TLDR Tech / InfoSec
No Shark is Safe: Millions of Shark Vacuums are Vulnerable to RCE
A security researcher found that all internet-connected Shark robot vacuums can be remotely controlled and used to execute arbitrary code by abusing misconfigured AWS IoT Core MQTT policies and device certificates. By extracting keys from one vacuum, an attacker can subscribe to a wildcard topic, see traffic from over a million devices, and send commands to hundreds of thousands of them. The devices can expose house maps, Wi‑Fi passwords in plaintext, and live camera feeds, turning them into mobile surveillance points inside homes. SharkNinja has been notified, but months later, the flaw remains unpatched.
Read the full story