Robot Vacuums Hacked to Direct Racial Slurs at Owners
Multiple smart robot vacuums in the United States were hacked and remotely controlled to emit racial slurs at their owners. The attacks exploited weak security features in Ecovacs and iRobot devices, including vulnerable PIN authentication and insecure Bluetooth connections.
What happened
Multiple robot vacuums in the United States were hacked by remote attackers who caused the devices to emit racial slurs at their owners. An individual named Daniel in Minnesota heard his Ecovacs vacuum yell a racial slur at him while he was standing in his living room.
Hackers exploited security vulnerabilities in smart vacuums, particularly Ecovacs models, including weak PIN-based authentication systems and insecure Bluetooth connections. The PIN access system relied on 'trust-based' authentication that could be bypassed, with validation occurring only through the app rather than server-side or device-side.
Reported impact
An attorney in Minnesota discovered his Ecovacs device, remotely controlled by an unknown person, was directing racial slurs at him in front of his son.
Similar incidents occurred in Los Angeles where a robot began chasing a dog, and in El Paso where another device insulted its owner in the middle of the night. A woman was photographed by her Roomba J7 while on a toilet, and that image was reportedly posted to Facebook.
Index analysis
Smart home devices with embedded cameras and microphones present multi-layered security risks beyond traditional cybersecurity concerns. The vulnerabilities affecting Ecovacs and iRobot devices demonstrate how weak authentication and encryption can be exploited to gain remote control over household devices.
Governance controls
The article references research showing that PIN-based access controls in robot vacuums lacked proper server-side or device-side verification, relying solely on app-level validation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.