Users Prohibit Data Collection: Robot Vacuum Cleaner 'Disabled' via Remote Control
2025-11-02 / Read about 0 minute
Author:小编   

The iLife A11 smart robot vacuum cleaner, utilized by American engineer Harishankar, is outfitted with an Allwinner A33 SoC chip, a GD32F103 microcontroller, and the TinaLinux system to manage sensors like LiDAR. Harishankar discovered that the device was covertly transmitting logs and telemetry data to the manufacturer without obtaining his consent. Upon blocking the IP address of the telemetry server, he found that the robot vacuum cleaner ceased to function. Despite multiple unsuccessful attempts by the after-sales service team to diagnose the issue and their subsequent refusal to provide further assistance, Harishankar took matters into his own hands. He disassembled the device and developed Python scripts to conduct tests. During his investigation, he uncovered significant security flaws: the Android Debug Bridge function was operating without encryption, and the manufacturer had implemented a temporary security measure to restrict the device's functionality, which he successfully bypassed. Additionally, the device was using Google Cartographer technology to create a 3D map of his home and was uploading this data to the manufacturer's server. After delving deeper into the logs, Harishankar identified a 'kill command' that aligned precisely with the time the device stopped working. Through reverse engineering, he managed to restore the device to offline operation. Further investigation revealed that the device functioned normally at the after-sales service center because the staff had cleared the 'kill command' during the firmware reset process. However, once the device was reconnected to the internet, the manufacturer remotely issued a command to 'brick' (render inoperative) the device, as a response to the telemetry server being blocked.