A robot mower is often seen as a tool designed to make life easier. However, a recent security report reveals possible hidden risks. According to security researcher Andreas Makris, Yarbo robots, which include lawn mowers and snow blowers, exhibit significant security flaws. These vulnerabilities may expose owners to remote access, live camera viewing, and Wi-Fi credential theft. Around 6,000 robots are currently vulnerable.
Yarbo has acknowledged the accuracy of the core technical findings in the report and is working on rolling out security fixes. These developments prompt questions on how much access smart yard devices should have to home networks.
Security Fears with Smart Yard Devices
Yarbo robots come with a persistent remote access setup. This utilizes a tunnel to connect the robot over the internet. The report states that robots have a hardcoded root password and a remote connection linked to the robot’s serial number. ‘Root’ access allows deep control over the device, resembling administrator-level access.
The remote tunnel runs automatically and can restart if stopped. This could be alarming as users may lack a simple switch to deactivate it.
Home Network Risks
Internet access is crucial for smart devices’ functionality. Makris argues that Yarbo’s configuration poses increased risks. He claims that remote access is built-in and not solely activated upon owner request. Attackers with proper knowledge could reach the robot, access internal functions, and use it as a springboard into the home network.
Though it may appear harmless, a robot mower connected to Wi-Fi with cameras raises security concerns. These devices are often close to homes, accessible, and regularly undertake tasks like mowing lawns or clearing snow.
Camera Access Concerns
The report suggests Yarbo robots can have several camera feeds. By obtaining root access through the tunnel, someone could view surroundings remotely. This could expose areas like driveways and backyards.
Exposure of Wi-Fi Credentials
Attackers with root access might retrieve saved Wi-Fi credentials from the robot. This endangers the security of a home’s main Wi-Fi network, used by various devices such as phones, laptops, and security devices.
Yarbo’s Response and Remedies
Following the report, Yarbo has admitted the existence of serious issues in its systems. The company has retired shared credentials, deactivated certain server-side connection paths, and made updates to its mobile app.
Despite these efforts, Yarbo acknowledges that further work is needed. The focus is on revamping the credential management system, transitioning to a model with unique per-device credentials.
Data Privacy Concerns
The report mentions connections to Yarbo’s parent company, Hanyangtech, and other technology platforms. Concerns arise over where telemetry data is sent and which companies access it.
Yarbo commits to addressing these concerns by phasing out legacy servers and enhancing transparency regarding data handling.
Suggestions for Yarbo Owners
- Place the robot on a guest network instead of the main Wi-Fi.
- If worried about exposure, change the Wi-Fi password to a strong, unique one.
- Review connected devices on your router and remove unfamiliar ones.
- Limit the robot’s reach by isolating guest devices, if possible.
- Request Yarbo for further information on remote access and diagnostic controls.
- Keep the robot updated via a guest network for security enhancements.
Conclusion
The report on Yarbo robots highlights the potential risks of combining convenience with connectivity. Owners should be aware of device accessibility and take measures to safeguard their networks. When considering smart yard tools, scrutinize their security features before other aspects.
Leave a Reply