In reality, the best case scenario is that it’s sold to our corporate overlords so they can slap an ad on your refrigerator and sell you more plastic waste.

    Worst case, it’s sold to ICE or some other fascist regime.

    https://arstechnica.com/gadgets/2025/10/ring-cameras-are-about-to-get-increasingly-chummy-with-law-enforcement/

  • source
  • hideshow 1 child comment
  • [–] 8 points 1 year ago* (last edited 1 year ago)

    Worst case, it’s sold to ICE or some other fascist regime.

    Every single government that has a contract with Palantir for Gotham or even whatever the fuck they're doing with the UK NHS data, is reason enough to know this kind of shit is a bad idea. The entire existence of Palantir makes this kind of shit a bad idea by default.

    Even if they're not using lavender or where's daddy (yet), I do not want them to have a detailed layout of my home, in addition to all the other information already being collected.

    If the day comes when any government needs to crush civil unrest, Palantir gives them an easy button to weaponize your data against you.

  • source
  • parent
  • [–] 26 points 1 year ago (8 children)

    Wait till you find out what your wifi can do.

  • source
  • hideshow 8 child comments
  • [–] 15 points 1 year ago (3 children)

    Port Scanning blocker was eye opening to how many websites just wanted to check in on me.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 23 points 1 year ago (6 children)

    That is why I have denied internet access for my robot vacuum cleaner. Xiaomi doesn't need to know the blueprint of my house, and if it can't connect to the internet, there's no need for firmware updates.

    I'll start the thing by pressing the button at the top.

  • source
  • hideshow 6 child comments
  • [–] 2 points 1 year ago (5 children)

    I’m unfamiliar with Xiaomi “smart” products, I assume there is an app to control the vacuum, if it does have an app does it still work for you strictly behind your LAN network?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 10 points 1 year ago (2 children)

    It does have an app, but I'm not using it. It also doesn't work, because it can't find the vacuum on the network.

    The device has 2 buttons: "turn on/off" and "find home", those are the only two I need.

    A vacuum doesn't need internet access.

  • source
  • parent
  • hideshow 2 child comments
  • [+] 21 points 1 year ago (4 children)
  • [–] 58 points 1 year ago (7 children)

    Well, yes, that's what those cheap "smart" devices do. Or does anyone think cheap smart would fit into that device? Rule of thumb: if a device needs internet access, it is spying on you.

  • source
  • hideshow 7 child comments
  • [–] 21 points 1 year ago* (6 children)

    !homeassistant@lemmy.world on a isolated vLAN is my goal for "Smart" devices.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 7 points 1 year ago (5 children)

    Yes, but some devices simply don't work without calling home, or have 99% of their brain in a cloud. For those cases, the vLAN does not help.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 13 points 1 year ago (1 child)

    Then don't buy those devices. If you have any excuse as to why you "can't do that", then there's zero point in complaining. I'm not saying your complaints are invalid, and companies should be held accountable and criticised. But as long as people buy privacy violating products, companies will continue to violate privacy.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago*

    Very valid and true point, but that requires companies to openly admit that they've made their devices to not work if it can't phone home, and no company is gonna do that. At best, they'll tell you it needs internet access, but even then they'll probably downplay it.

    Either that or some poor sacrifice will have to be the guinea pig and buy the thing to test it and tell others. Ah, I guess Consumer Reports could do that at least.

  • source
  • parent
  • [–] 3 points 1 year ago

    There's a version of every device that doesn't phone home. I switched to HomeAssistant a couple years ago now, and I think all of my stuff is finally local as of a few months ago, including my robot vacuum.

  • source
  • parent
  • [–] 20 points 1 year ago

    I used to be on a mailing list where American companies offered money to people in the third world for menial manual tasks. Like sending pictures of random crap from different angles and such. One time I got an email offering 4 of these things and $100 and all I had to do was put one of them in my home and use it for a week and give the other 3 away. Goes without saying they're clearly a privacy nightmare.

  • source
  • [–] 57 points 1 year ago (2 children)

    Yeah, I read about iRobot gathering and selling info about apartments like 10 years ago. People still alarmed by this are simply ignorant.

  • source
  • hideshow 2 child comments
  • [–] 12 points 1 year ago

    I don't care if they map my house, just give me raw access to the data. Them having access to the speaker and mic, i'm more concerned about.

  • source
  • [–] 11 points 1 year ago

    I live in a prefabricated home that is a different color than my neighbor's. Can I gift them one of these robots to get a blueprint of their house? It is already easily googled but I feel that making a robot do it keeps them lower on the food chain.

  • source
  • [–] 10 points 1 year ago

    Shit I’m scared of my home speakers echo locating my furniture and the size of my domicile

  • source
  • [–] 9 points 1 year ago
    load more comments
    view more: next ›
    13 comments in c/privacy@lemmy.world view that post
    6 comments in c/aboringdystopia@lemmy.world view that post
    2 comments in c/privacy@programming.dev view that post