"Some robot vacuum cleaners have security vulnerabilities, risking internal home exposure with cameras turned on"

Consumer agency inspects security of 6 robot vacuum cleaner products

3 products received corrective action; Samsung and LG Electronics products are the best

Korea Consumer Agency [Provided by Korea Consumer Agency, prohibited for resale and database]

It has been revealed that some robot vacuum cleaners, one of the popular home appliances recently, have security vulnerabilities, raising concerns about forced camera activation, photo viewing, and theft.

The Korea Consumer Agency announced on the 2nd that an inspection of the security status, including mobile apps, security updates, and personal information protection policies, for six robot vacuum cleaner models currently on the market, confirmed the possibility of illegal access or manipulation in some products.

According to the mobile app security inspection results, the Narwal Freo Z Ultra (YJCC017) and Ecovacs Deebot X8 Pro Omni (DEX56) products showed a risk of internal home photos taken during use being exposed externally due to insufficient user authentication procedures.

This means that if a third party obtains the user's private key or ID information, they can access photos and videos stored on the cloud server without any separate authentication procedures.

Robot vacuum cleaners are equipped with cameras to avoid obstacles and identify movement paths, and they take photos so that users can check for obstacles.

Furthermore, a security vulnerability was identified in the Dreame X50 Ultra (RLX85CE) that allows a third party to forcibly activate the camera function.

If the user shares some function permissions with a third party, they can forcibly activate other functions, such as the camera, beyond the granted permissions. This allowed the third party to view real-time video and photos through the vacuum cleaner's camera.

For Ecovacs products, it was confirmed that when registering the product on the mobile app, a third party could access the cloud server and save malicious photo files to the user's phone's photo album.

The Consumer Agency stated that each company has accepted the issues raised and has completed measures for these security vulnerabilities. The Consumer Agency, along with the Korea Internet & Security Agency, has also completed verification of the measures taken.

Additionally, in a policy management review that included security update policies and personal information protection policies, Dreame products were found to have insufficient personal information management, raising concerns about the leakage of user personal information such as names and contact details.

The inspection was conducted based on advanced attack scenarios by security professionals, but immediate improvement measures were completed as the vulnerabilities could be exploited by hackers beyond a certain level.

In the 'device security' inspection, which included hardware, network, and firmware, the hardware security level of Dreame and Ecovacs products was found to be relatively low.

The inspection results showed that Samsung Electronics and LG Electronics products were relatively superior in the overall evaluation due to well-established access control settings, functions to prevent unauthorized manipulation, secure password policies, and update policies.

The Consumer Agency stated that it recommended security improvement measures for all surveyed businesses regarding deficiencies in mobile app authentication procedures, hardware protection, and firmware security, and all six businesses have responded with quality improvement plans.

The Consumer Agency also plans to continue conducting inspections in cooperation with the Korea Internet & Security Agency to strengthen security management for Internet of Things (IoT) products, including robot vacuum cleaners.