Close Menu
TechBrunchTechBrunch
  • Home
  • AI
  • Apps
  • Crypto
  • Security
  • Startups
  • TechCrunch
  • Venture

Subscribe to Updates

Subscribe to our newsletter and never miss our latest news

Subscribe my Newsletter for New Posts & tips Let's stay updated!

What's Hot

One of Elon Musk's longtime VCS is suing his former employer after allegedly fired

May 8, 2025

Korean telephone giant SKT data breaches timeline

May 8, 2025

AppFigures: Apple earned more than $10 billion from its US App Store commission last year

May 8, 2025
Facebook X (Twitter) Instagram
TechBrunchTechBrunch
  • Home
  • AI

    OpenAI seeks to extend human lifespans with the help of longevity startups

    January 17, 2025

    Farewell to the $200 million woolly mammoth and TikTok

    January 17, 2025

    Nord Security founder launches Nexos.ai to help enterprises move AI projects from pilot to production

    January 17, 2025

    Data proves it remains difficult for startups to raise capital, even though VCs invested $75 billion in the fourth quarter

    January 16, 2025

    Apple suspends AI notification summaries for news after generating false alerts

    January 16, 2025
  • Apps

    AppFigures: Apple earned more than $10 billion from its US App Store commission last year

    May 8, 2025

    Instagram thread gets video ads

    May 8, 2025

    Google deploys AI tools to protect Chrome users from fraud

    May 8, 2025

    Match to lay off 13% of staff

    May 8, 2025

    Apple tries to delay ruling that it will prohibit cutting payments for external apps

    May 8, 2025
  • Crypto

    Stripe unveils AI Foundation model for payments, revealing a “deeper partnership” with Nvidia

    May 7, 2025

    Movie Pass explores the daily fantasy platform of film buffs

    May 1, 2025

    Speaking on TechCrunch 2025: Application is open

    April 24, 2025

    Revolut, a $45 billion Neobank, recorded a profit of $1 billion in 2024

    April 24, 2025

    The new kids show will come with a crypto wallet when it debuts this fall

    April 18, 2025
  • Security

    Korean telephone giant SKT data breaches timeline

    May 8, 2025

    Powerschool paid the hacker ransom, but now the school says it's being forced

    May 8, 2025

    VC Company Insight Partners Review Personal Data Stolen During a January Hack

    May 8, 2025

    Crowdstrike says it will fire 500 workers

    May 7, 2025

    Ox Security lands fresh $60 million to scan code vulnerabilities

    May 7, 2025
  • Startups

    7 days left: Founders and VCs save over $300 on all stage passes

    March 24, 2025

    AI chip startup Furiosaai reportedly rejecting $800 million acquisition offer from Meta

    March 24, 2025

    20 Hottest Open Source Startups of 2024

    March 22, 2025

    Andrill may build a weapons factory in the UK

    March 21, 2025

    Startup Weekly: Wiz bets paid off at M&A Rich Week

    March 21, 2025
  • TechCrunch

    OpenSea takes a long-term view with a focus on UX despite NFT sales remaining low

    February 8, 2024

    AI will save software companies' growth dreams

    February 8, 2024

    B2B and B2C are not about who buys, but how you sell

    February 5, 2024

    It's time for venture capital to break away from fast fashion

    February 3, 2024

    a16z's Chris Dixon believes it's time to focus on blockchain use cases rather than speculation

    February 2, 2024
  • Venture

    One of Elon Musk's longtime VCS is suing his former employer after allegedly fired

    May 8, 2025

    Sequoia leads a $1.5 billion tender offer for sales automation startup clay

    May 8, 2025

    Bosch Ventures is turning attention to North America with a new $270 million fund

    May 8, 2025

    A comprehensive list of 2025 tech layoffs

    May 7, 2025

    Kapor Capital's managing partner Ulili Onovakpuri has left the company

    May 7, 2025
TechBrunchTechBrunch

Ecovax home robots can be hacked to spy on owners, researchers claim

TechBrunchBy TechBrunchAugust 9, 20244 Mins Read
Facebook Twitter Pinterest Telegram LinkedIn Tumblr WhatsApp Email
Share
Facebook Twitter LinkedIn Pinterest Telegram Email


New research has found that malicious hackers could take control of Ecovacs vacuum cleaners and lawnmower robots, using the devices' cameras and microphones to spy on their owners.

Security researchers Dennis Giese and Braelyn will be presenting their work on Ecovacs robots in detail at the Defcon hacking conference on Saturday. After analyzing several Ecovacs products, the researchers found several issues that could be exploited to hack the robots via Bluetooth and secretly turn on their microphones and cameras remotely.

“Their security was really, really, really, really bad,” Giese told TechCrunch in an interview before the talk.

The researchers said they contacted Ecovax to report the vulnerability but did not receive a response from the company, and they believe the vulnerability remains unpatched and could potentially be exploited by hackers.

Ecovacs did not respond to TechCrunch's request for comment.

The main problem, according to the researchers, is that a vulnerability in the ECOVACS robots could allow someone to connect to and take over them using their smartphone over Bluetooth from up to 450 feet away, and once a hacker has control of the device, they could connect to it remotely, since the robots themselves are connected to the internet over Wi-Fi.

“You send a payload, which takes a second, and it connects to the machine, so it can connect to a server on the internet, for example, and then you can remotely control the robot from there,” Giese says. “It can read Wi-Fi credentials, [saved room] “And maps. You can control the operation of the robot's Linux operating system, so you can access the camera, microphone, everything.”

A dog sitting on someone's couch, seen through the camera of a hacked Ecovacs device.A dog seen through a hacked Ecovacs device. Image courtesy of Dennis Guise and Braelyn (Courtesy) Image courtesy of Dennis Guise and Braelyn

Giese said that while lawnmower robots have Bluetooth enabled all the time, vacuum robots enable Bluetooth for 20 minutes when they're turned on and then once a day when they auto-reboot, making them a bit harder to hack.

Most of Ecovax's new robots are equipped with at least one camera and microphone, which could allow a hacker to turn a compromised robot into a spy if they gain control of it. The robots have no hardware lights or other indicators that would alert nearby people that a camera or microphone is on, according to the researchers.

Some models theoretically play an audio file every five minutes to indicate that the camera is on, but Giese said a hacker could easily delete that file to remain stealthy.

“Basically it just deletes the file or overwrites it with a blank file, so if you access the camera remotely it won't play the alert,” Giese said.

Aside from the risk of hacking, Giese and Braelin said they had found other issues with Ecovax's equipment.

The problem is that the data stored on the robot remains on Ecovacs' cloud servers even after the user's account is deleted, and the authentication token also remains in the cloud, meaning that someone could access the robot even after the account is deleted, potentially allowing them to spy on people who may have bought a used robot. Also, the lawnmower robot has an anti-theft mechanism that forces you to enter a PIN code when you pick up the robot, but that PIN code is stored in plain text on the lawnmower, making it easy for a hacker to find and use it.

The researchers said that once an Ecovax robot is compromised, other Ecovax robots could also be hacked if the device is within range of those robots.

Giese and Braelyn said they analyzed the Ecovacs Deebot 900 Series, Ecovacs Deebot N8/T8, Ecovacs Deebot N9/T9, Ecovacs Deebot N10/T10, Ecovacs Deebot X1, Ecovacs Deebot T20, Ecovacs Deebot X2, Ecovacs Goat G1, Ecovacs Spybot Airbot Z1, Ecovacs Airbot AVA, and Ecovacs Airbot ANDY.



Source link

Share. Facebook Twitter Pinterest LinkedIn Tumblr Email

Related Posts

Korean telephone giant SKT data breaches timeline

May 8, 2025

Powerschool paid the hacker ransom, but now the school says it's being forced

May 8, 2025

VC Company Insight Partners Review Personal Data Stolen During a January Hack

May 8, 2025

Crowdstrike says it will fire 500 workers

May 7, 2025

Ox Security lands fresh $60 million to scan code vulnerabilities

May 7, 2025

NSO Groups must pay WhatsApp more than $167 million in damages for Spyware Campaign

May 6, 2025

Leave A Reply Cancel Reply

Top Reviews
Editors Picks

7 days left: Founders and VCs save over $300 on all stage passes

March 24, 2025

AI chip startup Furiosaai reportedly rejecting $800 million acquisition offer from Meta

March 24, 2025

20 Hottest Open Source Startups of 2024

March 22, 2025

Andrill may build a weapons factory in the UK

March 21, 2025
About Us
About Us

Welcome to Tech Brunch, your go-to destination for cutting-edge insights, news, and analysis in the fields of Artificial Intelligence (AI), Cryptocurrency, Technology, and Startups. At Tech Brunch, we are passionate about exploring the latest trends, innovations, and developments shaping the future of these dynamic industries.

Our Picks

One of Elon Musk's longtime VCS is suing his former employer after allegedly fired

May 8, 2025

Korean telephone giant SKT data breaches timeline

May 8, 2025

AppFigures: Apple earned more than $10 billion from its US App Store commission last year

May 8, 2025

Subscribe to Updates

Subscribe to our newsletter and never miss our latest news

Subscribe my Newsletter for New Posts & tips Let's stay updated!

© 2025 TechBrunch. Designed by TechBrunch.
  • Home
  • About Tech Brunch
  • Advertise with Tech Brunch
  • Contact us
  • DMCA Notice
  • Privacy Policy
  • Terms of Use

Type above and press Enter to search. Press Esc to cancel.