Ecovacs Home Robots Vulnerable to Hacking, Enabling Neighbor Spying, Researchers Warn

Ecovacs Clean Sweep? But Hackers Have a Cleaner Plan!

Imagine your smart vacuum or robot lawnmower deciding to stay up all night, quietly spying on you through its camera and microphone. Sounds like a sci‑fi plot, right? Turns out the reality is less “Tony‑Stark’s Home System” and more “Who’s Got Your Wi‑Fi Password?”

Researchers Who Readied a Brawl

• Security gurus Dennis Giese and Braelynn Luedtke hit the neon lights at Def Con on Saturday.
• They unpacked Ecovacs’ supposedly “intelligent” robots and uncovered a buffet of security gaps.
• Key take‑away? Your robot can be hijacked via Bluetooth from up to 450 feet (roughly 130 meters).

Bluetooth: The “Space Invader” of Home Automation

With a phone app in hand, a hacker could:

• Take over the robot’s Linux OS.
• Read Wi‑Fi credentials and every map stored inside.
• Turn the device’s camera and mic on—all remotely.

A Sneaky Tap on the Internet

Once inside, the compromised machine can send a tiny payload—just one second long—back to a hacker’s server. From there, they gain full control: monitor rooms, see who’s at the door, and yes—see you cleaning your socks.

What’s the Company Saying?

Ecovacs, in a calm‑and‑collected statement, shrugged it off: “Users can breathe easy. No need to over‑think this.” That’s as reassuring as a fart in a hurricane.

Closing the Curtains Doesn’t Hide the Screams

Researchers still haven’t heard back from the maker and expect the fixes to remain off the shelf. Until then, your lawn mower might be the only thing on your porch that’s built to act as a private eye.

Zoom‑Vigilante: How Your Ecovacs Robot Turns into a DIY Spy

Picture this: a clever dog that somehow ends up looking surprised at a hacked gadget. That’s the headline hit by Dennis Giese and Braelynn Luedtke after they poked around Ecovacs robots—those smart lawn mowers and vacuums that claim to keep your house spotless.

Bluetooth: The Digital Unicorn

• Reclaiming the lawn mower: Mowers keep their Bluetooth radio on, 24/7. That’s a door opened wide for anyone with a smartphone or a rogue app.
• The “quiet” vacuum: These vacuums turn on their Bluetooth for just 20 minutes once the power button is pressed, and they do a quick reboot once a day—making it a bit tougher to sneak in.

The Cameras & Microphones: No “Show Your Face” Light

Most new Ecovacs gear carries at least one camera and a microphone. Once a hacker grasps control, the device can suddenly become a doorway into your home. And guess what? There isn’t a single LED or beep to warn you that your fridge‑facing robot is spying on you.

Wary But Still Slimy

Some models supposedly send a 5‑minute audio cue: “Your camera is active!” But that file can easily be wiped. Giese confirmed: “You can just overwrite that file with an empty one and silence the warning without touching the camera.”

More Than a Hack: Long‑Term Breach Stakes

• Cloud‑held data: Even after deleting your account, the robot’s data and authentication token stay on Ecovacs’ servers. A bad actor could revive an old vacuum and start snooping on second‑hand buyers.
• Plaintext PIN: Lawn mowers require a PIN to prevent theft, but that PIN is stuck in plain sight inside the device’s memory. Someone could pull it out and unlock the mower in no time.
• Chain‑reaction mode: Once one robot is compromised, it can hop on to any nearby Ecovacs machine and spread the malware.

The Test‑Tubes We Checked

• Deebot 900 Series
• Deebot N8/T8, N9/T9, N10/T10
• Deebot X1, T20, X2
• Goat G1
• Spybot Airbot Z1, Airbot AVA, Airbot ANDY

Official Response – August 14 Update

In a response at 1:22 p.m. ET, Ecovacs issued a statement acknowledging the findings and emphasizing their ongoing commitment to device security. They promised a software patch to address the Bluetooth vulnerability and updates to cloud data retention policies.

In a nutshell: Your smart-cleaning assistant may be a cleaner than you think, but it could also be a more‑than‑mini‑CCTV if you let a bad wolf slip past the locks. Stay alert, and keep your firmware up to date—otherwise, you’ll end up with a very “dog‑centric” new love interest.