Vulnerability in Shark Robot Vacuums Allows Hijacking Other Devices Across an Entire AWS Region

A security researcher publishing under the handle tokay0 has disclosed an attack method targeting Shark robot vacuums, model RV2320EDUS. The vulnerability allows an attacker who has extracted a certificate from one device's flash memory to gain root access to other Shark vacuums operating in the same AWS region.

According to the researcher's write-up, exploiting the vulnerability grants access to far more than the device's basic functions. An attacker can view the video feed from the vacuum's camera, remotely control its movement, obtain the map of the home built by the robot, and even extract the owner's Wi-Fi password — which is transmitted in unencrypted form.

The method was published on Monday. The researcher notes that they tested the attack only on their own devices, but the fundamental potential for it to spread to other vacuums of the same product line within a cloud infrastructure region raises serious concerns.

At the time of publication, the vulnerability remains unpatched by the manufacturer. The write-up gives no details on whether Shark was notified before publication or whether it plans to release a firmware update.

The case illustrates the characteristic risks of the architecture behind today's connected smart-home devices: a single authorization infrastructure spanning a cloud region can turn a local vulnerability into a problem affecting a broad swath of users all at once. For devices with cameras and the ability to map living spaces, such holes are especially sensitive from a privacy standpoint.

Owners of the affected Shark robot vacuum model should keep a close eye on official manufacturer announcements about security updates.

Source: The Hacker News