Accidental Control of Thousands of Robot Vacuums
A man unintentionally took control of thousands of internet-connected robot vacuums while attempting to modify his device for use with a PlayStation controller. This unexpected access provided him with detailed floor layouts and even live camera footage from a robot vacuum made in China.
A report highlights a critical security vulnerability in the DJI Romo robot vacuum. During his personal modification project, the user unintentionally accessed over 6,700 devices worldwide. This security lapse exposed sensitive information, including live camera feeds, detailed floor plans, and remote control capabilities. Some researchers suggest that he may have stumbled upon a backdoor placed by the Chinese company for potential espionage.
The incident was discovered by AI strategist Samy Adufal, who was using Claude code to analyze the communication protocol between his DJI Romo robot vacuum and the servers. His primary aim was to enable control of his devices through a PlayStation controller. However, he inadvertently gained access to the credentials needed for approximately 6,700 robots across several continents.
Adufal clarified that what he did wasn’t hacking in the traditional sense. “I didn’t break any rules, I didn’t bypass any rules,” he said, emphasizing that he merely extracted private tokens from his vacuum. This resulted in access to live servers situated in the US, Europe, and China.
Upon realizing the security flaw, Adufal promptly informed DJI instead of misusing the access or compromising user privacy. In response, DJI implemented updates to resolve major issues without requiring end-user intervention. The company rolled out fixes to safeguard affected vacuums and prevent further unauthorized access.
Even though the primary vulnerabilities have been addressed, Adufal noted that other security concerns remain. One of these is the capability to stream video feeds from the DJI Romo devices without needing a security PIN. He also identified another significant issue that remains undisclosed, pointing out that the core problem lies beyond the encryption methods used during server communications. His investigation revealed that all data collected by the robot vacuums is stored in plain text on the server, making it easily accessible to anyone with server access.
Previous reports have shed light on the security risks associated with internet-connected devices, including robot vacuums. In one case, a woman was alarmed to find that a picture of her in a vulnerable situation had been shared online by a foreign gig worker monitoring equipment for Roomba.
An investigation by MIT Technology Review uncovered that gig workers in Venezuela were tasked with labeling items in photos taken inside homes by Roomba vacuums, sometimes featuring identifiable individuals. At least 15 of these images, including those of children and people in private moments, were shared on social media. This appears to be part of a broader issue where labelers often have access to private audio and video content.
Following this investigation, iRobot ended its contract with Scale AI, a data annotation company. However, iRobot’s CEO, Colin Angle, downplayed concerns about human workers potentially seeing sensitive images, arguing that such access is necessary for improving the company’s object recognition algorithms.
