Categories: Technology

Ecovacs says it will fix bugs that can be abused to spy on robot owners

Earlier this month, security researchers warned that a series of security flaws in vacuum and lawn mower robots made by Ecovacs could allow hackers to spy on their owners through the devices’ microphones and cameras. 

At the time, Ecovacs told TechCrunch it concluded that the flaws found by the researchers “are extremely rare in typical user environments and require specialized hacking tools and physical access to the device.”

“Therefore, users can rest assured that they do not need to worry excessively about this,” read the emailed statement, declining to commit to fixing the vulnerabilities. 

Two weeks later, Ecovacs changed its mind, telling the researchers and TechCrunch that, actually, the company will fix the bugs.

“We have conducted an in-depth verification and self-examination. We have identified several areas where there is room for improvement,” Martin Ma, the director of Ecovacs’ security committee, told TechCrunch in an email. “In response, we have initiated targeted improvements and addressing the issues highlighted.”

Contact Us

Do you have more information about flaws in Ecovacs or other internet-connected home robots? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

On August 10, security researchers Dennis Giese and Braelynn gave a talk about their research into Ecovacs’ home robots at the annual hacking Def Con conference in Las Vegas. The two said they analyzed 11 Ecovacs devices and found several flaws. 

The most impactful vulnerability, they said, allows anyone using a phone to connect to an Ecovacs robot via Bluetooth from as far as 450 feet — around 130 meters — and take control of the devices. That flaw would then let the hackers monitor the robots from anywhere because the robots are connected to the internet via Wi-Fi. 

Other flaws included a bug that would allow someone to access a robot vacuum after selling it and deleting their account, meaning they could then spy on a device’s new owners, according to the researchers.    

In an email to Giese on August 16 and shared with TechCrunch, Ecovacs’ Ma mentioned that the researchers’ talk at Def Con “has captured my attention.” That’s why, the email continued, Ma asked the Ecovacs security team to retrieve the correspondence the company had with the researchers. Ma said that the company “inadvertently overlooked” the researchers’ emails from December 2023. 

“We have carefully reviewed your points raised in the previous emails and the Demos at Def Con 2024, and conducted an in-depth verification and self-examination,” Ma said, adding that the company will fix issues in two Ecovacs models — the Goat G1 and the X1 — and in the Ecovacs app. 

“Your analysis has been greatly valued and appraised by our technical team. Your insights are invaluable in safeguarding the security and integrity of our products, and they contribute significantly to the consumer electronics industry as a whole,” Ma wrote. “Ultimately, it is the general consumers who will benefit most from your dedication.”

News Today

Recent Posts

Kareena Kapoor’s Next Untitled Film With Meghna Gulzar Gets Prithviraj Sukumaran On Board

Kareena Kapoor is working with Raazi director Meghna Gulzar for her next film. The project,…

17 hours ago

Purdue basketball freshman Daniel Jacobsen injured vs Northern Kentucky

2024-11-09 15:00:03 WEST LAFAYETTE -- Daniel Jacobsen's second game in Purdue basketball's starting lineup lasted…

17 hours ago

Rashida Jones honors dad Quincy Jones with heartfelt tribute: ‘He was love’

2024-11-09 14:50:03 Rashida Jones is remembering her late father, famed music producer Quincy Jones, in…

17 hours ago

Nosferatu Screening at Apollo Theatre Shows Student Interest in Experimental Cinema – The Oberlin Review

2024-11-09 14:40:03 A silent German expressionist film about vampires accompanied by Radiohead’s music — what…

18 hours ago

What Are Adaptogens? Find Out How These 3 Herbs May Help You Tackle Stress Head-On

Let's face it - life can be downright stressful! With everything moving at breakneck speed,…

18 hours ago

The new Mac Mini takes a small step towards upgradeable storage

Apple’s redesigned Mac Mini M4 has ditched the previous M2 machine’s SSD that was soldered…

18 hours ago