Budget robot vacuum cleaners send detailed 3D maps of apartments and houses to China

A programmer discovered that his iLife A11 robot vacuum cleaner, priced at approximately $300, was regularly sending data about the owner’s home to its manufacturer in China, including a detailed 3D map of the rooms, without his consent.

Small World blogger Harishankar Narayanan said he had been using the device for about a year before deciding to examine its internal processes and network activity. He said his suspicions about security had previously prompted him to check other home gadgets, and he decided to apply the same approach this time.

Almost immediately after beginning network monitoring, he noticed constant data transfers to remote servers located in China, where the iLife A11 manufacturer is based. The programmer claims the robot vacuum cleaner was regularly sending logs and telemetry data, data he had never authorized to be collected. At that point, Narayanan attempted to stop the device from communicating with the servers.

After the data transfer was blocked, the robot vacuum cleaner continued to work for only a few days and then stopped completely. At the service center, the engineer was told the device was fine and returned to the owner. However, after several attempts, the problem recurred. The repair was later rejected because the warranty period had unexpectedly expired.

Thus, the $300 home assistant effectively became a useless object on the shelf.

Narayanan decided to conduct a full investigation of the device. He reverse-engineered it, including examining the board and testing the sensors. In the process, he discovered another issue, which the developer described as alarming. The Android Debug Bridge interface, which is used for installing and debugging software, was open to external connections without any restrictions.

According to the programmer, he was able to gain full root access to the system in a matter of seconds, without exploits or hacking attempts.

After connecting to the robot vacuum cleaner from a computer, it became clear that the device’s software was powered by Google Cartographer, an open-source solution that creates 3D maps of rooms and sends them to servers in China. He also discovered a line of code with a timestamp that matched the moment the device was turned off, leading him to suspect remote interference.

The robot’s owner is convinced that similar systems could be used in many other “smart” devices that continue to collect and send data without being noticed by users.