The EU Commission is currently discussing whether Amazon can take over the vacuum cleaner robot manufacturer iRobot. In November 2023, the Brussels authorities published a series of objections because they saw the purchase as a threat to competition. The deadline in which Amazon could have responded to the comments has now passed. As the Wall Street Journal reports, representatives of the company met with representatives of the EU Commission yesterday, January 18th. Amazon was informed that the Commission would probably not approve the takeover. However, the formal consent of 27 heads of government is still missing for an official blockade.
Advertisement
Although data protection does not play a role in the publication of the EU’s objections, it is still an important point. Especially since iRobot has had unpleasant leaks of intimate photos taken with the Roomba vacuum cleaner robot in the past. The Roomba is just one example of a household robot that is equipped with a camera. This also applies to other devices that can be used at home. But the more these devices are equipped with sensors, the more sensitive data is generated that needs to be well protected.
For security researchers, a vacuum robot is a mobile sensor platform that is connected to a server on the Internet and sends it a lot of data: floor plans of apartments, for example, camera images or point clouds from which objects in the apartment can be reconstructed. In other words: a very interesting target.
Spies in the smart home
Researchers have shown time and again in recent years that this danger is not hypothetical: They cracked the software of various vacuum cleaner robots so that the devices could be operated from the outside at any time. They made vacuum cleaners play music from Spotify or downloaded apartment floor plans and camera images. In 2021, a team of researchers from Singapore was even able to show that a built-in lidar scanner can also be used as a listening microphone.
Have we, in a naive enthusiasm for technology, plastered our homes with spy tools? The answer is complicated, experts say — but not necessarily reassuring.
“Smart” household appliances are intended to fulfill an old promise of progress: to react to the user’s wishes without the user having to express them explicitly or in detail – electronic brownies, so to speak. However, they are house spirits who know a lot about us. And while heating and ventilation controls, voice assistants and intelligent displays usually stay in place, intelligent vacuum cleaners drive around independently to collect data and send it to the cloud.
This interaction of mobility, sensors, cloud and servers makes the devices attractive targets for attack. The machines are designed to respond to external commands. An attacker who tricks the software into believing that it is running a legitimate server can control the machine or access data. Another common attack strategy is to replace the robot’s firmware with your own software, which of course only communicates with your own web server. However, this requires physical access to the device.
To home page