Analyzing network traffic of vacuum bots

Robot vacuums are sold in large numbers and often sit on home networks with little scrutiny, so this talk asks what they actually send over the wire. The speaker builds a simple home lab with a router, a switch with a mirror port and a cable modem, then captures traffic from several bots while exercising their features: scheduled cleaning, spot and manual driving, auto mode, maintenance reminders, floor mapping and live video.

Analysis of those captures shows the bots resolving their cloud providers over DNS, sending movement and cleaning commands as text messages, and sending periodic keepalives even when idle. Some models authenticated with SASL using plaintext credentials, while others used MQTT, which avoided plaintext. Setup was another weak point: the bot creates a temporary Wi-Fi network and receives the home Wi-Fi credentials from the phone. The app also pushed the phone's time and time zone to the device, which could reveal location and disrupt cleaning schedules when travel changed the zone.

The talk then covers threat models: a visitor on the local network could replay commands on an unprotected setup, a remote attacker would most easily target app credentials since no two-factor authentication was present, and floor plans could leak through the app or the phone. The speaker describes a months-long disclosure with the vendor, which closed the report without public disclosure or a CVE. The takeaway is to treat consumer IoT devices as untrusted and to test them on your own network before buying.