Ecovacs Robot Vacuum Security Vulnerabilities Uncovered

Security researchers have found that Ecovacs’ vacuum and lawn mower robots are susceptible to hacking, which could allow malicious hackers to spy on users by controlling the devices’ cameras and microphones. This poses serious privacy risks.

In a recent interview with TechCrunch, researcher Dennis Giese, who has since presented these findings at this weekend’s DefCon hacking conference alongside co-researcher Braelynn, shared insights from their examination of various Ecovacs products. They have identified critical security flaws exploitable via Bluetooth, which could enable the remote activation of cameras and microphones without the owner’s awareness.

“The security of these devices was extremely poor,” Giese reported. Despite attempting to notify Ecovacs about these vulnerabilities, the company has not responded, leaving unresolved security gaps that could be exploited.

Potential Surveillance Vulnerability

The main vulnerability discovered allows anyone with a smartphone to connect to an Ecovacs robot via Bluetooth from as far as 450 feet (about 130 meters) away. Once they gain control, hackers can remotely access the robot through its Wi-Fi connection. With many Ecovacs robots equipped with cameras and microphones, these devices could potentially be used for surveillance.

Products Affected

The investigation included various models such as the Deebot 900 Series, Deebot N8/T8, Deebot N9/T9, Deebot N10/T10, Deebot X1, Deebot T20, Deebot X2, Goat G1, Spybot Airbot Z1, Airbot AVA, and Airbot ANDY.

For additional information about the scope of this Ecovacs robot vacuum security vulnerability, refer to the TechCrunch interview here. Vacuum Wars will continue to monitor and report on the situation as it develops.