Owners of Ecovacs robotic vacuums in various U.S. cities have reported a security breach. Hackers gained access to the cameras and controls, used offensive language through the speaker, and chased pets.
All affected vacuums were the Chinese-made Ecovacs Deebot X2, priced at around $900. The company confirmed the existence of vulnerabilities in some of its products.
The hacking attack lasted for several days in certain U.S. cities. Some users noted that their vacuums emitted sounds resembling interrupted radio signals, while the Ecovacs app indicated that the intruder accessed the live camera feed and remote control functions. Despite resetting their password and rebooting the robot, erratic behavior resumed shortly afterward.
Owners were shocked to discover that the robot could be used to spy on them silently for days. The hackers managed to disable the warning sound that should play when the camera is in use.
Security researchers had previously alerted Ecovacs to significant security flaws in its products. Exploits targeting the Bluetooth connection allowed complete access to the X2 model from over 100 meters away. The protective PIN code for remote control was also vulnerable to hacking.
Ecovacs stated that it found no evidence of the owners' accounts being compromised and no signs of any breaches in Ecovacs systems. The company released a patch for the PIN code vulnerability, but reports suggest this is insufficient.
In late May 2024, Ecovacs detected unusual credentials input when multiple login attempts originated from a single IP address, and this event was immediately blocked. The company plans to enhance the security of the X2 series with a wireless update in November. Ecovacs emphasizes that users should also implement measures to improve their online security, such as using strong and unique passwords and enhancing Wi-Fi security.
Comments (0)
There are no comments for now