37 votes

Hackers take control of robot vacuums in multiple US cities, yell racial slurs

37 comments

  1. [31]
    DefinitelyNotAFae
    Link
    WHY DO THEY EVEN HAVE SPEAKERS

    WHY DO THEY EVEN HAVE SPEAKERS

    34 votes
    1. [8]
      boxer_dogs_dance
      Link Parent
      I would ask why should it be online. I don't want my vacuum phoning home. Let it talk, but don't let it listen or transmit information.

      I would ask why should it be online. I don't want my vacuum phoning home. Let it talk, but don't let it listen or transmit information.

      37 votes
      1. [6]
        vord
        Link Parent
        I just recently purchased a robot vaccum/mop from Lidl for $50. Here's my review: It does both functions as intended for 1/4 the price of the cheapest option at Target. It doesn't have fancy laser...

        I just recently purchased a robot vaccum/mop from Lidl for $50. Here's my review:

        It does both functions as intended for 1/4 the price of the cheapest option at Target. It doesn't have fancy laser walls or anything, or app programability. It isn't remotely exploitable, as it has no way to connect to the internet at all.

        It beeps if it gets stuck using a simple pizo-electric buzzer. It has a basic IR remote to set a timer or choose a mode.

        The only downside is that if I want to wall off an area, I have to do it manually. Turns out that's not a huge deal for me, since I usually only run it at night or when we're not home so we just unblock it after.

        11/10 purchase. This is what smart appliances should look like.

        26 votes
        1. [3]
          tibpoe
          Link Parent
          But what you don't get is: efficient cleaning, where each spot is only covered once. this is important since the vaccum is loud and I'd like to minimize the time spent scheduled cleaning room...

          But what you don't get is:

          • efficient cleaning, where each spot is only covered once. this is important since the vaccum is loud and I'd like to minimize the time spent
          • scheduled cleaning
          • room mapping, so you can tell it to specifically go clean only the dirty rooms

          None of these features require an internet connection or a camera, and the $200 version at target also won't have them, but they are extremely useful.

          6 votes
          1. [2]
            vord
            (edited )
            Link Parent
            Mine does have scheduled cleaning. While I get your points about coverage, I run it overnight when I'm not near it anyway. And if there's one thing I know about carpet, one pass is rarely enough....

            Mine does have scheduled cleaning. While I get your points about coverage, I run it overnight when I'm not near it anyway. And if there's one thing I know about carpet, one pass is rarely enough.

            I can spot clean by picking it up, putting it in the dirty room, then blocking it off. I'm aware it's more manual, but the total time difference boils down to seconds (since I empty it out after every run anyhow). At the end of the day, this thing is a daily maintainer, not a proper replacement for a deep human clean with a vaccum with 5x the suction. The mop feature is baller though and has basically elimininated the need for mopping the kitchen.

            Of course, I also generally prefer my life without voice assistants now. For every thing they make better, they make a dozen things worse. I used to use mine dozens an hour, now I haven't used one in 3 years.

            A lot of our convienences are false ones. If it's not actively saving me substantial time, or substantially effort, I prefer to err on the side of cheaper.

            Another simple example is dishwasher pods. It turns out that just pouring powder is about 99.9% as easy as the pod, works the same, and costs about 90% less.

            But a great improvement was the all-in-one washer/dryer. I throw in laundry, 2.5 hours later I have clean and dry laundry. No more planning my day around timing the washer and dryer for swapping loads, nor forgetting a washed load for 2 days and then needing to rewash it.

            7 votes
            1. tibpoe
              Link Parent
              That makes a ton of sense! My personal experience to clarify where I'm coming from: I have the system on a schedule to clean half the house each day, but including the kitchen each day. I have a...

              That makes a ton of sense! My personal experience to clarify where I'm coming from:

              I have the system on a schedule to clean half the house each day, but including the kitchen each day. I have a small place, so it cleans the furthest room each night, but the other rooms are cleaned on an alternating basis during the day. After its daily clean on Friday, it goes to the trash can for me to empty it & replace the mop/cleaning fluid.

              This has totally eliminated manual vacuuming for me, except for every month or so for the most heavily trafficked rug. The floors are always spotless with nearly no effort on my part. But the vendor's app hasn't been much help for this, and this heavy automation only works because I was able to do it from Home Assistant.

      2. Pavouk106
        Link Parent
        I managed to get Valetudo compatible used vacuum for 80€. The best buy I could have ever done. It's not only working great but also integrates into Home Assistant. And yes, it has speaer, whoch is...

        I managed to get Valetudo compatible used vacuum for 80€. The best buy I could have ever done. It's not only working great but also integrates into Home Assistant. And yes, it has speaer, whoch is actually useful - it tells me if it got stuck, what the problem is, when to empty the bin... But it never ever calls home.

        1 vote
    2. [16]
      updawg
      Link Parent
      They gotta tell you what's wrong with them. "Low battery, please charge." "Error 644, cameras obscured." Stuff like that.

      They gotta tell you what's wrong with them. "Low battery, please charge." "Error 644, cameras obscured." Stuff like that.

      20 votes
      1. [4]
        vord
        (edited )
        Link Parent
        Thats why god invented diagnostic LEDs. 4 LEDs and a pizo-electric buzzer can fill a 200-page diagnostic book, no fancy speaker with TTS required.

        Thats why god invented diagnostic LEDs. 4 LEDs and a pizo-electric buzzer can fill a 200-page diagnostic book, no fancy speaker with TTS required.

        20 votes
        1. [3]
          hamstergeddon
          Link Parent
          Which is great for a tech working on the machine, but completely useless to the average user who doesn't have familiarity with debugging things by way of LEDs and beeps. Certainly there's an...

          Which is great for a tech working on the machine, but completely useless to the average user who doesn't have familiarity with debugging things by way of LEDs and beeps. Certainly there's an argument to be made that people are too ignorant about technology (dare I say "these days"? It's certainly gotten worse with fool-proof UI/UX) to use it half the time, but that's for another discussion.

          I think the real non-speaker solution would be to just send that info over BT/WiFi to the owner's device where it can print both a user-friendly message and useful debug info for a tech. That way the user can easily handle simple things in their control (eg dirt accumulating on cameras) and the tech can get the more detailed info if the problem calls for it.

          Then again, that Wifi connection is how dumb shit like this happens to begin with, so ya know...I don't know. There's a reason the smartest thing in my house is a single smart plug I use to turn the AC unit in my shed/office on a schedule.

          7 votes
          1. vord
            (edited )
            Link Parent
            That's not true, at all. That's basically how a car gives feedback. Check engine light Parking Brake All sorts of beeps for various 'warning' states Just because the average consumer is being...

            but completely useless to the average user who doesn't have familiarity with debugging things by way of LEDs and beeps.

            That's not true, at all. That's basically how a car gives feedback.

            Check engine light
            Parking Brake
            All sorts of beeps for various 'warning' states

            Just because the average consumer is being conditioned to feel confused by anything more complex than a Fisher Price phone doesn't mean they're incapable. 4 LEDs and a beeper is enough that you could have the 4 most common things each have a unique LED (battery, jam, full, lost), as well as a unique beep pattern for each one.

            And really, I'm not opposed to better feedback via voice or whatnot. However, I do feel that it needlessly bloats costs and increases chances of bugs for the benefit it provides.

            11 votes
          2. Akir
            Link Parent
            They also make tiny screens that cost less than a dollar to add to which they can display those errors directly in the user's preferred language. They’re not terribly more expensive than adding a...

            They also make tiny screens that cost less than a dollar to add to which they can display those errors directly in the user's preferred language. They’re not terribly more expensive than adding a Bluetooth or WiFi radio and they’re much more reliable because they don’t depend on any outside computers at all.

            10 votes
      2. cfabbro
        (edited )
        Link Parent
        This. My Eufy one also lets me know whenever it's gotten stuck or can't return to the base station by notifying me over the app, and beeping every few seconds until it's found, and I'm glad for...

        This. My Eufy one also lets me know whenever it's gotten stuck or can't return to the base station by notifying me over the app, and beeping every few seconds until it's found, and I'm glad for that functionality. My buddy has a Roomba without a speaker or any way to locate it in his house, so he is constantly complaining about having to search every room until he finds it whenever that happens, which with 2 dogs and a young kid in the house is rather frequent.

        12 votes
      3. [7]
        DefinitelyNotAFae
        Link Parent
        I really don't think it needs that as others said. Either an app alert if necessary, or beeps or something would be fine IMO

        I really don't think it needs that as others said. Either an app alert if necessary, or beeps or something would be fine IMO

        5 votes
        1. [6]
          vord
          Link Parent
          Valve figured out how to get haptic feedback to play songs on the Steam Controller. I'm sure some robot vac could get its motors to spit out R2D2 noises. Give me smart devices that let me upload...

          Valve figured out how to get haptic feedback to play songs on the Steam Controller. I'm sure some robot vac could get its motors to spit out R2D2 noises.

          Give me smart devices that let me upload MIDI files. Bring back the fun!

          6 votes
          1. [5]
            DefinitelyNotAFae
            Link Parent
            I don't hate that idea, I just don't understand why it needs speakers that can be accessed

            I don't hate that idea, I just don't understand why it needs speakers that can be accessed

            2 votes
            1. [4]
              vord
              (edited )
              Link Parent
              Definitely agree. I support a law that mandates that any appliance that requires internet connectivity: Has a public, detailed enough manual that the client and server software could be...

              Definitely agree. I support a law that mandates that any appliance that requires internet connectivity:

              • Has a public, detailed enough manual that the client and server software could be re-implemented by a motivated intermediate programmer. Ideally the software is open source, but I'll settle for protected re-implementations.
              • The user has the ability to access and control the device locally.
              • The user has the ability to flash unauthorized firmware to insure that the device has the ability to be fixed if/when the company goes under or stops supporting it.
              4 votes
              1. [3]
                redbearsam
                Link Parent
                As someone who likes iot devices, uses a tonne of them (I've echos in every room including bathrooms, as well as iot kettle, lights, scales, thermometers, blinds, vacuum), and doesn't really care...

                As someone who likes iot devices, uses a tonne of them (I've echos in every room including bathrooms, as well as iot kettle, lights, scales, thermometers, blinds, vacuum), and doesn't really care about this kind of data being monitored or leaked.... I kinda think we should let the market decide here.

                Even getting devs to create internal docs is difficult, never mind consumer facing docs which meet some complex standard. Especially when I get the sense a lot of these devs aren't even fluent in English (based on what docs there are, and marketing for these products etc). I'd worry this kind of regulation will surely add cost? For features in which I'm not interested?

                As someone worried about companies pulling their support structure and my being left with a bunch of lemons I'm slightly more inclined to see your pov though tbf.

                1. [2]
                  vord
                  (edited )
                  Link Parent
                  The thing is, we set the rules for the market. I want a market with rules that default to sustainable, consumer-oriented longevity. If that means the death of companies incapable of competing with...

                  The thing is, we set the rules for the market. I want a market with rules that default to sustainable, consumer-oriented longevity. If that means the death of companies incapable of competing with this rule, so be it. New ones will arise.

                  The winners in that market are far better than the default state of ewaste and prematurely bricked appliances.

                  2 votes
                  1. redbearsam
                    Link Parent
                    Yep that's quite a compelling argument you got there. I am somewhat swayed.

                    Yep that's quite a compelling argument you got there. I am somewhat swayed.

                    1 vote
      4. [3]
        raze2012
        Link Parent
        just ping me on my phone with Bluetooth please. Last thing I need in my house is more noisy objects and beings.

        just ping me on my phone with Bluetooth please. Last thing I need in my house is more noisy objects and beings.

        2 votes
        1. [2]
          RoyalHenOil
          Link Parent
          I am the exact opposite. I hate having everything routed through my phone. I disable nearly all notifications, etc., on my phone because they drive me crazy. I strongly prefer standalone...

          I am the exact opposite. I hate having everything routed through my phone. I disable nearly all notifications, etc., on my phone because they drive me crazy.

          I strongly prefer standalone electronics (or at least electronics that pretend to be standalone) that I can interact with in a more direct, physical way.

          When my robovac gets stuck, it plays a gentle sound so I can find it. Once I get it unstuck, I press a physical button on it to let it know that it's free. No phone interaction necessary (I just used my phone to set up it's cleaning schedule and I haven't touched the app since). I love that, and it's why my robovac is the one big exception I have to avoiding IoT devices.

          9 votes
          1. raze2012
            Link Parent
            I should note that IoT isn't the same as a smart device per se. I don't mind something connecting via BT, but I don't want anymore devices calling home to suck my data (and my phone can tweak...

            I should note that IoT isn't the same as a smart device per se. I don't mind something connecting via BT, but I don't want anymore devices calling home to suck my data (and my phone can tweak permissions to prevent that on the app too).

            I just like when my phone is a fancy remote control instead of trying to find the 8th remote control that is never where I put it. beeps and boops are also alright, but a full on microphone sounds overkill.

            1 vote
    3. [5]
      Hobofarmer
      Link Parent
      You remember "I have no mouth yet I must scream?"

      You remember "I have no mouth yet I must scream?"

      7 votes
      1. DefinitelyNotAFae
        Link Parent
        It explains why smart devices are a form of torture to humans.

        It explains why smart devices are a form of torture to humans.

        2 votes
      2. tanglisha
        Link Parent
        “I have no bones yet I must flee,” has completely overridden that in my brain.

        “I have no bones yet I must flee,” has completely overridden that in my brain.

    4. CptBluebear
      Link Parent
      I mean.. I agree with the sentiment. Mine is constantly yapping things I can just see as an error message or notification in the app. It doesn't have to announce that it's going to wash the mop in...

      I mean.. I agree with the sentiment. Mine is constantly yapping things I can just see as an error message or notification in the app. It doesn't have to announce that it's going to wash the mop in an Aussie accent (may as well make it fun) and it's only marginally helpful. But.. that's why!

      1 vote
  2. SteeeveTheSteve
    Link
    LOL That's a good one! Ya'll know you can just restart your modem and get a new IP right?

    They also said the company's technical team had identified the culprit's IP address, and disabled it to prevent further access.

    LOL That's a good one! Ya'll know you can just restart your modem and get a new IP right?

    20 votes
  3. tibpoe
    Link
    From their statement: A single person was able to make 90x the number of login attempts that every other user in their system was making combined? I appreciate their transparency, but this doesn't...

    From their statement:

    This investigation also identified a credential stuffing event, in which a third party attempted to use email addresses and passwords to try to gain access to Ecovacs’ customer accounts. There were significantly more attempts to log-in than the average daily amount, by a factor of 90:1. These all from the same IP address, which was identified as coming from both an unusual device, and an unusual location. This IP address was
    immediately blocked.

    A single person was able to make 90x the number of login attempts that every other user in their system was making combined? I appreciate their transparency, but this doesn't look good.

    16 votes
  4. CrazyProfessor02
    Link
    The fact that the company was made aware of this, by the people that found it before showcasing it at that conference, but the company decide not to pursue to patch it, and to carry on with a...

    The fact that the company was made aware of this, by the people that found it before showcasing it at that conference, but the company decide not to pursue to patch it, and to carry on with a business as usually mentally. It's just annoying that did nothing before this event happened. And even then it's considered halved assed.

    He took the device to the garage, and never switched it on again.

    I would have taken a hammer to the fucking thing at that point, just to bite the bullet and accept the money lost. And so that I am not tempted of giving it away or having someone else might pick it up by chance.

    15 votes
  5. [3]
    Tiraon
    Link
    This is inevitable for so called "smart" devices requiring internet access and for most also an arbitrary online account. If something allows remote control it can be controlled remotely. When you...

    This is inevitable for so called "smart" devices requiring internet access and for most also an arbitrary online account.

    If something allows remote control it can be controlled remotely. When you then connect it to the Internet it can be controlled over the Internet. To the large surprise of everyone involved that is problem and a bigger one when someone buys an Internet required appliance and trusts everything that appliance can do and all the data it can gather to a who knows who with unknown level of commitment to security and uknown level of respecting privacy.

    There are entire classes od devices where it is all but impossible to buy ones not requiring internet access. Robot vacuums, tvs, cars and probably more. Because that is more profitable and because most people simply do not care about consequences that are even minimally out of sight or obscured (as evidenced by the prevalence of ad-data business model, Windows, Youtube, Android, Google and many, many others) and basic computer literacy is at about the same level it the generall population as actual literacy was in the middle ages. Not because it is that hard or expensive(in time, money or opportunity costs) to have a very basic awareness of digital hygiene and best practices, but because most people cannot be bothered to take the weekend to educate themselves about the very minimal basics of the devices they trust in their everyday life with basically everything.

    And yes there is absolutely a cultural bias for that kind of a attitude but it should not be such an unrealistic expection for average person to think critically before trusting their privacy to unknown entities over whose practices regarding their personal information they have at the absolute best and only in certain jurisdictions tenuous and indirect control which they will likely never actually exercise. Sometimes it is neccessary to function in society, yes but this not a timeline where the effects we are seeing were caused by thoughtfull and conscious compromise toward these forces by the general population.

    Lot of that is probably because the consequences are indirect, nebulous and obscured even if their broad effect(or at the absolute minimum the general direction of the the impact they have) is very transparent.

    6 votes
    1. [2]
      PigeonDubois
      Link Parent
      Can't you just, not connect it to wifi?

      There are entire classes od devices where it is all but impossible to buy ones not requiring internet access.

      Can't you just, not connect it to wifi?

      1 vote
      1. CptBluebear
        Link Parent
        Some flat out don't work if you don't. Some do, they'll just default to the buttons on the device itself instead of the app. So it's possible.

        Some flat out don't work if you don't. Some do, they'll just default to the buttons on the device itself instead of the app. So it's possible.

        6 votes