... Why does a vacuum needs a webcam, a microphone, and Internet access? And what did the manufacturer do with all that data?

But he soon discovered that the same credentials that allowed him to see and control his own device also provided access to live camera feeds, microphone audio, maps, and status data from nearly 7,000 other vacuums across 24 countries. The backend security bug

I feel like "bug" is doing a looot of heavy lifting here.

[the robot vacuum] retails for around $2,000 and is roughly the size of a large terrier or a small fridge

Doing everyhing possible to avoid actual dimensions as always.

What size is a 'small fridge' anyway??

Minions! Tonight we vacuum.. THE ROOM!

Long story short: he was trying to find the password for his own vacuum (yeah that already sounds ridiculous) so he could control it with a game controller, and found that the same exact credentials worked for an estimated 7000 other vacuums that need to call home to process visual data in the cloud. Hidden behind the lede: DJI automated vacuums require constantly sending their footage abroad to even work in the first place

Why do these things require microphones?

This honestly sucks

Good time to shamelessly plug valetudo, if your vacuum robot is supported.

With this, it does not access the public internet, and still functions the same as without rooting it. You just can't manage it if you're not home, unless you have some VPN set up or home assistant integration. But I don't know when I ever wanted to manage/watch my vacuum robot when I'm not home. Some sort of offline mode should be legally required for these kinds of devices that don't really need it. "Does not need an app to work" has become a major selling point for me for things, alongside "has physical buttons".

Also drop me a message if you're in switzerland and need an unsoldered valetudo breakout board, I still have around 5 left.

I see a new law coming, limiting the number of automatic bots/ai one person can legally give commands to.

World's suckiest army.

Willard 2

The backend security bug effectively exposed an army of internet-connected robots that, in the wrong hands, could have turned into surveillance tools, all without their owners ever knowing.

Suprise, if it has cameras, microphones, gps, data mapping capabilities and speaks to a server outside of your home it is by definition is a surveillance tool.

All of this has always been predicated on the idea that the surveillance will never be used against you somehow. I don't know why anyone ever bought into that.

I guess the most plausible explanation is incompetence, there wouldn't be a reason to do this on purpose (a backdoor), right? Since the company could have easily used different credentials per device that they store anyway?

https://valetudo.cloud/

Gosh, their drones are getting banned in the US. This just seems to help their case.

Long story short: he was trying to find the password for his own vacuum (yeah that already sounds ridiculous) so he could control it with a game controller, and found that the same exact credentials worked for an estimated 7000 other vacuums that need to call home to process visual data in the cloud. Hidden behind the lede: DJI automated vacuums require constantly sending their footage abroad to even work in the first place

I guess computing also abhors a power vaccuum!