Feed: Slashdot
Feed Link: https://slashdot.org/
---

Title: Manufacturer Bricks Smart Vacuum After Engineer Blocks It From
Collecting Data

Link: https://hardware.slashdot.org/story/25/11/06/...

A curious engineer discovered that his iLife A11 smart vacuum was remotely
"killed" after he blocked it from sending data to the manufacturer's servers.
By reverse-engineering it with custom hardware and Python scripts, he managed
to revive the device to run fully offline. Tom's Hardware reports: An
engineer got curious about how his iLife A11 smart vacuum worked and
monitored the network traffic coming from the device. That's when he noticed
it was constantly sending logs and telemetry data to the manufacturer --
something he hadn't consented to. The user, Harishankar, decided to block the
telemetry servers' IP addresses on his network, while keeping the firmware
and OTA servers open. While his smart gadget worked for a while, it just
refused to turn on soon after. After a lengthy investigation, he discovered
that a remote kill command had been issued to his device. He sent it to the
service center multiple times, wherein the technicians would turn it on and
see nothing wrong with the vacuum. When they returned it to him, it would
work for a few days and then fail to boot again. After several rounds of back-
and-forth, the service center probably got tired and just stopped accepting
it, saying it was out of warranty. Because of this, he decided to disassemble
the thing to determine what killed it and to see if he could get it working
again. [...] So, why did the A11 work at the service center but refuse to run
in his home? The technicians would reset the firmware on the smart vacuum,
thus removing the kill code, and then connect it to an open network, making
it run normally. But once it connected again to the network that had its
telemetry servers blocked, it was bricked remotely because it couldn't
communicate with the manufacturer's servers. Since he blocked the appliance's
data collection capabilities, its maker decided to just kill it altogether.
"Someone -- or something -- had remotely issued a kill command," says
Harishankar. "Whether it was intentional punishment or automated enforcement
of 'compliance,' the result was the same: a consumer device had turned on its
owner." In the end, the owner was able to run his vacuum fully locally
without manufacturer control after all the tweaks he made. This helped him
retake control of his data and make use of his $300 software-bricked smart
device on his own terms. As for the rest of us who don't have the technical
knowledge and time to follow his accomplishments, his advice is to "Never use
your primary WiFi network for IoT devices" and to "Treat them as strangers in
your home."

Read more of this story at Slashdot.

---
VRSS v2.1.180528