Spying with Your Robot Vacuum Cleaner: Eavesdropping via Lidar Sensors [pdf]

Hello all, I&#x27;m Sriram, the first author of this paper. We were inspired by the idea of laser microphones as an audio eavesdropping vector, and tried to find a way to use LIDARs similarly, even though they&#x27;re not designed for this purpose at all.<p>In the near future, what I think is scarier is the possibility of executing the same attack through self-driving cars LIDARs. Perhaps this would allow attackers to spy on conversations in cars that are driving beside you or stationary next to you at traffic lights.

If only my Roomba was that smart, I wouldn&#x27;t probably worry about eavesdropping: right now it can barely clean my floor and lock himself in the bathroom forever.<p>Jokes aside, which Robot Vacuum Cleaner is equiped with a LIDAR? So far the only ones that I&#x27;ve seen barely have a proximity sensor, fall sensor and IR sensors . It could be that I&#x27;ve only bought and seen the cheapest versions though.

The &quot;Evil Maid&quot; class of attacks have a new vector: &quot;Evil Digital Maid&#x2F;Butler&quot; (assume pervasive, fully compromised electronic assistants).<p>iPhone &quot;Evil Maid&quot; =&gt; GPS, Mic, Camera, Digital User Impersonation [post social network messages, iMessage, etc.]<p>HomePod &quot;Evil Butler&quot; =&gt; Control HomeKit, Mic, Playback Arbitrary Recordings [freeze, this is the police, etc., impersonate a significant other]<p>Roomba &quot;Evil Maid&quot; =&gt; Lidar (mm-resolution depth-camera?!?), Virtual Mic, Push&#x2F;Close Doors, Push&#x2F;Move Objects [tip over a table w&#x2F; candle]<p>WiFi Cams &quot;Evil Maid&quot; =&gt; Camera, sometimes speakers, sometimes motion control<p>...if this is how the robot uprising begins, we&#x27;re a long way from Terminators &#x2F; SkyNet, but easy to see entire classes of vulnerabilities which are pretty obvious in retrospect.<p>If you haven&#x27;t seen &quot;Enemy of the State&quot; or &quot;Conspiracy Theory&quot;, they&#x27;re great movies with a similar premise: &quot;What if &#x27;the system&#x27; turned against you?&quot;

If you&#x27;re playing around with this, it might help to be root on the vacuum. <a href="https:&#x2F;&#x2F;github.com&#x2F;dgiese&#x2F;dustcloud" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;dgiese&#x2F;dustcloud</a>

Human maid vs robot vacuum cleaner... I&#x27;d take my chances with the robot.

Here&#x27;s a clearer photo of the setup -<p><a href="https:&#x2F;&#x2F;umd.app.box.com&#x2F;s&#x2F;7qkltjg5xs6cpbjllu8fajpelbs736cm" rel="nofollow">https:&#x2F;&#x2F;umd.app.box.com&#x2F;s&#x2F;7qkltjg5xs6cpbjllu8fajpelbs736cm</a><p>It&#x27;s interesting work. It&#x27;s a kinda like finding a really weak seemingly impossible to use buffer overflow and now someone has to weaponize it and put it into easy to use metasploit to become just one of 1000s of things to have available.<p>Personally I&#x27;m surprised all these robots don&#x27;t have microphones yet. Not being able to talk to robots makes them pretty lame.

In reality though I never have my lidar robotvac running when I am at home. Even less having a conversation as all robotvac are loud. I personally would be still more concern about all voice activate device (alexa etc).

This is why I make sure to whisper when entering my 2FA codes.

This reminds me of the LibreRVAC project:<p><a href="https:&#x2F;&#x2F;librervac.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;librervac.org&#x2F;</a>

Terrifying when you think of the implications this has on self driving cars and the latest smartphones.

Given that these vacuums also have a speaker, could that be used as a microphone as well?

This is stupid; if I&#x27;m going to be able to sneak an entire robot vacuum cleaner into the victim&#x27;s environment, I&#x27;m putting an actual microphone and even camera in there, and not messing around with LIDAR bouncing off vibrating paper cups.