Reverse Engineering and Hacking Ecovacs Robots
Reveals critical security flaws in Ecovacs smart home robots including broken crypto, missing TLS validation, remote code execution, and camera eavesdropping.
Summary
Smart Home Robot Security Posture
Modern robotic vacuums and air purifiers integrate high-definition cameras, microphone arrays, and continuous cloud connectivity. The security architecture of Ecovacs, a market leader in home robotics, was evaluated across multiple product lines.
Discovered Vulnerabilities and Attack Paths
Reverse engineering Ecovacs firmware and communication stacks uncovered widespread vulnerabilities, including broken cryptographic routines, absent TLS certificate validation, honor-system access controls, and multiple remote code execution (RCE) flaws.
Unauthorized Surveillance and Privacy Breaches
Exploiting identified firmware weaknesses allows unauthorized attackers to access live camera feeds, intercept audio recordings, and bypass factory reset protections without user consent.
Vendor Disclosure and Certification Failures
Researchers share challenges encountered during the vulnerability disclosure process and discuss why third-party security certifications frequently fail to ensure real-world IoT device security.
Related talks
Creator Stage·43 min
Zoltan Balazs
Surveys pervasive architectural and implementation failures in consumer IoT gadgets, highlighting cleartext credentials, command injections, and insecure defaults.
Creator Stage·28 min
Justin Mott · Ava Petersen
Documents finding nine zero-day vulnerabilities in Vilo consumer home routers through UART interfacing, firmware reversing, and protocol analysis.
Main Stage·40 min
Reynaldo · nyx
Reverse engineers commercial vape and sound monitoring sensors installed in school restrooms, uncovering unauthenticated telemetry feeds and cloud vulnerabilities.