- 10
- 194 657
Dennis Giese
Germany
Приєднався 25 гру 2018
Ecovacs X1 Remote Live Video PIN bypass (applies also to X2, Z1, Z2, Goat G1 and others)
This is a demo for our DEFCON/HITCON talk about Ecovacs Robots: dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots.html
Here we demonstrate how firmware of Ecovacs robots does not verify the Live Video Pin at all. The robot runs the latest firmware. The authentication for the Live Video function is done solely on the client side (the app plugin). An attacker can, in combination with the TLS certificate validation bug+JWT token leak, access the camera remotely, even if the owner has set a PIN.
Ecovacs tried to patch the App plugin for the X2 (but not X1 nor Z1) and enforce a new version of the app. We were able to simply downgrade the app and reuse the old plugin again. The legitimate owner of the device does not need to have any modifications of their phone or app.
The vulnerability exists in the latest versions (July 2024) of Ecovacs Goat lawnmowers, Ecovacs X2, Ecovacs Z2, Ecovacs X1 and Ecovacs Z1. Other devices that use a Live Video Pin might be also impacted.
We hope, that Ecovacs releases a firmware patch and finally does the right steps. As of now, Ecovacs newer replied to us (after we contacted them in December). They tried to silently fix it, but that was unsuccessful.
Ecovacs devices and apps are certified by TÜV Rheinland and claim to meet ETSI EN 303 645 and ISO 27001:2013 standards.
Here we demonstrate how firmware of Ecovacs robots does not verify the Live Video Pin at all. The robot runs the latest firmware. The authentication for the Live Video function is done solely on the client side (the app plugin). An attacker can, in combination with the TLS certificate validation bug+JWT token leak, access the camera remotely, even if the owner has set a PIN.
Ecovacs tried to patch the App plugin for the X2 (but not X1 nor Z1) and enforce a new version of the app. We were able to simply downgrade the app and reuse the old plugin again. The legitimate owner of the device does not need to have any modifications of their phone or app.
The vulnerability exists in the latest versions (July 2024) of Ecovacs Goat lawnmowers, Ecovacs X2, Ecovacs Z2, Ecovacs X1 and Ecovacs Z1. Other devices that use a Live Video Pin might be also impacted.
We hope, that Ecovacs releases a firmware patch and finally does the right steps. As of now, Ecovacs newer replied to us (after we contacted them in December). They tried to silently fix it, but that was unsuccessful.
Ecovacs devices and apps are certified by TÜV Rheinland and claim to meet ETSI EN 303 645 and ISO 27001:2013 standards.
Переглядів: 728
Відео
BLE RCE Ecovacs Goat G1 details (reverse shell via unauthenticated BLE)
Переглядів 4813 місяці тому
This is a demo for our DEFCON/HITCON talk about Ecovacs Robots: dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots.html Here we demonstrate how we can send a malicous BLE payload to an Ecovacs Goat G1 lawnmowing robot. The robot runs the latest firmware. We use a stock Android phone with Nordic nRF connect to send the payload to the robot. Until receiving the payload, the robot...
BLE RCE Ecovacs Goat G1 lawnmower (code execution as root via unauthenticated BLE)
Переглядів 4753 місяці тому
This is a demo for our DEFCON/HITCON talk about Ecovacs Robots: dontvacuum.me/talks/DEFCON32/DEFCON32_reveng_hacking_ecovacs_robots.html Here we demonstrate how we can send a malicous BLE payload to an Ecovacs Goat G1 lawnmowing robot. The robot runs the latest firmware. We use a stock Android phone with Nordic nRF connect to send the payload to the robot. Until receiving the payload, the robot...
[37c3]Ecovacs Home: Live video ap(p)ocalypse demo
Переглядів 92811 місяців тому
Uncommented demonstration of the Live video pin bypass for Ecovacs devices. WARNING: jumpscare at the end of the video This demo shows that the access to the camera microphone of a Ecovacs vacuum robot is possible, even if you do not have the pin. A lot of security logic is implemented in the app itself (in contrast to the cloud or the device), and it can be easily bypassed. In combination with...
(broken) DEFCON 31 "Vacuum robot security and privacy - prevent your robot from sucking your data"
Переглядів 9 тис.Рік тому
This video is just for reference until DEFCON releases the official recording. The recording is very bad, but should still give you some idea about the contents of the talk. Find the abstract and slides here: dontvacuum.me/talks/DEFCON31/DEFCON31-Vacuum_robot_security_and_privacy-Prevent_your_robot_from_sucking_your_data.html This is an alternative version of the talk, which is not broken: medi...
Roborock S6/T6 Teardown: Many screws away from getting root... (Part 1 of the rooting process)
Переглядів 78 тис.4 роки тому
With the introduction of the Roborock S6 and T6 (and S4/T4) models it is not possible to use the old method to get root access to the vacuum robots [see my talks to learn more about the old method]. Roborock changed the firmware format and started to sign all firmwares, sound packages and configurations. Also the manufacturer introduced geo-blocking, where the T6 model would not work outside of...
Roborock S6/T6 Technical information and rooting (Part 2)
Переглядів 41 тис.4 роки тому
In this video I give a technical overview about the Roborock S6/T6 vacuum cleaning robots and its differences to previous models. I explain the steps which are required to obtain root access and to install custom firmware (e.g. valetudo). Please watch the whole video before you start disassembling your vacuum robot. By disassembling your device you risk to break it. Due to the new firmware pack...
Ecovacs DEEBOT 900 teardown (with some technical info but without comments)
Переглядів 44 тис.4 роки тому
Hi, A while ago I did some teardown and analysis of the Ecovacs DEEBOT 900 for my DEFCON and Chaos Communication Camp 2019 talk about privacy and IoT (dontvacuum.me/talks/CCCamp2019/CCCamp2019_Dennis-Giese-Privacy-leaks-in-smart-devices.html). Due to the limited hardware (in comparison to Roborock/Xiaomi/Viomi), I did not bother to further investigate ways to root the device. While sorting my r...
Rooted Xiaomi M1S vacuum robot camera perspective
Переглядів 3,4 тис.4 роки тому
Video was streamed from the vacuum robot (model: roborock.vacuum.m1s) in July 2019. In contrast to the other models, this model have an upward facing camera to detect different rooms. There is no public rooting method available for this model.
DEF CON 26 - Dennis Giese - Having fun with IoT: Reverse Engineering and Hacking of Xiaomi IoT
Переглядів 17 тис.5 років тому
Find more information on my homepage: dontvacuum.me To root your vacuum cleaners: github.com/dgiese/dustcloud Documentation of Xiaomi IoT devices: github.com/dgiese/dustcloud-documentation Slides: dontvacuum.me/talks/DEFCON26/DEFCON26-Having_fun_with_IoT-Xiaomi.pdf Follow me on Twitter: dgi_de While most IoT accessory manufacturers have a narrow area of focus, Xiaomi, an Asian based...
Dear, really appreciate your support, hiw can i contact yiu?
1 of 10 at repairability scale
Thanks Dennis, followed your quide and got a roborock V1 (also firmware 4010) working with Valetudo, man oh man there are a lot of screws in the V1, then I rooted a roborock S5 by just using the flash tool you mentioned on your website. Thank again, you have breathed new life into two old robots, and I am very happy to have them "off the cloud".
Interessantes Video aber warum man nur ein Model hackt wo doch fast alle männlichen youtuber ganze saugroboter farmen haben würde mich sehr interessieren. Sieht für mich doch schwer nach einbruchsvorbereitung aus. Natürlich kann ich voll falsch liegen aber in Verbindung mit maps der saugroboter ist das ja wohl nicht ausgeschlossen. Vielleicht kommt ja mal ein Kommentar warum nur ecovacs staubsauger gehackt wurden sind und nicht allgemein gültig mehrere Modelle. Gut zu den hiesigen heutigen Begriffen des namens sichheitsforscher habe ich mal andere masstäbe gelernt. Aber past schon bei den einen können die Anforderungen nicht hoch genug sein bei anderen nicht tief genug. Zieht sich ja alles durch dieser Humbug. Denn nach Maßstäben die mir erklärt wurden sind, ist dieses Video kein hack mehr aber das entscheiden da eh alle anderen und ich bestimmt nicht.
wow, thanks for putting that out, I guess you informed ecovacs about the problem, and they did not fix it, obviusly, so maybe now its time for ecovacs to fix their sh*te, finally? 🙄
geiler scheiß, ich find deine Arbeit echt cool.👍
Danke :-)
Hi! Thank you so much for the video! Do you know if the procedure is the same with the new roborock q revo s version?
Привет. Успехов по Roborock s7 maxv нет? Мне удалось на плате Topaz SV-Mainboard-CE найти UART, я вижу консоль загрузки, отправляю символы они принимаются, но на команды консоль не реагирует. Скорее всего в Uboot заблокированная возможность приема команд. У меня есть полный дамп микросхемы памяти мне удалось разобрать его на разделы, возможно кто-то поделится идеями или ссылками как можно поправить раздел Uboot чтобы разблокировать консоль? Буду рад любой информации, или веткам связанным с иследованием s7 maxv. У меня есть несколько рабочих плат от этой модели и достаточно оборудования, для экспериментов. Я не нашел в разделах sshd в /usr/bin:/bin:/usr/sbin:/sbin, похоже он вырезан, только конфигурационный файл /etc/ssh/sshd_config был, возможно подсунуть в дамп свой бинарный файл SSH демона и залить прошивку на флеш с помощью программатора?
Привет, думаю тебе лучше на английском написать что бы было больше шансов получить ответ
Dear Sir, I have Deebot 950, the right side bruch is making noise when the robot is at the corner, otherwise it works best and there is no noise. I opened the robot, thanks to this video. When the gears are checked, they don't seem to have any issue. When I cleaned and regreased the gears, I can see the gears are slipping. I need a help to get the gears, is it possible?
If you don't have a USB to UART adapter but an Arduino with USB (the micro for example), you may use it as a USB to UART brisge with the SerialPassthrough example that comes with the arduino ide. Just successfully did so because I could not wait until tomorrow when my adapter is supposed to be delivered ;)
@dennisgiese5591 Hello Dennis, You obviously sounded very skillful and much more than me obviously although I myself is passionate about anything related to new technologies Today My concern is more down to earth than security concerns, and I believe you are the one who can help me out. Here is my question to you : I have bought The DREAMEX30 from Aliexpress And there are no ways for me to connect the Dreame application to control the Robot. Following the setup procedure it just keeps spinning when reaching the connection to my router phase. ☹ I just read that the robot is not working outside of China (I live in Paris in FRANCE) ☹ I heard you say that it is possible to hack the robot to make it work in Europe. Please Help me do that !! I would be so thankful if you can help. Right now I have a useless very expensive robot that can barely do 25% of what it is supposed to do :( I hope to hear back from you. You are my only hope.
palant
Great presentation! Do you know which CVE Id would be associated with the vulnerability you found in the UBoot? Thanks!
I do not apply for CVE's for bugs I find usually (tbh, I never even looked into how). Here, it is a tricky thing, as the same issue affects different implementations in different ways.
Forgive my ignorance here... but is it not a little bizarre that these manufacturers have decided to use ADB for USB management despite not running Android?
What the fuck this is scary as shit
Hello Dennis, you are very successful in robots, I want to improve myself in the robot vacuum cleaner business, would you like to help?
is there any way to upload a firmware of own choice to ikohs S15 cleaning robot ?
This seems like it may be a helpful resource in rooting my Lydsto R1. Somehiw got myself banned from the Valetudo Telegram channel for asking questions I think or maybe sounding like a noob. I am new to the whole RE thing since I only have my associates thought I would find some help there guess not. I'll just fork and do it all on my own till i can do a PR
Robot lawnmowers are the next hacking scene. There are expensive husqvarna/gardena robot mowers and others also. i got some cheap chinese Sunseeker robot mower that is being sold with many names in europe atleast. Cuts fine but im interested in hacking the firmware and freeing from the cloud.
Hello Dennis, and thank you for the effort you put into this project! It's really a bad feeling having a spy robot in my apartment!! Our old Neato-robot is working worse every day, so I have to decide what to buy next. On robotinfo you have Dreame Bot D10s Pro (dreame.vacuum.r2250) listed. It seems to be a solid device - everything looks good in terms of "rootability", but you added this comment: "Device currently (April 2023) part of the Adv. [...]. (ARTHRP) Part 1c." Contact us Contact us before purchasing if you plan to [...].” What does this mean for me? Should I just buy the robot and wait a little longer for a tutorial? Thank you very much! 🙂
oh - I found it by myself. Actually you've answered it already in your talk, how its done 😀
I am looking to replace a broken speaker on my s6pure Attack on Titan edition and I just want to know before I disassemble the device if the speaker connectors are soldered or if they attach to one of the physical connectors on the PCP. If the latter, I think I should be able to just buy a used s6 on eBay and take the parts I need.
All parts are having connects. Afaik, the speaker uses a red/black wired connector. Should be trivial to replace.
@@dennisgiese5591Thank you! By luck my speaker did not fully break from water exposure; letting the speaker dry out for 2 days was enough to restore loud volume function. Finding the part is sadly no cheap task because it's not available on AliExpress and Roborock customer support declined to sell it.
Thanks a lot for that instruction. But have you faced with situation when you cannot get in sunxiext loader ? I have Q7 max roborock, and i cannot get there, boot screen goes futher, no reaction on s or any other key. looks like they disable it
yeah, they patched that. We need to use a different method now. Check S7 rooting. That should still work.
why the feaking glitches in this vid. did defcon just loose all their marbles on tech ...
Its a dump from the Twitch stream. Apparently, there were some glitches. I gave more or less the same talk here: ua-cam.com/video/0bbKx8ujfwI/v-deo.html
"PromoSM" 😁
Dreame is a subsidy of Xiaomi,
Initially I thought it too, however, they are basically an OEM and partner of them (e.g. they use their ecosystem).
Thank you for helping me secure my vaccumm.
It just painful to watch with these glitches
agree. Watch this version instead: media.ccc.de/v/camp2023-57158-vacuum_robot_security_and_privacy (its the same presentation, except I was a bit sick and tired. But it contains all information)
100
The same talk was also given at CCCamp. It has fewer audio issues ua-cam.com/video/0bbKx8ujfwI/v-deo.html
that mic is very low par
Wie sieht es in der Hinsicht bspw. bei iRobot aus bezüglich root ? Hast du bei den neueren Geräten (die den PCB debug edge connector haben) in der Hinsicht mal was versucht, oder gibt es da rechtliche Probleme? Gruß
Probleme gibt es nicht wirklich, aber mag iRobot nicht so direkt :)
Dennis, thanks for the amazing work, you gave my EOL vacuum a new lease on life.
The obfuscation part really saddens me. I fully appreciate that security is requires layering, but this approach just looks like a giant waste of everybody's time to me. Just provide an easy, fully local, robust factory reset to avoid malicious uses and rootkits, and permit easy customization to tinkerers. I'll really never get the idea behind the current approach.
It would be really cool to see a FOSS robot vacuum made from a widely available SBC like a Raspberry Pi
The video is nearly unwatchable, lots of freezing.
hopefully DEFCON uploads the official version soon
This is an alternative version of the talk: media.ccc.de/v/camp2023-57158-vacuum_robot_security_and_privacy
@@dennisgiese5591 Thank you.
@dennisgiese5591 so these keep a map of your home etc and pass it on ?
@@QIKUGAMES-QIKU well, the devices need to have a map of your house. And obviously, they need to upload it to the cloud. You cant know what they do with the data that is on the server.
Let's go Dennis
It freezes from 21:45 to 22:01🙃🙃
Blame DEFCON :) The official recording should be hopefully fine.
@@fantielefant If they can't figure out tech then humanity is doomed!!
Talk starts @12:00
yep, I getting that cut right now, but youtube is slow.
Hello Dennis
Thank you!
S6 painted the floor with dog mess. Cleanup required a complete teardown. This video was key in reassembling it all. Big thanks!
Hello Dennis, very detailed video. I have a Roborock S6 MaxV which doesn't finish the factory reset process and power blinking keeps on going forever. Is there a way to fix this using your method? Also what is the micro USB port for?
Thanks! Very useful! With this video i can do the maintenance, thanks for share with us :)
I know this is a silly question, but my Samsung navibot runs Windows CE, do you think it’s possible to root?
Thanks for this detailed and great tutorial! I have unfortunately the problem that the password read via U-Boot and calculated via your Password Calculator does not work for me with the "root" user (Roborock S6). I have already read the string from the vinda file several times and checked the generated and inserted for spelling. Unfortunately always with the same result. 😞 Has anyone else had this problem?
I had exactly the same problem! I'm ashamed, but I gave up and bought a S6 Mainboard. Not cheap but cheaper than a new robot and it worked..
same here with S6-. @dennisgiese5591: any idea if that is related to a specific SW/HW version (3.5.8_2700)? I have got an "\" in that vinda-pwd. shouldn't be a problem, correct? Anything I could provide to solve that issue? --> Factory Reset did the trick, sorry. Was too stupid to follow the procedure correctly
Thx for this video. I also had to clean the filter next to the fan.
No audio
Hi Dennis, great tutorial. Rooting was sucessfull. But now the dustbilder firmware builder seems not work for me. No mail and I checked the spam many times. Thanks!
Was not patient enough, after 30 min it came...
Man i have Spotify on my xiaomi thx to u XD