Man took control of 7,000 vacuum cleaners in 24 countries after security flaw
A software engineer exploited a security flaw in a vacuum cleaner, gaining control over 7,000 devices worldwide.
A software engineer named Sammy Azdoufal, based in Barcelona, inadvertently discovered a security flaw while attempting to connect his robot vacuum cleaner through a gaming controller. This flaw allowed him unauthorized access to an astounding 7,000 DJI robot vacuum cleaners located in 24 different countries. Priced at $2,000 each, these devices posed significant privacy risks and vulnerabilities as Azdoufal was able to access live camera feeds, microphone audio, home mapping, and even location data from these vacuum cleaners.
Azdoufal promptly reported this major security issue to the company responsible for selling these vacuum cleaners. He highlighted that the breach stemmed from a flaw in the authentication token, which allowed him unrestricted access to sensitive information and functionalities of the devices. This incident reflects the ongoing challenges in cybersecurity, particularly in smart home devices, which are increasingly prevalent in modern households.
Following Azdoufal's disclosure, the company managed to rectify the vulnerability in early February, ensuring that no user intervention was required to resolve the issue. This situation emphasizes the importance of robust security measures in technology to protect user privacy and prevent unauthorized access to personal data, especially as more individuals utilize internet-connected devices in their daily lives.