The day my smart vacuum turned against me
97 comments
·October 7, 2025ianferrel
danpalmer
It sounds like the re-flashing was an important step in fixing it, and that just unblocking the IP would not have fixed it if the bricking command had been sent. After all, this was happening sufficiently early in startup that the device appeared to not turn on (rather than boot loop, or turn off after connecting).
ianferrel
That is a good point I hadn't considered.
I think, charitably, what might have happened here is:
1. Author left out the diagnostic step that restoring the connectivity didn't fix the robot, because it didn't work.
2. Author did the technical analysis mentioned (there is a repository attached. I haven't verified that it actually has the level of technical analysis indicated).
3. Author took some creative liberties (possibly involving some AI-assisted punching-up) when writing the blog post story to make it more compelling in a way that made it feel a bit off and left me and others questioning its veracity.
metalcrow
This also really looks like a chat GPT written article. Lot of keywords and specific phrases to that effect. It might be totally made up
pinkmuffinere
Just meaning this as feedback -- I hate these kinds of comments. Unless there is something concretely failing that you can point out, it's not very useful to say "it seems like chatgpt". I hate inaccurate articles as much as the next person, but "seems like chatgpt" is a criticism that can be lobbied at _every article_, and therefore loses value. For instance, I could very well claim that your comment looks like it's written by ChatGPT, and thus should be disregarded. And you could claim the same about this comment.
metalcrow
Fair, yeah. There's a few concrete points: the ai generated header image is a start, but "I had recently bought an iLife A11 smart vacuum—a sleek, affordable, and technologically advanced robot promising effortless cleaning and intelligent navigation." sounds like an advertisement or marketing fluff. Extremely frequent use of em-dashes. Frequent use of "It was X, but also Y" sentences. "In seconds, I had full root access. No hacks, no exploits. Just plug and play." is such hokey writing. That's just the first 3rd.
andy99
I agree with the grandparent comment and wanted to say something similar. I’m allergic to AI written drivel and at the first “it wasn’t just” I had to close the article.
Whether or not the author used AI to write it, it’s a valid criticism that it sounds like it, it makes people not want to read it and the author should consider a less offputting style if they want more engagement.
Edit to add, it’s worth flagging AI articles if you don’t want to see them, just commenting on it ends up making for a poor discussion - this thread is littered with talk about how it’s AI written. Better just to vote for it to flagged/dead.
thfuran
>I began to feel like I was losing my mind. How could a simple IP block disable a vacuum cleaner that is supposed to work offline as well?
It sure sounds like they were aware of the relation, just not how or why one thing led to the other.
BoredPositron
You are right the logical conclusion would be to send it for repair repeatedly.
akerl_
Yea, I feel like this is the kind of thing that makes manufacturers resistant to open/hackable devices.
I've done restrictive or invasive things to a variety of devices I own. But if something isn't working the way it should, "reset back to a clean default state and test again" always comes before trying to engage a warranty service process.
varenc
I had the same thought... and if an intentional manually sent kill command was sent to the vacuum to disable it, surely it'd be clear that blocking its access to the internet entirely, not just the logging servers, would prevent this? I don't know why you wouldn't force it to be fully offline in the first place. Possible that by default that also causes it to brick itself.
Also the very frequent use of `—` gives me ChatGPT vibes, but may just be for editing or a personal style. Still enjoyed reading it.
akerl_
Yea; it’s wild to me that they just kept sending the thing back for repairs.
Were they even able to see what was inside the traffic they blocked? Or are they just assuming it’s telemetry?
blutack
Luckily it's supported by Valetudo so it can go back to work.
https://valetudo.cloud/pages/general/supported-robots.html#i...
switz
I recently bought a robot vacuum, installed valetudo, installed tailscale onto the robot itself and now I can control it from anywhere through my personal mesh vpn.
It's pretty amazing. Valetudo is perhaps the most opinionated software I've ever used, which comes with the good and the bad. But overall, it works and it does what it says it will do.
I don't really need to access it remotely, though it has come in handy: when heading out of town I can turn off the scheduled cleans and just run it once on the day I'm returning home. Which is really the only functionality you would need the manufacturer-provided cloud connectivity for.
It's been fun explaining to people that it's "declouded", but I can access it from anywhere. Melts non-tech peoples' brains a little bit.
altairprime
I initially skipped this comment as sarcasm; it’s not! For other readers, the context: Valetudo is a custom firmware project.
> Cloud replacement for vacuum robots enabling local-only operation
LukeShu
To expand on laulis' comment: Valetudo isn't a full custom-firmware, it's a mod for the existing firmware. You copy on the Valetudo daemon binary, fuss with the init scripts to start the daemon, and fuss with the DNS and such to point some domains at 127.0.0.1 to talk to that daemon instead of the normal servers (well, actually you probably download a firmware image from dustbin that already has those modifications applied).
This is a distinction that is worth making because the robot is still running and relying on all of the on-robot proprietary code; it's just the in-cloud code that has been replaced.
ghostpepper
it's a bit of a blurry distinction because, what is firmware if not the software that runs on an embedded device? a more accurate description would be that the high-level operating system (HLOS) has been modified to include the installation of a drop-in-replacement for the cloud API. the client side, and whatever hardware abstraction layer lives below it, is untouched. so the client thinks it's talking to the server but it's actually talking to a local open-source server.
I think it's also not quite correct to say the low-level firmware is unmodified, because with vale tudo you rely on the project author to provide a minimal rootkit that gets customized on a per-serial-number basis for the initial rooting.
from a high-level though, it delivers what it says on the tin - cloud features without any requirement of packets leaving your network or even the robot itself.
here's a talk from the author discussing his research https://www.youtube.com/watch?v=AfMfYOUYZvc
null
taylodl
This reveals a whole new channel of modern warfare. Imagine a nation state getting control of an adversaries' smart devices? You don't need to destroy capital-intensive infrastructure such as an electric grid if you can disable their ability to store and cook their food (internet connected ovens and refrigerators). That's morbidly fascinating, though I now realize I'm potentially open to such an attack.
Terr_
[delayed]
wrs
Check out Mr. Robot S2E1, where someone is terrorized by their hacked smart house. Or 1977's Demon Seed, a film where an AI house does worse things. I really thought the latter would remain fictional, but I'm less sure now.
nonfamous
Cassandra, a short series on Netflix, follows similar themes and is quite good (as long as you speak German or don’t mind subtitles).
dylan604
Lots of movie plots with hacking critical infrastructure. Hackers controlled the ballast of a ship. Some other movie(s??) have taken over the flow of oil/gas at refineries. The entire US electrical grid is nothing but a soft target. A Ukranian style sneak drone attack on enough substations would knock the entire country into a blackout without ever touching the generation plants.
RajT88
Definitely stick with Mr. Robot.
Unless it's Saturday Night and you're drunk. Then go for Demon Seed.
reaperducer
Unless it's Saturday Night and you're drunk. Then go for Demon Seed.
Don't give Svengoolie any ideas!
mft_
It struck me recently how vulnerable we are to small disrutpive attacks of the sort you mention, and more. For example, several major European airports were closed recently due to unidentified drone activity around them. I don't know if the authorities have figured it out, but in theory someone could cripple air travel for the cost of a few anonymous drones.
no_no_no_no
[dead]
loloquwowndueo
Go for the phones. Watch “Leave the World Behind”.
SchemaLoad
Phones are extremely hard to hack and getting harder. The phone hacking companies only bother targeting an extremely limited set of people because once it becomes widespread, the whole exploit chain gets patched and you have to spend millions of dollars developing a new one.
With ARM Memory Tagging Extension becoming common on phones now it's getting borderline impossible to hack them.
loloquwowndueo
Thank god the movie is just a movie :)
mcv
This kind of intentional remote bricking should be super illegal. I would really like to see a law that would allow the customer a full refund of the original purchasing price if the manufacturer remotely disables advertised functionality of a device for whatever reason. Because this kind of deceptive behaviour needs to be slapped down hard.
floren
Oh, your XOURR smart vacuum got remotely disabled? Unfortunately the XOURR company has ceased operations so no refund is possible, but luckily there's a sale on IWEEET robot vacuums now, and I hear they're very reliable!
missingcolours
Most "smart" devices simply don't function without connectivity back to the manufacturer's cloud, and this is basically just the same thing with extra steps.
webstrand
It clearly doesn't need the cloud, it intentionally bricks itself if it can't exfiltrate it's logs. It's not like it's sending data necessary for its immediate operation.
thfuran
I think the extra step should be enough to technically constitute hacking and destruction of property.
ivanjermakov
Lucky you, my Roborock won't even load the map without mothership connection, not to mention full cleaning. Seems like all SLAM and pathfinding is done remotely, crazy.
crazygringo
This makes no sense.
He's insisting that they repeatedly remotely disabled his device in retaliation for blocking their data collection...
...yet they paid for the device to be shipped back and forth and inspected several times under warranty, presumably costing them $$$$?
It makes zero business sense to break your customer's products intentionally, which will lead to 1-star reviews and expensive support.
Plus, I hate to be the "this sounds like it was written by ChatGPT" guy, but this does. People don't write like this:
> Deep within the robot’s startup scripts, I discovered the smoking gun.
> It came back to life instantly. They hadn’t merely incorporated a remote control feature. They had used it to permanently disable my device.
> I may have lost my warranty, but I won back my autonomy.
Also, the idea that someone would waste months (?!) of their life until they "had a complete understanding of how the hardware was designed, down to each chip and wire connector" is just not real life. This is more like someone with a mental illness related to obsession.
I'm guessing this is 100% fiction from ChatGPT. Complete with the AI-generated image.
RHSeeger
I'm surprised they didn't push back when they said it was out of warranty. They send it in for repair, and it was never fixed. They can either continue the process of trying to repair it, or refund the original cost of the device.
Rooster61
My wife thought I was being crazy for not connecting our Roomba to wifi when we bought it. I feel quite vindicated.
conductr
I’ve been doing this a long while, but I’m finding it harder as more devices share my WiFi credentials with each other without my permission/consent/or even knowledge.
I recently moved into a new home and decided to take the opportunity to replace everything; it’s been surprising how many things are just coming to life. TVs, vacuums, kitchen appliances, etc. Some of my new TVs won’t even let me use the microphone on the remote until I give it my WiFi password. It’s quite ridiculous the world we’re creating for ourselves.
mcv
I'm amazed this is so common. I don't think any of my household appliances require wifi access. Our PC, laptops, phones, tablets and printer do, of course. I do occasionally check which devices are connected to my wifi, and try to keep track of what's what, but there are always a few mysterious devices I don't recognise, so I block those just to see what stops working.
cptskippy
> Some of my new TVs won’t even let me use the microphone on the remote until I give it my WiFi password.
What brand?
codetiger
Lesson learnt: Best thing to do for a smart device is not connect them to internet from day one. Though it beats the purpose to some extend, we don’t have an option of buying dump devices anymore.
theamk
Well, one of the big upside of the modern smart vacuums is you can see the map it built, set up rooms or zones, do a virtual cleaning, etc... This (1) definitely requires some connectivity, and (2) has to go via central server if the phone is not on same subnet.
Sadly, because of (2), most (all?) companies don't bother with local connectivity at all. Much easier to debug one codepath (via remote server) rather than two (remote server and direct connection).
So yeah, if you are worried about device being remote controlled by its manufacturer, don't buy devices which say "Can be remote controlled" right on the box. But of course then you are back to ancient tech, setting physical virtual wall devices or bounding the clean area with overturned chairs.
dylan604
what exactly is a virtual cleaning? i don't think it would be received well if I said I virtually cleaned something when asked
thfuran
>This (1) definitely requires some connectivity, and (2) has to go via central server if the phone is not on same subnet
Why couldn't that just be over Bluetooth?
heresie-dabord
> My wife thought I was being crazy
The real madness is to think that data harvesting is not happening.
jkestner
That was my one condition when an air fryer entered the house. No connecting it. When they’re putting WiFi on the cheapest models you know it’s a profit center in spite of you not paying for it.
Gabrys1
My guess would be that the manufacturer didn't remotely block the device, but rather the device itself did.
If last connection time < N days ago and last M tries connecting were unsuccessful, then: brick myself.
Still shitty, no doubt (and very similar to planned obsolescence), but the customer can un-brick by resetting to factory like they did in the service center.
ivanjermakov
What is the benefit to anyone of it bricking itself?
cptroot
Fun article, but the repeated use of what I'd call "AI punch-up language" is a little distracting.
stevage
The article is very vague on what actually caused the shutdown. Does he think a human triggered the kill command? Or the remote servers do this when they haven't heard from the device in a while? Or the device shuts itself down if it can't reach the servers?
plasticeagle
Most, if not all, of the article is written by AI.
3pt14159
I downvoted you for two reasons:
1. I didn't see any obvious AI ticks in the article.
2. If you want to claim that some slop is AI then please bring reasons. Even if they are the stuff of "there is too many em-dashes" then fine at least you brought something.
nemomarx
Top image is definitely AI, watermarked though so they're not hiding that.
I do see a lot of em dashes throughout the opening, but at least one of them seems proper. "Inside, the iLife A11 wasn’t just a vacuum cleaner; it was a small computer on wheels." is also kind of an AI tick phrasing. And there's pretty heavy use of bullet points for listing things beyond what I would normally expect from a tech blog.
(Also a lot of random lines are in block quotes for emphasis, but that could be a writing quirk. Kinda weird to read though)
If you go through there's at least enough of a smell I suspect someone had an AI polish or edit their actual blog post here?
mcv
The art is pretty obviously AI, though. But I didn't get that impression from the article.
mindcrash
Seemingly remote kill command, very likely punishment due to not receiving telemetry because that particular address was blocked through firewall:
"2024/02/29, 14:06:55.852622 [LogKimbo][CAppSystemState] Handle message! cmd_id 501 RS_CTRL_REMOTE_EVENT, len 8 serialno 0"
Note something being named RS_CTRL_REMOTE_EVENT
stevage
Yes, but automatic or manual? If automatic, what exactly was the trigger?
I'd have been tempted to explore this further - does sending fake or repeated telemetry satisfy it?
stronglikedan
OT, but anything automatic was manually and intentionally implemented at some point
IshKebab
Punishment due to not receiving telemetry? Please, that's fantasy land stuff.
It might be a malfunction caused by his blocking, but the idea that someone in HQ was like "guys, we've got someone blocking telemetry!" "disable his vacuum, the bastard".
Or in some design meeting they were like "what do we do if a handful of privacy nerds block our telemetry?" "well.. I guess we should automatically disable their vacuums in a weird way so they repeatedly send them in for repair and it costs us loads of money".
Come on, at least try to live in the real world.
fckgw
>"The manufacturer had the power to remotely disable devices and used it against me for blocking their data collection."
He posits that some low-level support person triggered a remote "kill switch" because he dared to block some telemetry servers which is, frankly, ridiculous.
thfuran
He didn't posit that it was a manual action, only that the kill command came over the network.
Bratmon
So what's your explanation?
fwip
A much simpler explanation is that the device disabled itself after being unable to contact the cloud servers for X time (probably a bug), rather than an employee sending a kill command over the now-disabled cloud connection.
The article is obviously AI-written, and also I very much doubt that these conclusions were reached without a sycophantic AI in their ear.
hypfer
> That was the moment my vacuum ceased functioning. The timestamp matched precisely with when it had stopped working, even though I hadn’t touched the app.
> 2024/02/29, 14:06:55.852622 [LogKimbo][CAppSystemState] Handle message! cmd_id 501 RS_CTRL_REMOTE_EVENT, len 8 serialno 0
> Someone—or something—had remotely issued a kill command.
Uuuuh are you sure that you're not reading a bit too much into the word "REMOTE" in that logline?
These are some very strong accusations and opinions that to me don't feel like they're being backed up with equally strong evidence. At least not evidence that is part of that post.
What even is a RS_CTRL_REMOTE_EVENT? Did you maybe check with e.g. Ghidra?
hypfer
Having thrown one version of everest-server of _a_ CRL-200S firmware (which might not be the one OP's firmware is running) into Ghidra and having found the string, this "REMOTE CONTROL" to me really does not look like it's executing remote commands.
I mean it does, but not like shell commands but probably IR remote? The CRL-200S can be controlled via an IR remote, so it is possible that it saw something. The sun, perhaps?
Feel free to prove me wrong on this of course.
The author of this article:
1. Has the technical skills to disassemble this device, trace circuit boards, design his own boards and custom software to interface with components to substantially reverse engineer this device.
2. Is totally mystified when his internet connected device stops working after he blocks its communication, and rather than try unblocking it and seeing if it works again, sends it out for repair repeatedly.
Something here doesn't add up. Tastes like bullshit to me.