Security Flaws in Yarbo Robot Mowers Raise Home Network Concerns

Robot lawn mowers promise to simplify yard work, but a new security report reveals potential privacy issues. Researcher Andreas Makris has identified serious vulnerabilities in Yarbo’s autonomous mowers and snow blowers. These flaws could expose users to remote access, live camera viewing, and Wi-Fi credential theft, affecting approximately 6,000 robots.

Following the report, Yarbo acknowledged these findings and began implementing security fixes. Questions arise about the level of access such smart devices should have within home networks.

For practical tips on securing tech devices, visit CyberGuy.com.

Yarbo Robot Security Risks

Makris highlights a persistent remote access setup in Yarbo robots, allowing internet-based access to them. This includes a shared hardcoded root password across devices and a serial number-based remote connection method. Such ‘root’ access means control at an administrator level.

The report shows the remote connection runs automatically, restarting if needed, with no simple app switch for user control. This raises concerns as these robots constantly connect to home Wi-Fi networks.

Network Security Concerns

Most smart devices require internet access for operation. Makris points out that Yarbo’s remote access setup presents increased risks. Attackers with specific information could exploit this access, compromising the owner’s network.

Although these machines cut grass efficiently, they pose potential privacy threats due to their internet connectivity and camera features.

Camera and Wi-Fi Credential Risks

Makris warns that anyone gaining root access to Yarbo robots could possibly view its camera feeds. This could expose views of key outdoor areas where families spend time.

Additionally, an attacker could access saved Wi-Fi credentials from the robot’s system, potentially compromising wider network security. This vulnerability highlights the importance of evaluating the privacy implications of outdoor smart devices.

Yarbo’s Response

Post-report, Yarbo responded by identifying vulnerabilities in remote diagnostic and data management systems. It acknowledged past design choices as the main security issue and is updating its policies to fix these.

Implemented Security Fixes

Yarbo states several remedial steps have been taken. The company has eliminated legacy root credentials and revoked shared remote access credentials. They have also removed outdated scripts and non-essential network features.

Work continues on improving their credential management system, moving to unique credentials for each device supporting independent rotation and revocation.

Data Transmission Concerns

The report also references data sent to Yarbo’s parent company and links with ByteDance Feishu and other Chinese services. Yarbo plans to phase out old servers and access channels.

Recommendations for Yarbo Owners

For Yarbo robot owners, treat the devices as you would any other connected gadget. Ensure they receive security updates by connecting them to the internet as needed, then place them on a guest or isolated network.

Follow practical steps like using a guest network, changing Wi-Fi passwords, checking device lists on your router, and keeping devices updated.

Conclusion

Yarbo’s situation showcases the potential hidden risks of smart yard tools. Control and transparency are crucial. Gather clear information from manufacturers about device connectivity before purchasing.