34C3 - Unleash your smart-home devices: Vacuum Cleaning Robot Hacking

start

So thank you very much. So this is Dennis,
I'm Daniel

and today we will talk about
vacuum cleaners.

And to be more specific:
we will talk about Xiaomi vacuum cleaners.

I already
– there are some fans over there –

apologize for mispronunciation the name
of the vendor.

I actually have no real idea
how to pronounce it correctly.

So let's start with some numbers:

Why did we choose to pay more attention
to Xiaomi devices?

They claim to have 50 million connected
devices in 2016.

And they also say they made 1.9 billion
euros in revenue, also in 2016.

So these are already impressive numbers.

The biggest point for us was the stuff is
actually cheap as hell

when you compare it to other stuff

for example other vacuum cleaners
which cost 1000 euro

you can buy four Xiaomi vacuum cleaners
for the same amount of money

and so we chose to look into Xiaomi stuff
and then we saw this advertisement:

So they said for their vacuum cleaners
they have three different processors.

So three processors? Why do they need
three processors in a vacuum cleaner?

And my eyes were already like this.

We were really interested to know what is
going on in these vacuum cleaners.

And then we took a step back and looked
into how actual ecosystem look like.

So, in the middle of everything is
basically your smartphone app.

And then you have of course smart devices.
For example the vacuum cleaners,

or smart bulbs in the top left corner.

There are also smart water kettles or
other sensors

which are then connected via a gateway.

This shows these arrows here are dotted
which means that during the connection

phase they talk directly to the smartphone
and then after they are connected,

basically they will have a direct
connection to the Xiaomi cloud.

So there is no more communication via the
app.

They talk directly to the cloud.

And as you can see, there are also some
other techniques or protocols to use,

for example Bluetooth LE and ZigBee.

So this is already the end of my part and
then Dennis will show you more in depth

stuff about these vacuum cleaners and I
will just present you this vacuum cleaner

Thank you Daniel. So let's take a look at
the vacuum cleaner itself.

So this is again advertisement and you see
it has a lot of sensors.

So the most important one is like this
LIDAR sensor.

But it also has like a lot of infrared
sensors around the device

and which is also very interesting a
gyroscope and accelerometer.

So usually you would ask why a device
needs that, but it's actually very nice.

When we saw that it has a lot of sensors
we thought like:

Oh yeah, if we can root it why not?

And we tried a lot of things to root
this thing.

One approach was like to get some kind of
hardware access to that,

the next one was the network based
approach.

So it actually has micro USB. So we
thought: Oh yeah, simply connect via

micro USB. What could possibly go wrong?

Unfortunately, this doesn't work

because they use some kind of
authentication for that.

So that wasn't possible.

The next thing we tried to figure out
where some serial port is on the PCB.

But unfortunately, they also didn't label
that. So we had no idea.

Next idea would be: Let's connect it to
the WiFi and check for open services like

telnet or something. Usually IoT devices
love to have open telnet ports or telnet

service, but the thing was: port scan
wasn't successful. All ports are closed.

And our last approach to sniff the
network traffic was also not successful

because everything was encrypted. So that
was pretty bad.

The next thing you usually do is, you tear
this whole thing down.

So basically you unscrew everything and
take a look at the whole device.

We were very surprised that it was very
easy to disassemble this whole thing.

We think it is also well engineered in
terms of you can unplug simply the parts

without any connectors or something so
this is very nice.

The next thing what we see here is like
the PCB layout.

What you see here is the application
processor which is an ARM quad core

with 1.4 GHz – I think – per core.

There connected is also like 512 MB of RAM
– it's DDR3 RAM, if I remember.

It has also like 4 GB of flash and over
SDIO there is some WiFi module

which connects the whole thing
to the WiFi.

For all the real-time tasks, for example
the sensors were some STM32 MCU

which takes care of everything like that.
And this is an ARM Cortex M3 – probably

most of you will know.

There is also an additional MCU in the
LIDAR

which is not shown here in this picture.

If you look at the backside, you see that
there is a lot of test points

which are labeled with different marks
like test point 1,

test point 2 and everything.

The problem with that is, that it doesn't
give us any information about if there is

a UART or something.

But we figured out there that the only two
test points which didn't have a label

were actually the UART for the application
processor.

But unfortunately, if you connect to that
you don't see anything or you can't do

anything.

So next step: Okay we need to attack the
hardware somehow to get root access.

And our weapon of our choice was aluminum
foil, actually.

The idea behind that is, actually if you
look into the datasheet of the application

processor, it has some fallback mode which
is called FEL mode.

So what we did is we inserted the aluminum
foil under the BGA chip and shortcutted

the MMC data lines so the application
processor falls back into this FEL mode.

And then we can connect through USB and
upload some small tool then dumps the

complete memory content of the MMC flash.

As soon as we had the MMC flash we could
do some modifications to that

but it didn't have any checks, runtime
checks on certificates or whatever.

And then we flash it again to the chip.

Fun thing about that is exactly one layer
of aluminum foil fits under the chip.

Two are too much, actually. So you need
just one.

The idea is to just corrupt the data.

As soon as we take a look into that vacuum
cleaner image, we figured out that we use

actually Ubuntu 14.04 which was mostly
untouched in terms of the packages were

still original. And we do a lot of
patching on a regular base.

For example they closed down the
vulnerability for the VPA(?) quiet fast.

For navigation they use open source
software called Player which takes care

of all the sensors. And we have of course
like also a lot of like proprietary

software which do all communication like
the control of the commands which come

from the cloud.