Amid concerns that robot vacuums can be hacked to spy on users’ homes, a South Korean authority said on Tuesday that three of the four Chinese models it surveyed were found to be vulnerable.
The Korea Consumer Agency inspected six robot vacuum models — four Chinese and two Korean products widely sold here — and discovered serious security flaws in three Chinese brands: Narwal, Ecovacs and Dreame. The vulnerabilities could expose users’ homes and personal information to outsiders.
The three brands are popular in Korea due to their lower prices compared to competitors.
Tests found that the Narwal Freo Z Ultra and Ecovacs Deebot X8 Pro Omni lacked proper authentication on their apps, allowing photos taken during cleaning to be accessed by third parties. With a user’s private code or ID, outsiders could enter the cloud system and view stored photos and videos without further verification.
The Dreame X50 Ultra carried an even greater risk, as hackers could remotely activate the vacuum’s camera. If shared permissions were enabled, others could bypass restrictions and watch real-time footage through the device.
The Ecovacs model also had a flaw that would allow outsiders connected to the cloud to plant malicious files directly into a user’s mobile photo album.
Privacy checks further revealed that Dreame’s product lacked sufficient safeguards for personal data, putting names, phone numbers and other details at risk of leakage.
The Korea Consumer Agency said all affected companies have since patched the issues. Meanwhile, models from Samsung Electronics and LG Electronics were rated as having stronger protections, including solid access controls, anti-tampering features and secure password systems, according to the agency.
ssh@heraldcorp.com
