Betty Davis's vacuum's eyes

/

full text:

This story is actually insane:

• dude drops $2000 on a DJI robot vacuum like a lunatic

• refuses to use the normal app like a peasant

• pulls an auth token from their servers, connects successfully • except the system thinks he controls 7000 vacuums

•checks again

• yep, seven thousand

• DJI built authentication with zero device ownership verification

• any valid token works for any unit on the planet • Sammy now has eyes inside homes across 24 countries

• live vacuum camera feeds everywhere

• full floor plans from the mapping data

• some guy in germany eating cereal at 3am, unaware his roomba is snitching

• one API call away from being the most informed burglar in history • all he wanted was to steer his vacuum with a joystick

• does the right thing and reports it

• DJI fixes it in two days

• back to normal life with his stupidly expensive floor cleaner

• IoT companies stay undefeated at shipping garbage security