Who Else Is Cleaning Your Home?
Robot vacuum. Linux on wheels. Camera, mic, floor plan of your home, all riding around on WiFi. I opened one up, tapped the UART, dumped the firmware, and followed it to the cloud. Came out with root on any of these things in the fleet from any account. Vendor knows. This is the hack.
Step one, buy a robot vacuum. Step two, take the shell off. Step three, find the UART pads and start listening.
That's how it started. A few months later I had a chain of six bugs that lets any authenticated user on the vendor's cloud push a shell command to any of their robots on earth. The on-device handler runs whatever comes down. As root. No signature check. No allowlist. Just runs.
The interesting piece isn't on the device though. It's the MQTT broker in the middle. The broker takes my "I am device X" claim at face value and delivers a shell payload to device Y. Which is your robot. In your living room.
Walkthrough covers:
- opening the thing, soldering to UART, dumping the boot log
- finding the cloud credentials in the firmware
- MITMing the MQTT traffic to map the topic tree
- the moment I fired a shell command from my account at a robot owned by someone else and it just ran
- the recon that turns "any random robot" into "your robot"
- the actual PoC, and where the vendor's fix landed
Six CVEs filed with MITRE. Vendor signed Safe Harbor. Full disclosure clears before the conference.
Come if you own one of these. Come if you write firmware. Come if you like watching a $500 gadget give up everything it knows about the person who lives with it.
Amir is an offensive security consultant based in Toronto. He spends most weeks either breaking a client's stack or finding new ways to break IoT hardware on his own time. This talk is the second kind.
Outside the day job he co-organizes DefCon Toronto (DC416) and sits on the organizing committee for TASK. Both keep him plugged into the local Toronto security community year round.
He speaks at conferences when he has something worth saying. This is one of those times.