Reverse engineering and hacking Ecovacs robots

Reverse engineering and hacking Ecovacs robots

Speakers: Dennis Giese, Security Researcher, Hardware Hacker; Braelynn Hacker, Leviathan Security Group

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=_wUsM0Mlenc

Overview

This talk, presented by security researchers Dennis Giese and Braelynn Hacker at DEF CON 32, provides a comprehensive look into the security vulnerabilities and privacy risks inherent in Ecovacs IoT robots. Drawing from over five years of dedicated research, the speakers demonstrate how they achieved root access on a wide range of Ecovacs devices, including robot vacuums (up to the X2 series), lawn mowing robots, and Airbot air purifiers, as well as products from Ecovacs' sub-brand, Yedi. The core of their presentation highlights critical security flaws, culminating in a significant Bluetooth Remote Code Execution (RCE) vulnerability that allows for initial access without physical disassembly.

The motivation behind this extensive research extends beyond mere technical curiosity, delving into crucial aspects of user privacy, the right to repair, and the broader implications of connected devices in smart homes. Giese and Hacker emphasize the importance of verifying vendor privacy claims and the dangers posed by devices equipped with cameras and microphones that constantly "phone home" with potentially sensitive data. Their work serves as a stark reminder that even certified IoT products can harbor severe security weaknesses, challenging the industry's approach to device security and data handling.

Background

▶ Watch: Introduction and speaker background (0:00)

The journey into robot hacking for Giese and Hacker stems from a desire to understand, control, and secure the increasingly ubiquitous IoT devices in our homes. Dennis Giese, known for his extensive collection of over 600 IoT devices and 60-70 vacuum robots, has a long-standing goal of achieving root access on these machines to prevent them from constantly transmitting data to cloud servers. Braelynn Hacker, with a background in application security and APIs, began hardware hacking during COVID, focusing on robots, cameras, and smart locks. Their combined expertise has been instrumental in uncovering the deep-seated issues within the Ecovacs ecosystem.

The speakers trace their history of robot hacking back to 2017, targeting early Xiaomi and Roborock vacuum robots where over-the-air (OTA) update systems were found to be completely broken, allowing for local firmware updates. As vendors improved security, requiring physical teardowns and custom bootloader tools for newer Rockchip devices, the researchers adapted, developing techniques like secure boot bypasses for brands such as Dreamy, Roborock, Narval, and Shark. These efforts, sometimes taking months, highlighted the persistent cat-and-mouse game between security researchers and IoT manufacturers.

Ecovacs Robotics, founded in China in 1998, began producing its own brand of Deebot vacuum robots in 2007. By 2020, they held a 17% global market share, second only to iRobot, a position they estimate has strengthened significantly since. Their product line has expanded beyond vacuum robots to include window cleaners, mobile air purifiers, and lawn mowing robots. All devices targeted in this research run on Linux, distinguishing them from simpler, "dumb" robots. The typical hardware architecture involves a System-on-Chip (SOC) running Linux, responsible for navigation, mapping, and connectivity (Wi-Fi, Bluetooth, Ultra-Wideband, Lidar, cameras, microphones), and a Microcontroller (MCU) handling real-time operations like wheel control, infrared sensors, fans, and critical drop sensors to prevent physical damage.

The motivation for distrusting IoT vendors is multifaceted. Devices are constantly connected to home networks and the internet, with encrypted communication to the cloud that users cannot inspect. Past incidents, such as iRobot being caught selling images of users' homes labeled by gig workers, underscore the potential for data misuse. Furthermore, the speakers highlight the difficulty of developing secure hardware and software, leading to a proliferation of vulnerabilities. The presence of cameras and microphones in many robots raises significant privacy concerns, as devices might store pictures and audio indefinitely, both locally and in the cloud. The risk of purchasing compromised used devices, potentially pre-loaded with rootkits, further emphasizes the need for users to verify the integrity of their smart home technology—a task often only possible with root access.

Key Findings

▶ Watch: Specific Ecovacs, Yedi, and Airbot devices covered (2:30)

The research conducted by Dennis Giese and Braelynn Hacker on Ecovacs robots has uncovered a series of significant security vulnerabilities, demonstrating a persistent lack of robust security practices within the company's product lines. Many of these findings were shared with Ecovacs, but attempts to fix them either failed or were outright ignored, particularly for critical issues.

One of the earliest discoveries, dating back to 2018 with the Deebot 900 series, revealed that the firmware was entirely unprotected. This model, running on a weak Rockchip SOC with limited resources (1 core, 128MB RAM, 256MB NAND flash), also suffered from completely broken TLS (Transport Layer Security) and lacked integrity protections for its firmware. These weaknesses allowed researchers to achieve root access via a Man-in-the-Middle (MITM) attack, enabling the push of malicious OTA updates. However, due to the severely underpowered hardware, the practical utility of these findings was limited, and the results were not widely published at the time.

The most critical and recent finding, however, is a Bluetooth Remote Code Execution (RCE) vulnerability discovered last year. This flaw affects newer Ecovacs vacuum robots and all lawn mowing robots, and critically, it remained unpatched at the time of the DEF CON 32 presentation. This RCE allows attackers to gain initial access to the device without requiring physical disassembly, a significant escalation in the ease and stealth of compromise. The vulnerability leverages the Bluetooth Low Energy (BLE) protocol, which these devices use for initial provisioning (e.g., configuring Wi-Fi credentials). For lawn mowers, BLE is perpetually active, serving as a fallback control mechanism. In vacuum robots, BLE is active for approximately 20 minutes after booting and reactivates every time the device reboots, such as for routine memory cleaning. The speakers also alluded to a method for remotely forcing a robot reboot, which would effectively re-enable the BLE attack window, though the specifics were not detailed in the talk.

Overall, the key findings demonstrate a pattern of security negligence:

• Unprotected Firmware and Broken TLS: Allowing easy interception and manipulation of device communication and updates on older models.
• Lack of Integrity Protections: No verification mechanisms for firmware updates, enabling the installation of malicious software.
• Persistent BLE RCE: A severe vulnerability allowing remote, proximity-based code execution on a broad range of current Ecovacs products, which the vendor has failed to patch.
• Vendor Inertia: Ecovacs' repeated failure to adequately address known vulnerabilities, or outright ignoring serious issues, highlights a systemic problem in their security posture.

These findings collectively point to significant privacy and security risks for users of Ecovacs and Yedi devices, underscoring the speakers' assertion that current IoT security certifications cannot be fully relied upon.

Technical Deep Dive

▶ Watch: Vendor knew vulnerabilities, failed to fix critical issues (3:15)

The technical deep dive into Ecovacs robots reveals a layered approach to gaining control over these sophisticated IoT devices, with the recently discovered Bluetooth Remote Code Execution (RCE) serving as a primary vector for initial access on modern hardware. The speakers' ultimate goal is to achieve root access without the need for physical disassembly, minimizing the barrier to entry for exploitation.

At the hardware level, Ecovacs robots utilize a dual-component architecture: an SOC (System-on-Chip) and an MCU (Microcontroller Unit). The SOC, running a Linux operating system, is the brain of the robot, managing complex functions like navigation, mapping, and connectivity. It interfaces with high-level sensors such as Lidar, cameras, and microphones, and handles communication via Wi-Fi, Bluetooth, and in some newer models, Ultra-Wideband (UWB). Conversely, the MCU is dedicated to real-time, low-latency operations, controlling essential physical components like wheels, infrared sensors, fans, and crucial drop sensors. This separation ensures that critical safety functions are not delayed by the complexities of the Linux-based SOC.

Early Ecovacs models, such as the Deebot 900 series (circa 2018), were found to be remarkably insecure. These devices, based on a Rockchip SOC, featured firmware that was entirely unprotected, meaning it lacked encryption or obfuscation, making analysis straightforward. More critically, their implementation of TLS (Transport Layer Security) was "completely broken," allowing attackers to easily decrypt and manipulate network traffic. The absence of integrity protections meant that firmware updates could be tampered with. This combination of vulnerabilities allowed researchers to perform Man-in-the-Middle (MITM) attacks to intercept communications and push custom, malicious OTA updates, thereby gaining root access. However, the hardware limitations (128MB RAM, 256MB NAND flash) made running complex tools or custom firmware impractical, leading the researchers to not widely publish these findings.

For more recent devices, the game changed. As vendors like Roborock and Xiaomi implemented stronger protections, including secure boot mechanisms, researchers had to develop more sophisticated techniques, often involving physical teardowns to access UART interfaces or custom bootloader tools. By 2021 and 2023, methods were developed to bypass secure boot on various competitors' devices through "bootloader magic," though these processes were time-consuming, sometimes taking months.

The pivotal technical finding for Ecovacs in this talk is the Bluetooth Remote Code Execution (RCE). This vulnerability targets the Bluetooth Low Energy (BLE) protocol, which is crucial for the initial setup and provisioning of new robots, allowing users to push Wi-Fi credentials to the device. The RCE exploits weaknesses in the BLE service handling, likely a buffer overflow or command injection vulnerability, though the precise exploit primitive was not detailed. The attack window for this RCE is particularly concerning:

• Lawn Mowing Robots: BLE is always active on these devices, as it serves as a fallback control mechanism, providing a constant attack surface.
• Vacuum Robots: BLE is active for approximately 20 minutes after booting. It also reactivates every time the robot reboots, which can occur nightly for memory cleaning or other maintenance tasks. The speakers also mentioned the existence of a remote method to force a reboot, which would effectively reset and reopen this 20-minute attack window, making the vulnerability more exploitable on vacuums.

Once the BLE RCE is triggered, it grants an attacker initial code execution on the device. From this point, the researchers can leverage this access to establish persistence, allowing them to run custom firmware and maintain control even after reboots. This capability allows for full verification of vendor privacy claims, modification of device behavior, and integration into custom smart home systems like Home Assistant, bypassing the vendor's cloud infrastructure. The ability to gain root access without physical disassembly marks a significant victory for researchers seeking to democratize control over smart home devices.

Demo / Proof of Concept

▶ Watch: Why distrust IoT companies: data collection, cameras, microphones (4:40)

While the talk transcript does not include a step-by-step live demonstration of the Bluetooth Remote Code Execution (RCE), the speakers clearly assert that this vulnerability was discovered and proven effective last year. Dennis Giese explicitly states, "let's talk about our main point today and this is the Bluetooth remote code execution which we found at some point last year. Um which we were hoping that we would patch until today, but we didn't." This confirms that the RCE is a demonstrated and active capability, not merely a theoretical possibility.

The speakers describe the RCE as a mechanism to "get initial access" to Ecovacs robots. This initial access is achieved by exploiting vulnerabilities within the Bluetooth Low Energy (BLE) provisioning process. For newer vacuum robots and all lawn mowing robots, BLE is utilized to push Wi-Fi credentials during setup. The critical aspect of this proof of concept is its proximity-based nature, operating without the need for physical disassembly of the device. The RCE's efficacy is further highlighted by its operational windows: constantly active on lawn mowers and active for 20 minutes after boot or reboot on vacuum robots. The ability to remotely force a reboot, though not detailed, implies a method to reliably re-establish the attack window on vacuums.

The successful exploitation of this BLE RCE allows researchers to "get persistence and run some custom firmware on some of the devices which don't have protections." This confirms that the proof of concept extends beyond mere temporary code execution to achieving lasting control over the robot's operating system. The implications are profound, demonstrating that an attacker in proximity can fully compromise affected Ecovacs devices, verifying the speakers' claims of widespread security and privacy issues across the app, robots, and cloud infrastructure, despite vendor certifications.

Defensive Implications

▶ Watch: iRobot scandal: user photos sold without consent (6:00)

The extensive research by Dennis Giese and Braelynn Hacker into Ecovacs robots reveals critical vulnerabilities that demand immediate attention from both users and the vendor. The defensive implications are significant, requiring a re-evaluation of trust in IoT device security and a proactive approach to mitigating risks.

First and foremost, the discovery of a persistent Bluetooth Remote Code Execution (RCE) vulnerability, particularly affecting lawn mowing robots where BLE is always active, necessitates extreme caution. For vulnerable lawn mowers, users should turn them off until a vendor-issued fix is confirmed and applied. If devices are not in use, they should be powered down to minimize exposure.

For Ecovacs devices that do not utilize BLE or have older firmware, the speakers offer a nuanced recommendation: do not update them if you wish to retain root access or control over the device's behavior. This advice stems from the observation that past firmware updates have sometimes introduced new security features that lock down devices, making future rooting attempts more difficult. However, this also means foregoing potential security patches for other vulnerabilities, presenting a difficult trade-off for users.

The talk also highlighted the general insecurity of IoT devices and their associated applications. Users should exercise extreme caution with network connections: avoid connecting vulnerable apps to open Wi-Fi networks, such as those found at conferences like DEF CON, as they can expose devices to various attacks.

The issue of used devices is a significant concern. The researchers warn that "used devices might come from come with a compromised firmware." It is "very difficult to verify" the integrity of such firmware, making root access the only reliable method. While performing a factory reset before selling a device is crucial for protecting personal data, users purchasing used devices should be aware that a factory reset might not fully remove a malicious, persistent rootkit. This underscores the need for greater transparency and verifiable integrity checks from manufacturers.

The broader implications extend to data privacy. With robots increasingly equipped with cameras and microphones, the potential for surveillance is high. The speakers' ability to "validate the claims of the vendors" and find "a lot of like security and privacy issues" across the app, robots, and cloud emphasizes that vendor assurances and certifications (like TF certification mentioned in the talk) cannot be blindly trusted. Users should choose their smart home partners wisely, recognizing that compromised devices can be repurposed as "stalker tools."

In summary, defenders must:

• Immediately power off vulnerable lawn mowers until a patch for the BLE RCE is available.
• Exercise caution with firmware updates on older devices if maintaining root access is a priority, understanding the associated risks.
• Never connect vulnerable IoT apps to untrusted or open Wi-Fi networks.
• Be extremely wary of used IoT devices, as firmware integrity is difficult to verify; a factory reset may not be sufficient against persistent compromise.
• Question vendor privacy claims and certifications, as they do not guarantee robust security.
• Understand the full privacy implications of devices with cameras and microphones in their homes.

These measures, while not exhaustive, represent critical steps to protect against the types of vulnerabilities exposed by Giese and Hacker's research.

Key Takeaways

• Pervasive IoT Security Flaws: Ecovacs robots, including vacuums, lawn mowers, and air purifiers, exhibit significant security vulnerabilities, ranging from unprotected firmware and broken TLS on older models to critical Bluetooth Remote Code Execution on newer devices.
• Bluetooth RCE Poses Immediate Risk: A major Bluetooth Low Energy (BLE) Remote Code Execution (RCE) vulnerability allows proximity-based initial access without physical disassembly on newer Ecovacs vacuums and all lawn mowing robots, with the vendor failing to patch it.
• Vendor Negligence and Failed Fixes: Ecovacs has been aware of many findings for years, with attempts to fix some vulnerabilities failing and other "really, really, really bad" issues being ignored, highlighting a systemic problem in their security posture.
• Certifications Are Not Guarantees: Industry certifications (like TF certification) do not guarantee robust security, as demonstrated by the presence of severe vulnerabilities in certified products. Users should not blindly trust such claims.
• Privacy and Data Collection Concerns: IoT devices with cameras and microphones pose significant privacy risks, as they can "phone home" with sensitive data or store it indefinitely. Root access is often the only way for users to verify vendor privacy claims and ensure device cleanliness.
• User Actions for Defense: Users should power off vulnerable lawn mowers, be cautious with used devices (factory reset may not be enough), avoid open Wi-Fi with vulnerable apps, and critically evaluate the security and privacy practices of all IoT device manufacturers.

About the Speaker(s)

Dennis Giese is a distinguished security researcher and hardware hacker with a deep focus on wireless and embedded security and privacy. His passion lies in reverse engineering virtually any device he finds interesting, particularly in the realm of IoT. He is a prolific collector, boasting an impressive collection of over 600-700 IoT devices and 60-70 vacuum robots. Dennis's primary goal in his research is to achieve root access on vacuum robots, a journey he documents on his website, robotinfo.dev, which serves as a resource for hardware information, software insights, and rooting methods for various robots. His work consistently highlights the security and privacy risks inherent in smart home technology.

Braelynn Hacker is a security professional who hacks things for Leviathan Security Group during her day job, with a general focus on application security and APIs. Her involvement in robot hacking began during COVID-19 as a personal research endeavor, taking apart a broken robot vacuum and attempting to hack it for fun. This sparked a passion for hardware hacking, now primarily focusing on robots, cameras, and smart locks. Her contributions to this talk are entirely personal research and do not reflect the views of her employer. Braelynn's work underscores the growing interest and expertise in consumer device security from a diverse range of researchers.