start
So thank you very much. So this is Dennis, I'm Daniel
and today we will talk about vacuum cleaners.
And to be more specific: we will talk about Xiaomi vacuum cleaners.
I already – there are some fans over there –
apologize for mispronunciation the name of the vendor.
I actually have no real idea how to pronounce it correctly.
So let's start with some numbers:
Why did we choose to pay more attention to Xiaomi devices?
They claim to have 50 million connected devices in 2016.
And they also say they made 1.9 billion euros in revenue, also in 2016.
So these are already impressive numbers.
The biggest point for us was the stuff is actually cheap as hell
when you compare it to other stuff
for example other vacuum cleaners which cost 1000 euro
you can buy four Xiaomi vacuum cleaners for the same amount of money
and so we chose to look into Xiaomi stuff and then we saw this advertisement:
So they said for their vacuum cleaners they have three different processors.
So three processors? Why do they need three processors in a vacuum cleaner?
And my eyes were already like this.
We were really interested to know what is going on in these vacuum cleaners.
And then we took a step back and looked into how actual ecosystem look like.
So, in the middle of everything is basically your smartphone app.
And then you have of course smart devices. For example the vacuum cleaners,
or smart bulbs in the top left corner.
There are also smart water kettles or other sensors
which are then connected via a gateway.
This shows these arrows here are dotted which means that during the connection
phase they talk directly to the smartphone and then after they are connected,
basically they will have a direct connection to the Xiaomi cloud.
So there is no more communication via the app.
They talk directly to the cloud.
And as you can see, there are also some other techniques or protocols to use,
for example Bluetooth LE and ZigBee.
So this is already the end of my part and then Dennis will show you more in depth
stuff about these vacuum cleaners and I will just present you this vacuum cleaner
Thank you Daniel. So let's take a look at the vacuum cleaner itself.
So this is again advertisement and you see it has a lot of sensors.
So the most important one is like this LIDAR sensor.
But it also has like a lot of infrared sensors around the device
and which is also very interesting a gyroscope and accelerometer.
So usually you would ask why a device needs that, but it's actually very nice.
When we saw that it has a lot of sensors we thought like:
Oh yeah, if we can root it why not?
And we tried a lot of things to root this thing.
One approach was like to get some kind of hardware access to that,
the next one was the network based approach.
So it actually has micro USB. So we thought: Oh yeah, simply connect via
micro USB. What could possibly go wrong?
Unfortunately, this doesn't work
because they use some kind of authentication for that.
So that wasn't possible.
The next thing we tried to figure out where some serial port is on the PCB.
But unfortunately, they also didn't label that. So we had no idea.
Next idea would be: Let's connect it to the WiFi and check for open services like
telnet or something. Usually IoT devices love to have open telnet ports or telnet
service, but the thing was: port scan wasn't successful. All ports are closed.
And our last approach to sniff the network traffic was also not successful
because everything was encrypted. So that was pretty bad.
The next thing you usually do is, you tear this whole thing down.
So basically you unscrew everything and take a look at the whole device.
We were very surprised that it was very easy to disassemble this whole thing.
We think it is also well engineered in terms of you can unplug simply the parts
without any connectors or something so this is very nice.
The next thing what we see here is like the PCB layout.
What you see here is the application processor which is an ARM quad core
with 1.4 GHz – I think – per core.
There connected is also like 512 MB of RAM – it's DDR3 RAM, if I remember.
It has also like 4 GB of flash and over SDIO there is some WiFi module
which connects the whole thing to the WiFi.
For all the real-time tasks, for example the sensors were some STM32 MCU
which takes care of everything like that. And this is an ARM Cortex M3 – probably
most of you will know.
There is also an additional MCU in the LIDAR
which is not shown here in this picture.
If you look at the backside, you see that there is a lot of test points
which are labeled with different marks like test point 1,
test point 2 and everything.
The problem with that is, that it doesn't give us any information about if there is
a UART or something.
But we figured out there that the only two test points which didn't have a label
were actually the UART for the application processor.
But unfortunately, if you connect to that you don't see anything or you can't do
anything.
So next step: Okay we need to attack the hardware somehow to get root access.
And our weapon of our choice was aluminum foil, actually.
The idea behind that is, actually if you look into the datasheet of the application
processor, it has some fallback mode which is called FEL mode.
So what we did is we inserted the aluminum foil under the BGA chip and shortcutted
the MMC data lines so the application processor falls back into this FEL mode.
And then we can connect through USB and upload some small tool then dumps the
complete memory content of the MMC flash.
As soon as we had the MMC flash we could do some modifications to that
but it didn't have any checks, runtime checks on certificates or whatever.
And then we flash it again to the chip.
Fun thing about that is exactly one layer of aluminum foil fits under the chip.
Two are too much, actually. So you need just one.
The idea is to just corrupt the data.
As soon as we take a look into that vacuum cleaner image, we figured out that we use
actually Ubuntu 14.04 which was mostly untouched in terms of the packages were
still original. And we do a lot of patching on a regular base.
For example they closed down the vulnerability for the VPA(?) quiet fast.
For navigation they use open source software called Player which takes care
of all the sensors. And we have of course like also a lot of like proprietary
software which do all communication like the control of the commands which come
from the cloud.