DJI Romo: Modder uses PS5 controller to drive robot vacuum, gains access to 7,000 robot cameras

The DJI Romo is the well-known drone maker’s very first robot vacuum. With a striking transparent design, the robot stands out from competitors, but protection against cyberattacks apparently wasn’t prioritized during development. As The Verge reports, a customer has accidentally hacked around 7,000 DJI Romo units worldwide.

Sammy Azdoufal originally just wanted to control his robot vacuum with a PlayStation controller for fun. The custom remote-control app was supposed to control the robot through DJI’s servers. But instead of only controlling his own DJI Romo, the server granted the developer access to all nearly 7,000 DJI Romo units that were active at the time. More alarmingly, the developer could not only control the robots but also access their microphones and speakers, which practically gave him live access to thousands of homes.

Via the IP address, the approximate location of each robot could be determined, and the robots could even generate room maps. The programmer said he did not have to break any rules or bypass security restrictions to get this kind of access. Instead, DJI’s servers accepted the token from a single DJI Romo as authentication to access the data of all DJI Romo units. DJI fixed this major security flaw on Wednesday, February 11. Nevertheless, the incident illustrates how much personal data a smart home device like a robot vacuum can collect, and how serious this kind of flaw would be if it’s exploited by an attacker.