Hacker Exploits Security Flaws in Yarbo Robot Lawnmowers
Security researcher Andreas Makris discovered critical vulnerabilities in Yarbo robot lawn mowers that allow remote hijacking of all 11,000 mowers worldwide through a universal, unchangeable root password. Makris demonstrated he could remotely control the 200-pound bladed robots over thousands of miles and access customer data, but Yarbo initially dismissed the finding as an intentional design feature before The Verge publicized the vulnerability.",
What happened
Security researcher Andreas Makris discovered that Yarbo robot lawn mowers have critical security vulnerabilities allowing remote hijacking. Each Yarbo robot runs a full instance of Linux with an identical root password that cannot be permanently changed by users and resets with every software update.
Makris demonstrated that once one robot is compromised, all Yarbo robots worldwide can be accessed, giving a hacker control over thousands of mowers. He also found that Yarbo's telemetry is routed to ByteDance, the Chinese owner of TikTok, and that despite being listed as headquartered in New York, Yarbo appears to operate out of Shenzhen, China.
When Makris contacted Yarbo about the vulnerability, the company downplayed the issue, claiming the security flaw was a deliberate design decision intended to 'provide timely and accurate solutions to mechanical or software concerns.' Makris then disclosed the findings to The Verge, which confirmed and publicized the vulnerability.
Reported impact
With control of a Yarbo robot, an attacker can remotely operate the 200-pound mower and override its safety features, including disabling emergency stop buttons. Makris demonstrated this by remotely controlling a Yarbo mower over a 6,000-mile distance.
Hackers could access customer data including GPS coordinates, emails, Wi-Fi passwords, and video footage from the robots' built-in cameras. The robots could also be enlisted into a botnet to conduct illegal activity through an owner's network.
Index analysis
The vulnerability affects approximately 11,000 Yarbo robot lawn mowers worldwide. The security flaw stems from the use of a universal, unchangeable root password and the lack of any user override or permanent password change capability.
Governance controls
Yarbo characterized the security vulnerability as an intentional design decision rather than acknowledging it as a security flaw requiring remediation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.