news

한어Русский языкEnglishFrançaisIndonesianSanskrit日本語DeutschPortuguêsΕλληνικάespañolItalianoSuomalainenLatina

Recently, two security researchers said at the Def Con security conference that they found security issues in Ecovacs' sweeping robot products. After connecting to the Ecovacs robot via Bluetooth, hackers can remotely control it through the product's built-in WiFi connection function and access functions and information such as room maps, cameras, and microphones in its operating system.

In response to the above questions, Ecovacs said in an interview with Southern Finance Omnimedia that data security and user privacy are among the issues that Ecovacs attaches the most importance to. The Ecovacs Robotics Safety Committee has conducted internal research and reviews on issues such as network connection and data storage, and concluded that these security risks are extremely unlikely to occur in the daily use environment of users, and require professional hacking tools and close contact with the machine to complete, so users do not need to worry about it. Despite this, Ecovacs will actively optimize its products based on research and review findings.

Southern Finance Omnimedia reporters found that while the Internet of Things and smart home appliances are developing rapidly, in addition to sweeping robots, emerging smart home devices such as smart door locks and home cameras have also had many privacy and security issues in recent years, but relevant industry segmentation regulations and standards are still absent.

How to ensure information security in family life scenarios involving a lot of personal privacy information is still a problem that needs to be solved urgently in the smart home industry.

Remote hacking risk

According to two security researchers, Dennis Giese and Braelynn, Ecovacs' security issue mainly lies in the Bluetooth connection. Hackers can use their mobile phones to match and control the device within a range of 450 feet (about 130 meters). Once control is achieved, they can connect to the server through the robot's built-in WiFi networking function to achieve remote control.

Currently, the preventive measures taken by Ecovacs' sweeping robot devices are to enable Bluetooth for 20 minutes after being turned on and automatically restart once a day, but the Bluetooth of the brand's lawn mowers always remains on; in addition, when the camera is turned on, the device will play an audio file every five minutes to remind users that the device is on, but Dennis Giese said that hackers can delete the audio file to keep the device hidden.

In response, Ecovacs said it would use technical means to restrict second account logins, strengthen secondary verification of mutual connections between Bluetooth devices, and increase physical operations to trigger Bluetooth connections to enhance the security of its products in Bluetooth connections.

"Bluetooth security has always been a commonplace security issue." Wu Jianping, head of Bangbang Security Master Laboratory, pointed out in an interview with Southern Finance Omni-Media reporter that since the Bluetooth pairing key is a purely digital 4-digit or 6-digit password, modern computers can successfully decipher it within a few seconds if there are only ten thousand or one million possibilities.

In addition to Bluetooth-related vulnerabilities, the two researchers also discovered other security issues with Ecovacs products. They pointed out that even if the user account has been deleted, the robot's related data will still be stored in the cloud server; the user's authentication token is also stored in the cloud, which may cause the relevant user to still be able to access the device after deleting the account, threatening the privacy security of users who purchase the machine second-hand.

Wu Jianping pointed out that the "Data Security Law of the People's Republic of China" and other laws and regulations stipulate the storage period of user data by manufacturers under specific conditions. Usually, when a user deletes his account, the manufacturer only needs to destroy the relevant data within the corresponding period.

However, in current data supervision practices, except for some companies involved in data outbound business, regulatory authorities in most cases do not carefully examine the implementation of relevant data destruction. This makes data destruction dependent on the self-consciousness of the manufacturer, thereby increasing the risk of relevant data leakage after the cloud server is hacked.

A reporter from Southern Finance Omnimedia found that in the privacy agreement of the Ecovacs supporting APP, it is stated that after the user cancels the APP account, the manufacturer will "only retain your personal information for the period necessary for the purposes stated in this policy and the longest period permitted by laws and regulations. After that period, we will delete or anonymize it in a timely manner."

Ecovacs said that it will update the product software to implement the token expiration mechanism in real time, increase the difficulty of obtaining tokens, and clear the log information after resetting the device to ensure data security. In addition, it will remind users that if they want to transfer the device to others, they should reset the device to prevent information leakage.

"As for the questions raised by the security personnel this time, cracking can only be achieved by keeping the device within a certain range or disassembling the device under physical conditions. Ordinary users can avoid this by resetting machine settings, checking machine status in a timely manner, etc." said a smart home industry practitioner when communicating with reporters.

In its response, Ecovacs further stated that the company respects the habit of security experts to discover product risks through research and actively communicate with companies. Ecovacs Robotics believes that security experts' interaction with companies through attack and defense drills and results releases helps improve product safety.

Lack of industry standards

Looking back at smart home-related events in recent years, privacy disputes caused by security vulnerabilities are not uncommon. In addition to sweeping robots, home cameras, smart door locks and other networked devices with built-in image, sound sensors and storage capabilities are theoretically at risk of being remotely hacked, resulting in personal information leakage.

The frequent safety issues of various smart home appliances are due to the fact that, on the one hand, the current situation of corporate security construction needs to be further improved, and on the other hand, there is a lack of regulatory details in related fields.

Taking the field of sweeping robots as an example, the current general safety standard that is the main reference in the industry is the "General Safety Requirements for Service Robots for Household and Similar Purposes" (GB/T 41527-2022), but this standard only covers physical safety issues such as marking and instructions, stability and mechanical hazards, mechanical strength, and structure, but does not include security issues related to the device's operating system and the user personal information it collects.

Wu Jianping pointed out that although my country currently has regulatory requirements in terms of network security, hardware design and manufacturing, there has been a lack of corresponding subdivision standards in the field of intelligent products that combine software and hardware, and there is no way to talk about various security requirements and protection measures extended on this basis.

Taking chips, the core components currently widely used in domestic smart hardware, as an example, for some chips that use foreign-made chips or whose design solutions draw on foreign ideas, although domestic manufacturers use the products, they do not follow their complete maintenance systems and processes, which makes it impossible to fix the vulnerabilities of the underlying Linux system for a long time.

"For example, the Java programming language software service provider acquired by Oracle will control what type of hardware the related software and systems run on, what type of protocol the motherboard uses, and what vulnerabilities may exist. On the one hand, it is convenient to maintain subscription charges, and on the other hand it also helps to ensure the security of software and hardware." Wu Jianping said.

However, in the early years of extensive development of some Chinese manufacturers, the standard for the use of software and components was often "as long as it works", which resulted in many supporting security management measures failing to keep up. Manufacturers also cut off third-party access to their hardware design and architecture through patent protection and other means, making it impossible to obtain hardware version information, resulting in most network security penetration tests often stopping at the application layer and failing to sink to the hardware layer.

In this regard, Wu Jianping further suggested that, on the one hand, it is necessary to improve the construction of relevant industry standards and provide a way for regulators or third parties to inspect and test the safety of smart hardware products; on the other hand, Chinese manufacturers can also give priority to the use of domestic architecture technology to facilitate regulatory agencies to supervise from the company's procurement list and improve the transparency and reliability of the overall product design at the security level.