How Ecovacs Robots Got Hacked And What We Can Learn From It - Dennis Giese

How Ecovacs Robots Got Hacked And What We Can Learn From It - Dennis Giese

Speakers: Dennis Giese, Security Researcher

Conference: Nullcon

YouTube: https://www.youtube.com/watch?v=7rJd28tuStI

Overview

In this insightful talk at Nullcon, security researcher Dennis Giese, known for his extensive work in wireless and embedded security, detailed a seven-year journey into uncovering critical vulnerabilities within Ecovacs robotic devices. Titled "How Ecovacs Robots Got Hacked And What We Can Learn From It," the presentation exposed a litany of security flaws ranging from trivial encryption keys to remote code execution, impacting millions of users and significantly damaging the company's reputation and market value. Giese, a self-proclaimed "vacuum robot and IoT collector," highlighted that these issues were not isolated to Ecovacs but are endemic across the IoT landscape, emphasizing the urgent need for better security practices in connected devices.

The talk served as a stark reminder of the inherent security and privacy risks posed by increasingly sophisticated IoT gadgets in our homes. Giese meticulously explained how devices, despite often carrying certifications like ETSI and ISO 27001, can harbor severe vulnerabilities that allow bad actors to spy on users, shout racist slurs, or even potentially flood homes. His research, conducted collaboratively with Brayan, underscores that the convenience offered by smart devices often comes at the cost of robust security, leaving users exposed to various forms of exploitation.

Beyond the technical exposition, Giese also delved into the broader implications of his findings, including the challenges of responsible disclosure, the often-inaccurate nature of media coverage, and the critical importance of a company's response to security incidents. The Ecovacs case, which saw a significant dip in stock price and widespread public outrage following media reports, serves as a cautionary tale for any company developing IoT products, stressing that foundational security principles cannot be overlooked.

Background

▶ Watch: Introduction and provocative alternative title (0:00)

The proliferation of IoT devices, from smart locks to vacuum robots, has introduced unprecedented convenience into daily life, but also a new frontier for security and privacy risks. Dennis Giese's research focuses on this critical intersection, driven by a motivation to reverse engineer hardware, free devices from cloud dependency, unlock hidden features, and ultimately, find vulnerabilities. His long-running involvement in this niche, dating back to 2017 with talks at CCC and Defcon, has seen him investigate numerous vendors including Xiaomi, Roborock, Viomi, Dreamy, Narwal, and now Ecovacs, systematically uncovering similar flaws across the industry.

The fundamental problem, as Giese explains, stems from the inherent difficulty of developing secure hardware and software. Many IoT companies, some relatively new to the tech landscape, often lack the deep security expertise required to protect complex, internet-connected devices. This often results in "shady behavior" such as excessive telemetry collection for machine learning, often sent back to servers in originating countries like China or the US, without clear user consent or transparency. Furthermore, the increasing integration of cameras and microphones into these devices amplifies privacy concerns, as the potential for surveillance, intentional or otherwise, becomes a tangible threat. Giese pointedly notes that even devices boasting certifications from bodies like TÜV Rheinland or compliance with ETSI and ISO 27001 standards were found to be easily compromised, casting doubt on the efficacy of such assurances in practice. His work on Ecovacs devices began in 2018 with initial investigations into early models, which, despite their weak hardware, already exhibited fundamental security flaws. The return to Ecovacs in 2022 revealed that while the hardware had significantly improved, the underlying security posture had largely stagnated, presenting a familiar landscape of vulnerabilities.

Key Findings

▶ Watch: Motivation for hardware hacking and device freedom (3:30)

Giese's seven years of research into Ecovacs robots revealed a comprehensive array of vulnerabilities, many of which persisted across different models and generations of devices. These findings collectively paint a picture of neglected security fundamentals:

• Persistent SSL/TLS Issues: Both the robot devices and the mobile application consistently failed to properly validate SSL certificates. This critical flaw enabled Man-in-the-Middle (MITM) attacks, allowing attackers to intercept communications, including sensitive user authentication tokens, and gain full access to user accounts.
• Unsigned and Unprotected Firmware: Ecovacs devices routinely ran unsigned firmware, meaning that modified or malicious firmware could be flashed onto the devices without detection. The firmware itself was often unprotected, allowing for easy modification and analysis.
• Derivable Root Passwords: On some models, the root password for the device could be computed directly from its serial number, offering a straightforward path to administrative access.
• Easy Physical Debug Access: Many devices provided readily accessible UART and USB debug pins, often hidden only by a plastic cover, simplifying the process of gaining shell access and reverse engineering.
• Command Injection Vulnerabilities: Giese discovered multiple avenues for command injection, including through manipulated credentials, altered URLs, and even specially crafted sound files, which could be used to execute arbitrary commands on the robot.
• The "Live Video Apocalypse" (Remote PIN Bypass): A significant flaw where the PIN protection for accessing the robot's camera feed was implemented solely on the client-side (the mobile app) rather than on the robot itself. This client-based authentication meant that an attacker who compromised the app or intercepted communications could bypass the PIN and access the camera without the robot's knowledge, as the robot did not track successful connections or maintain honest logs.
• Bluetooth LE Remote Code Execution (BLE RCE): This critical vulnerability allowed an attacker to achieve root-level code execution on fully stock, unmodifed devices remotely via Bluetooth Low Energy (BLE). The attack leveraged a trivial AES encryption key ("12345678 Ecovacs") used in the GATT protocol communication and a complete lack of input validation for payloads.
• Hardcoded Secrets and Trivial Obfuscation: The communication protocols and firmware often contained hardcoded secrets and relied on easily reversible obfuscation techniques like XOR, offering minimal protection against reverse engineering.
• Creative Encryption Key Generation: Giese found instances where firmware encryption keys were generated using highly insecure methods, such as incorporating someone's email address as a "random" string.
• Base Station Vulnerabilities: Ongoing research revealed problems in the communication between robots and their base stations, again due to trivial encryption keys, which could lead to taking over the base station and potentially causing physical damage, such as flooding a house if plumbed into the water supply.

In total, the research identified 18 vulnerabilities across over 30 Ecovacs models. As of the talk, nine CVEs had been published, with 10 more still unpatched and awaiting disclosure.

Technical Deep Dive

▶ Watch: Core reasons why IoT devices are untrustworthy (4:18)

The technical complexity of modern vacuum robots involves a dual-processor architecture. On one hand, a Linux-based system-on-chip (SoC) handles high-level functions like navigation, mapping, and connectivity (Wi-Fi, Bluetooth). This SoC has access to critical sensors such as LiDAR, cameras, and microphones. On the other hand, a separate, often less powerful, microcontroller handles real-time operations like motor control for wheels and safety mechanisms (e.g., cliff sensors). Attackers, like Giese, target various components: the device's storage, debug interfaces, and communication channels between the device and the app, and between the device and the cloud.

Giese's initial foray into Ecovacs in 2018 involved reverse engineering an older model with a single-core ARM chip and 128MB of RAM. He successfully dumped the firmware, identified UART and USB pins, and uncovered fundamental flaws: SSL issues (sending unencrypted data) and unsigned firmware. The hardware was so weak, however, that the hacking potential was limited.

By 2022, Ecovacs hardware had significantly advanced, featuring quad-core or octacore CPUs and up to 2GB of RAM (or 8GB in lawnmowers). Despite this, Giese found the exact same underlying security issues that plagued the older, weaker devices. This included continued SSL certificate validation failures in both the robot and the app, unsigned firmware, the ability to compute the root password from the serial number, and easily accessible debug ports. Tools used were common and inexpensive: a cheap TTL adapter (UART), a Flash Reader, and a Raspberry Pi for both. Giese also utilized development boards for specific SoCs (like Horizon X3 chips) to test exploits without risking expensive production devices.

The software vulnerabilities were extensive. Command injection was possible through multiple vectors: manipulating credentials, changing URLs, and even crafting malicious sound files. The SSL breakdown was particularly egregious; neither the robot nor the app performed proper certificate validation. This meant any public Wi-Fi connection could be exploited for a Man-in-the-Middle (MITM) attack, leading to the leakage of OAuth tokens and full account compromise. Giese recommended using tools like Apple's CMM to efficiently test mobile apps for such vulnerabilities.

Further analysis revealed hardcoded secrets and trivial XOR obfuscation in communications. A particularly alarming finding was the use of an email address as a "random" string for generating firmware encryption keys. Giese also noted the presence of machine learning models in the firmware, including one for detecting dog feces.

The "Live Video Apocalypse" (PIN bypass) was a prime example of flawed security architecture. The PIN to access the robot's camera was enforced only by the mobile application, not by the robot itself. This client-based authentication is inherently insecure, as the client's decision on access cannot be trusted. The robot also failed to log successful camera connections, making it impossible to detect unauthorized access. If an attacker could compromise the app or intercept communications (e.g., via the SSL vulnerability to get an OAuth token), they could simply tell the app that the PIN was correct, gaining unfettered camera access.

The most critical vulnerability was the Bluetooth LE Remote Code Execution (BLE RCE). Present in all newer robots and lawnmowers, this allowed for root-level compromise. The communication over BLE used the GATT protocol, but the encryption relied on a laughably trivial AES key: "12345678 Ecovacs." Crucially, there was no input validation for the incoming BLE payloads. This combination allowed an attacker to send a specially crafted payload over Bluetooth, which the robot would execute as root. Giese noted the irony that Ecovacs proudly claimed TÜV Rheinland security certifications while harboring such a basic, fundamental flaw.

Demo / Proof of Concept

▶ Watch: Long-running history of robot hacking research (6:00)

Dennis Giese presented several compelling demonstrations to illustrate the severity of the vulnerabilities.

1. Live Video Apocalypse (PIN Bypass) Demonstration:

This demo showcased the critical flaw in the client-based authentication for camera access.

• Setup: On the left side of the screen, Burp Suite was running, configured to intercept and modify network traffic. The Ecovacs mobile app was used to attempt camera access.
• Attack Flow:

1. Giese attempted to access the robot's camera via the app and entered an incorrect PIN. As expected, the app denied access, stating the PIN was incorrect.
2. He then enabled a rule in Burp Suite that would intercept the robot's response regarding the PIN verification. The rule was set to always tell the app that the PIN was "correct," regardless of the actual input.
3. With Burp Suite active, Giese re-entered the same incorrect PIN. This time, due to the intercepted and modified response, the app happily granted camera access.

• Impact: The live camera feed from the robot (featuring a dog named Opal) immediately appeared on screen. This demonstration vividly proved that the PIN protection was entirely client-side and could be trivially bypassed with an MITM attack, especially when combined with the SSL vulnerability that allowed for easy acquisition of OAuth tokens. This specific demo image was widely circulated in media outlets like TechCrunch and Vice.

2. Bluetooth LE Remote Code Execution (BLE RCE) Demonstration:

This demo illustrated the ability to gain root access to a fully stock robot remotely via Bluetooth.

• Setup: On the left, a netcat listener was set up, waiting for an incoming shell. The robot was a completely stock device, connected to Wi-Fi, running its original firmware. The NRF Connect app on a smartphone was used to send the malicious BLE payload.
• Attack Flow:

1. Using the NRF Connect app, a crafted BLE payload (leveraging the trivial AES key "12345678 Ecovacs" and lack of input validation) was sent to the robot.
2. Almost instantly, the netcat listener on the left side received a connection. Giese then demonstrated full root access to the robot by running commands like whoami (showing root) and exploring the file system.

• Distance Test: A further demonstration, unfortunately without audible sound in the recording but confirmed by Giese, involved a lawnmowing robot. When the BLE RCE payload was successfully delivered, the robot would play its boot-up music. This test was conducted from over 150 meters away, highlighting the significant range of the attack.

3. Robot Worm Scenario and Live Feed:

Giese described a potential robot worm scenario where a compromised robot (especially a lawnmower with its longer-range antennas) could actively scan for other nearby Ecovacs robots via Bluetooth and compromise them, creating a self-propagating network of hacked devices. He also showed a live feed from a robot compromised with the BLE RCE, demonstrating real-time video capture, emphasizing the persistent surveillance capabilities.

These demonstrations underscored the critical nature of the vulnerabilities and the ease with which an attacker could gain extensive control over Ecovacs devices, leading to significant privacy and security breaches.

Defensive Implications

▶ Watch: Summary of previous Ecovacs vulnerability findings (6:45)

The detailed findings from Dennis Giese's research offer crucial lessons for both IoT device manufacturers and consumers seeking to defend against similar attacks.

For Ecovacs and other IoT vendors, the implications are profound:

• Implement Server-Side Authentication and Authorization: The "Live Video Apocalypse" highlights the catastrophic failure of client-based authentication. All critical functionalities, especially camera access, must be verified and authorized by a trusted server, not solely by the client application. The robot itself must maintain an independent audit trail of access attempts.
• Robust SSL/TLS Certificate Validation: The widespread failure to validate SSL certificates in both the devices and the mobile apps is a fundamental security flaw. Manufacturers must ensure that all network communications are protected by properly implemented TLS, with rigorous certificate pinning and validation on both endpoints to prevent Man-in-the-Middle (MITM) attacks.
• Secure Firmware Updates: The use of unsigned firmware is unacceptable. All firmware updates must be cryptographically signed, and devices must verify these signatures before installing any update to prevent malicious firmware injection.
• Strong Cryptography and Key Management: Relying on trivial AES encryption keys ("12345678 Ecovacs") or using email addresses for key generation is a severe lapse. Strong, randomly generated encryption keys must be used, and proper key management practices, including secure storage and rotation, are essential for protecting communications and data.
• Comprehensive Input Validation: The Bluetooth LE Remote Code Execution (BLE RCE) was possible due to a lack of input validation. All inputs, regardless of their source (network, Bluetooth, physical interfaces), must be rigorously validated to prevent command injection and other forms of code execution.
• Establish a Clear Vulnerability Disclosure Program: Ecovacs' initial failure to respond to Giese's reports is a critical misstep. Companies must establish accessible and responsive vulnerability disclosure channels, such as a bug bounty program or a dedicated security contact, and engage constructively with researchers. Ignoring reports only allows vulnerabilities to persist and potentially be exploited by malicious actors.
• Transparent and Honest Public Response: Ecovacs' initial dismissive public statements ("extremely rare," "physical access required") caused significant backlash. Companies must be transparent, take responsibility, and communicate clearly and honestly with their users and the media about security incidents, outlining concrete steps for remediation.
• Security by Design: Security cannot be an afterthought. It must be integrated into the entire product development lifecycle, from initial design to deployment and ongoing maintenance. Regular security audits, penetration testing, and code reviews are essential.

For defenders and consumers, the takeaways emphasize vigilance and informed decision-making:

• Question Certifications: Do not blindly trust security certifications. Giese's research demonstrates that even certified devices can be deeply insecure.
• Be Wary of IoT Devices with Sensitive Sensors: Devices with cameras and microphones inherently carry higher privacy risks. Understand how these devices operate and what data they collect.
• Secure Your Home Network: Use strong, unique passwords for Wi-Fi, segment IoT devices onto a separate network (e.g., a guest network or VLAN) if possible, and keep router firmware updated.
• Monitor for Updates: Regularly check for and install firmware and app updates from manufacturers, as these often contain critical security patches.
• Research Before You Buy: Look for reviews and security assessments of IoT devices before purchasing. Prioritize vendors with a track record of good security practices and transparent vulnerability handling.
• Consider Physical Access: Be aware that many IoT devices are vulnerable to physical tampering if an attacker gains access to them.

Ultimately, the Ecovacs case serves as a powerful reminder that the "smart" in smart home devices does not automatically equate to "secure." Proactive measures from manufacturers and informed caution from consumers are both vital in mitigating the ever-evolving landscape of IoT security threats.

Key Takeaways

• Certifications Do Not Guarantee Security: Despite Ecovacs devices and apps being certified by bodies like TÜV Rheinland and claiming ETSI and ISO 27001 compliance, they contained critical and easily exploitable vulnerabilities.
• Client-Side Authentication is Catastrophic: Relying on the client (mobile app) to enforce security measures, such as PIN protection for camera access, is fundamentally flawed and leads to bypassable vulnerabilities like the "Live Video Apocalypse."
• Basic Security Flaws Persist for Years: Many of the vulnerabilities found in 2022-2023 were identical to those discovered in 2018, demonstrating a persistent neglect of fundamental security principles by the vendor.
• Trivial Keys and Lack of Input Validation Lead to RCE: The Bluetooth LE Remote Code Execution (BLE RCE) was possible due to a simple AES key ("12345678 Ecovacs") and a complete absence of input validation, allowing remote root compromise of devices.
• Vendor Response and Media Coverage Are Critical: Ecovacs' initial denial and delayed response led to significant public outrage and a $400 million drop in market value. Media coverage, while raising awareness, often over-accelerated and confused the technical details, highlighting the need for careful communication by researchers and companies.
• Hardware Hacking is an Underexplored Niche: While software security is heavily scrutinized, hardware vulnerabilities often remain undetected for years, presenting a significant area for security research and exploitation.

About the Speaker(s)

Dennis Giese is a renowned security researcher and hardware hacker with a primary focus on wireless and embedded security and privacy. His research interests span a wide array of interesting devices, including smart locks and, notably, vacuum robots, earning him the self-proclaimed title of "vacuum robot and IoT collector" with a collection exceeding 80 devices. Giese is also recognized as the recipient of the fifth season "theist letter" in Defcon's history, an achievement related to his previous work on smart locks. He is known for developing many of his research tools in PHP and Perl. This particular work was a collaborative effort with Brayan, whose main focus is application security and APIs, and who also pursues hardware hacking as a personal research hobby.