125

An engineer got curious about how his iLife A11 smart vacuum worked and monitored the network traffic coming from the device. That’s when he noticed it was constantly sending logs and telemetry data to the manufacturer — something he hadn't consented to. The user, Harishankar, decided to block the telemetry servers' IP addresses on his network, while keeping the firmware and OTA servers open. While his smart gadget worked for a while, it just refused to turn on soon after. After a lengthy investigation, he discovered that a remote kill command had been issued to his device.

top 50 comments
sorted by: hot top controversial new old
[-] GreenShimada@lemmy.world 59 points 1 week ago

The fact that this isn't considered outright fraud is disturbing. This person OWNS the device, yes? They're not leasing it.

FFS, this should be illegal.

[-] Vorticity@lemmy.world 16 points 1 week ago

I agree with you that this should be illegal. I expect this was in the terms of service, though. Since we have no laws restricting this kind of bullshit, the company can argue that they're within their rights.

We need some real legislation around privacy. It's never going to happen, but it needs to. We need a right to anonymity but that is too scary for advertisers and our police state.

[-] FartMaster69@lemmy.dbzer0.com 24 points 1 week ago

Terms of service need to stop being treated like law.

[-] MalReynolds@slrpnk.net 16 points 1 week ago

They're not law as long as you can afford the lawyers and legal costs to fight them. Which is, of course, the problem and the system working as designed.

load more comments (2 replies)
[-] Pyr_Pressure@lemmy.ca 8 points 1 week ago

How often are the terms of service evident at the time of purchase? It's unreasonable to assume at the checkout that the price is only for a limited time of use. I doubt the put it on the box or on the Amazon page when you purchased stuff like this. Are you supposed to buy it and then return it after reading the fine print in the instruction booklet after opening it up?

[-] GreenShimada@lemmy.world 3 points 1 week ago

I expect this was in the terms of service, though

While I expect the same, there's also just a reasonablility standard. If Meta and Google updated their TOS to say that users agreed to become human chattle slaves to mine cobalt and forfeit their rights, no court (...right, SCOTUS?...right?) would uphold that. A TOS is a contract, but it's mostly for the protection of companies from liability. Takign active steps to brick someone's device over the device not connecting to it's C2 server (the company had zero evidence this was done intentionally and a router firewall misconfiguration could just have easily done the same thing), is IMO something that should result in a lawsuit.

[-] Vorticity@lemmy.world 2 points 1 week ago

I agree with you. The problem is that lawsuits cost money. Fighting the company on this requires the right plaintiff who is willing to risk money on the problem.

load more comments (4 replies)
[-] Zier@fedia.io 11 points 1 week ago

There needs to be a huge neon orange warning on the Front of these products that explains, clearly, that you don't own it, your privacy will be invaded and the company can disable it at anytime. This will stop people from buying this garbage, and hopefully companies will stop if they want our money.

My life rule is, if it says Smart on it, it's never going to be smart. It will always cause trouble.

[-] GreenShimada@lemmy.world 4 points 1 week ago

IMO "Smart" refers to the lawyers that got paid to write a 900-page TOS that lets a company do whatever they want.

load more comments (3 replies)
load more comments (2 replies)
[-] Goldholz@lemmy.blahaj.zone 14 points 1 week ago

Say it with me. If buying doesnt mean 100% ownership...

load more comments (2 replies)
[-] CptOblivius@lemmy.world 11 points 1 week ago

How is this legal?

[-] SocialMediaRefugee@lemmy.world 10 points 1 week ago

If I don't own it 100% then reimburse me if you disable it.

[-] mal3oon@lemmy.world 10 points 1 week ago

For me the worst part is that someone developed the functionality to monitor and track, until the signal is lost, and if so, kill. It's really crazy how daring this is.

[-] percent@infosec.pub 8 points 1 week ago

I wish companies would at least offer a "no data collecting/selling" price option. Like, how much would they make from selling my data? Just give me the option to pay that extra amount so I can buy a vacuum without thinking about how it's spying on me.

load more comments (3 replies)
[-] Hadriscus@jlai.lu 7 points 1 week ago

Same story with this guy (in french)

https://www.youtube.com/watch?v=OGMRUiBOFj0

Highly recommend watching his stuff, might be very technical but also super methodical

[-] j4k3@piefed.world 6 points 1 week ago

Stalkerware is criminal digital slavery. It is sale and ownership of a part of a person to manipulate and exploit them.

[-] BennyTheExplorer@lemmy.world 3 points 1 week ago

I think your comparison to slavery is a bit overblown and minimizes the tragedy of actual slavery. But I agree with the sentiment.

[-] FlyingCircus@lemmy.world 2 points 1 week ago

But someone making money off of me without my consent is literally slavery. No one is saying that this form of slavery is equivalent to chattel slavery, so I don’t understand how this minimizes that? Do you also think that wage slavery or forced prison labor are not slavery?

load more comments (3 replies)
[-] spaghettiwestern@sh.itjust.works 5 points 1 week ago* (last edited 1 week ago)

My robot vac will only operate when connected to the Internet so it's only allowed to communicate when actually in use. As soon as it returns to the charger Internet access is automatically blocked.

Unfortunately the manufacturer has deliberately made this as inconvenient as possible. If communication is blocked for more than a few hours the vacuum loses all maps and will no longer even load saved maps from the Tuya app. To use it the vac must be powered down and the app killed. Only then can a saved map be restored.

It's too bad it's so useful.

[-] kent_eh@lemmy.ca 4 points 1 week ago

My robot vac will only operate when connected to the Internet

That would trigger me to return it to the store. "It doesn't work"

[-] ExLisper@lemmy.curiana.net 2 points 1 week ago

it’s only allowed to communicate when actually in use.

What's the point? The manufacturer is interested in the map of your apartment and usage statistics. What do you think it's sending when not in use? Does it have a microphone or something?

[-] spaghettiwestern@sh.itjust.works 3 points 1 week ago* (last edited 1 week ago)

Since I haven't pulled it apart or tried to decrypt the ssl traffic I have no idea whether it has "a microphone or something." That's the point.

load more comments (3 replies)
load more comments (3 replies)
[-] brsrklf@jlai.lu 4 points 1 week ago

There's something not working in this article.

They say it "makes sense" for the device to basically send the plan of your home to some online server, because the vacuum is not powerful enough to process this data on its own. This is already a bit horrifying to me, but okay.

And then when that guy blocked it out, the vacuum "worked for a while" before something sent the kill command through an update.

How come is it still working at all if navigation requires that server?

[-] fonix232@fedia.io 6 points 1 week ago

It's not the navigation that requires the server but the processing of the mapping data.

Which in itself is BS because most of these vacuums come with hardware roughly equivalent of a top of the line smartphone from about 5-6 years ago. They can easily do the raw data to map conversion, even if it's a bit slow and takes 20-30 seconds.

Also if you read the article it specifies that the damn thing is already running Google Cartographer which is a SLAM 3D map builder software - one of the better pro-grade mapping software suites, mind you. So the whole claim of cloud needed for processing is BS.

[-] brsrklf@jlai.lu 4 points 1 week ago

My VR headset can create pretty accurate 3D maps of my environment like nothing, and it only uses cameras to do so, so I can imagine it's doable.

Then, yeah, it doesn't "make sense" for that thing to externalize that.

load more comments (1 replies)
[-] LH0ezVT@sh.itjust.works 5 points 1 week ago

It is total BS. Offline vacuum cleaners do mapping and localisation just fine. It is just an excuse to spy on your home.

load more comments (2 replies)
[-] Microtonal_Banana@lemmy.zip 3 points 1 week ago

Louis Rossman should do a segment on them.

[-] FosterMolasses@leminal.space 3 points 1 week ago

Jesus christ, just vaccuum your own house already. This is the largest tradeoff I have ever seen for the minor inconvenience of a single household chore.

[-] aceshigh@lemmy.world 2 points 1 week ago

As a layman, can someone explain what the ramifications of smart devices sharing your data is. I know it’s bad, but I don’t understand why it’s bad and how it’s used against you.

[-] badgermurphy@lemmy.world 15 points 1 week ago* (last edited 1 week ago)

The problem that is created by a person's private data being collected against their will is primarily a philosophical one similar to the "principle of least privilege", which you may be familiar with. The idea is that those collecting the data have no reasonable need for access to it in order to provide the services they're providing, so their collection of that information can only be for something other than the user's benefit, but the user gets nothing in exchange for it. The user is paying for the product/service they get, so the personal data is just a bonus freebie that the vendor is making off with. If the personal data is worthless, then there is no need to collect it, and if it does have worth, they are taking something of value without paying for it, which one might call stealing, or at least piracy. To many, this is already enough to cry foul, but we haven't even gotten into the content and use of the collected data yet.

There is a vibrant marketplace among those in the advertising business for this personal data. There are brokers and aggregators of this data with the goal of correlating every data point they have gotten from every device and app they can find with a specific person. Even if no one individual detail or set of details presents a risk or identifies who the specific person is, they use computer algorithms to analyze all the data, narrowing it down to exactly one individual, similar to the way the game "20 questions" works to guess what object the player is thinking of--they can pick literally any object or concept in the whole world, and in 20 questions or less, the other player can often guess it. If you imagine the advertisers doing this, imagine how successful they would be at guessing who a person is if they can ask unlimited questions forever until there can be no doubt; that is exactly what the algorithm reading the collected data can do.

There was an infamous example of Target (the retailer) determining a young girl was pregnant before she told anyone or even knew herself, and created a disastrous home situation for her by sending her targeted maternity marketing materials to her house, which was seen by her abusive family.

These companies build what many find to be disturbingly invasive dossiers on individuals, including their private health information, intimacy preferences, and private personal habits, among other things. The EFF did a write-up many years ago with creepy examples of basic metadata collection that I found helpful to my understanding of the problem here:

https://www.eff.org/deeplinks/2013/06/why-metadata-matters?rss=1

Companies have little to no obligation to treat you fairly or even do business with, allowing them to potentially create a downright exile situation for you if they have decided you belong on some "naughty list" because of an indicator given to them by an algorithm that analyzed your info. They can also take advantage of widely known weaknesses in human psychology to influence you in ways that you don't even realize, but are undeniably unethical and coercive. Also, it creates loopholes for bad actors in government to exploit. For example, in my country (USA), the police are forbidden from investigating me if I am not suspected of a crime, but they can pay a data broker $30 for a breakdown of everything I like, everything I do, and everywhere I've been. If it was sound government policy to allow arbitrary investigation of anyone regardless of suspicion, then ask yourself why every non-authoritarian government forbids it.

I know that's a lot; it is a complicated topic that is hard to understand the implications of. Unfortunately, everyone that could most effectively work to educate everyone on those risks is instead exploiting their ignorance for a wide variety of purposes. Some of those purposes are innocuous, but others are ethically dubious, and many more are just objectively nefarious. To be clear, the reason for the laws against blanket investigations was to prevent the dubious and nefarious uses, because once that data is collected, it isn't feasible to ensure it will stay in the right hands. The determination was that potential net good of this kind of data collection is far outweighed by the potential net negatives.

I hope that helps!

load more comments (2 replies)
[-] Sir_Premiumhengst@lemmy.world 6 points 1 week ago

A detailed room-mapping scan is basically a wealth report disguised as vacuum telemetry: square footage, room count, layout complexity, “bonus” spaces like offices or nurserie; all of it feeds straight into socioeconomic profiling. And once companies have that floor plan, they’re not just storing it; they’re monetizing it, feeding it into ad networks, data brokers, and pricing algorithms that adjust what you see (=and what you pay) based on the shape of your living space.

And a mapped floor plan also quietly exposes who lives in the home, how they move, and what can be inferred from that.

load more comments (8 replies)
[-] underisk@lemmy.ml 5 points 1 week ago

Email me the blueprints to your house, your address, name, and your favorite hobbies and I will tell you the answer.

[-] HeyThisIsntTheYMCA@lemmy.world 2 points 1 week ago

The answer to all your questions is "fried green tomatoes"

load more comments (4 replies)
[-] rowinxavier@lemmy.world 2 points 1 week ago

I have just purchased a Dreame L10s Ultra and have had the PCB for a breakout board made and components for setting it up ordered. In a few days I should get the last bits and I will be able to root the device and have it connect to Valetudo managed through Home Assistant. Fully local operation with basically the same features but none of the privacy issues. As soon as I can get it connected I will be able to use it just like a robot I actually own should without some random third party being involved in every single operation.

load more comments (2 replies)
[-] elvith@feddit.org 2 points 1 week ago

Having not read the article: “Let’s apply Hanlon’s Razor: Oh, probably it just collects the data locally and caches it until the vendor’s servers are reachable. After a while the data partition was full and it stopped working as this case was never deemed possible when this was developed.”

Having read that the kill command was logged and he found it in the logs: “ok, there are no technical details, so there might still be a misunderstanding, but that’s not what I expected!”

[-] Randomgal@lemmy.ca 2 points 1 week ago

Why talk if you don't know what you're talking about? If you didn't read the article whatever you say is irrelevant.

load more comments (2 replies)
load more comments
view more: next ›
this post was submitted on 05 Dec 2025
125 points (97.0% liked)

Technology

77648 readers
565 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS