Is your robot vacuum spying on you? (besides being racist)

Monday 14th October 2024 12:19 AM

Some American users of Ecovacs Deebot X2 robot vacuum cleaners have had an unpleasant surprise. Their devices no longer just clean their floors. They could also act as unwitting spies for some people, or worse.

A slightly creepy remote control

Robot vacuums are not only handy for vacuuming your floors, but apparently they also know how to turn into little spies without you knowing. Security researchers have in fact shown that these robots can be hacked remotely, sometimes from more than 100 meters away. And the most worrying? Some hackers have taken great pleasure in using the onboard camera to take a look at what is happening with some of their owners. Worse yet, they can completely control the vacuum remotely, and even broadcast messages through its speakers. It’s not exactly the peace of mind we expect from a device that’s supposed to make our lives easier.

The Ecovacs Deebot X2 in question

Safety in question

In addition to helping you with the cleaning, many robot vacuums collect a wealth of data about you: photos, videos, and voice recordings. The problem is that users are not always aware of this collection. For example, by registering for the improvement program via the Ecovacs application, they unknowingly authorize access to this sensitive information. And even if you think you’ve deleted that data, it might still be sitting somewhere on the manufacturer’s servers. Maybe your robot knows your house better than you do.

Photo of my own cat sleeping, taken with my robot vacuum cleaner, which remains very well behaved (a priori)

Hacked and insulting robots?

The situation becomes even stranger with these incidents reported in the United States. Several users reported that their Deebot had been hackedand that he started shouting racist insults at them, or chasing their pets. Yes, you read that right. Behind these incidents lie security vulnerabilities such as easily circumvented PIN code systems or poorly secured Bluetooth connections. Fortunately, it’s still possible to press the off button in these moments, but it’s still a bit disturbing and worrying. I hope my Roborock S8 Max V Ultra won’t do this kind of beating to me.

A solution is coming

Faced with this series of incidents, Ecovacs announced a security update for November 2024. They claim their robots will be saferso everything should be fine. Until then, if you have a Deebot X2, keep an eye on it, or rather, prevent it from keeping an eye on you.