technology
Yarbo to Eliminate Default Remote Access on Robot Lawn Mowers, Make Feature User Opt-In
Yarbo has reversed course on a remote access vulnerability in its robot lawn mowers following security research that allowed remote hijacking. Cofounder Kenneth Kohlmann told The Verge the company will eliminate the default backdoor and let customers decide whether to install it. Firmware updates have begun rolling out with unique root passwords.
May 12, 8:15 AM·1m read1 source
The VergeAudio version
Tap play to generate a narrated version.
Developing·Limited corroboration so far. This page will refresh as more sources emerge.
Yarbo plans to completely remove the remote backdoor access from its robot lawn mower and will let customers decide whether the remote access feature gets installed. The company had promised on Friday that it would tackle many security issues head-on after security researcher Andreas Makris hijacked Yarbo robots from the other side of the globe.
The vulnerabilities exposed email addresses and GPS locations.
On Saturday, spokespeople Showan Hou and Maggie Zhou told The Verge that completely removing remote diagnostic capability would reduce Yarbo’s ability to help customers resolve safety, connectivity, and service issues quickly, especially in cases where physical inspection is not practical.
By Monday the company had shifted position. Kenneth Kohlmann, a cofounder of Yarbo, called Sean Hollister from the airport.
“In the future there should be no remote backdoor unless the user decides to opt in,” Kohlmann said. Removing the tunnel will take some time. The required files to install a new version may still technically be loaded on each robot’s internal storage.
“It would most likely be a setup script that sits on the machine and doesn’t do anything unless the user triggers it,” Kohlmann said. ” Users would likely first try uploading a log file to Yarbo tech support before opting for remote access. Firmware updates have already rolled out to the first 1,000 machines.
Firmware updates are coming to additional waves of robots. Every device should soon have a unique root password that Yarbo won’t provide to end users. The company is now in touch with Makris, and it is possible the security researcher will be able to validate the changes.
