Jiska - Vacuum Cleaning Security: Pinky and The Brain Edition
Reverse engineers robot vacuum cleaners to reveal camera surveillance capabilities, Bluetooth vulnerabilities, and cloud data exposure.
Summary
Robot Vacuum Security Research
Jiska Classen (security researcher, Technical University of Darmstadt) presents comprehensive security research on consumer robot vacuum cleaners, revealing surveillance capabilities and vulnerabilities in popular models.
Firmware Analysis
Using UART debugging interfaces and firmware extraction from NAND flash, Classen analyzes the embedded Linux firmware in Roomba, Neato, and iRobot models. The firmware includes cloud connectivity modules, camera subsystems, and navigation AI components.
Camera and LiDAR Privacy
Camera-equipped models (iRobot Roomba i7, Ecovacs) capture and upload environmental imagery to cloud servers for navigation and customer support. Classen analyzes what imagery is retained, for how long, and who can access it — raising significant home privacy concerns.
Bluetooth Protocol Vulnerabilities
The Bluetooth LE control protocol used by vacuum cleaners contains authentication weaknesses that allow unauthorized device control from within Bluetooth range — enabling an attacker to disable the vacuum, alter its schedule, or dump its internal map of the home's floor plan.
Related talks
Main Stage·40 min
Reynaldo · nyx
Reverse engineers commercial vape and sound monitoring sensors installed in school restrooms, uncovering unauthenticated telemetry feeds and cloud vulnerabilities.
Main Stage·46 min
smea
A thorough security analysis of internet-connected intimate devices revealing Bluetooth vulnerabilities, insecure APIs, and privacy failures.
Main Stage·42 min
Mark Omo · James Rowley
Reverse engineers electronic gun safes and commercial digital vaults, demonstrating effortless physical and electromagnetic bypasses across leading brands.