Some of the automatic household helpers from the Chinese manufacturer Ecovacs are particularly vulnerable to attacks. Hackers are now making fun of it and playing insulting expressions over the robots’ loudspeakers.
Ecovacs’ vacuum robots have been criticized for a long time. Many models are easy to hack. This means attackers can take full control of a number of cleaning devices remotely. Among other things, microphones and the devices’ cameras can be switched on without the owners noticing.
Some time ago, security researchers published a list of affected models and informed the manufacturer about the security gap. Ecovacs has already released a patch that is intended to close the gap. However, security researchers criticized this as not being sufficient. Now reported ABC News about a specific incident in which attackers apparently had fun insulting the owner of a device.
Minnesota lawyer Daniel Swenson noticed strange noises coming from his Ecovacs Deebot X2. According to his own statements, he could see in the app that strangers were accessing the camera and the remote control of the robot. He then changed the access password and restarted the device.
But immediately after the restart, the robot started moving and playing racist insults over the loudspeaker. “I had the impression it was a child, maybe a teenager,” Swenson said. “Maybe they were just jumping from device to device and messing with families.” There have been similar incidents in the USA in the past. Here too, Ecovacs vacuum cleaners had been hacked and controlled remotely. Each time the attackers played insults over the loudspeaker.
When asked, the manufacturer said it had found no evidence that the devices had been hacked via a gap in the Ecovacs system. At least the company has announced a security upgrade for November for the Deebot X2, which appears to be particularly easy to crack.
Whether this fixes the problems remains to be seen. In addition to the security gaps, the Chinese manufacturer is also criticized because the vacuum robots take photos of their users’ private surroundings in order to train the company’s AI. Even recordings and data deleted by users are still stored and used.
