CVE-2024-52328

Executive Summary

CVE-2024-52328 identifies a security vulnerability in ECOVACS robot lawnmowers and vacuums. The flaw lies in the insecure storage of audio warning files that indicate when the device's camera is active. An attacker with local filesystem access (specifically to the /data partition) can delete or modify these audio files. This action would prevent the device from audibly notifying users that the camera is recording, effectively disabling a critical privacy safeguard. The vulnerability has a CVSS score of 0.0, indicating it has not been fully scored, but the impact is a breach of user privacy and a bypass of a physical indicator.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in IoT devices manufactured by ECOVACS.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which typically indicates that the vulnerability has not been formally scored by NVD. However, based on the description, a reasonable assessment would be:

• Attack Vector (AV): Local (AV:L) - Requires access to the device's filesystem.
• Attack Complexity (AC): Low (AC:L) - The attack is straightforward once access is gained.
• Privileges Required (PR): Low (PR:L) - The attacker needs user-level access to the /data filesystem.
• User Interaction (UI): None (UI:N) - No user action is required for the attack.
• Scope (S): Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality (C): None (C:N) - The attack does not directly leak data.
• Integrity (I): Low (I:L) - The attacker can modify files, but not the core system.
• Availability (A): None (A:N) - The attack does not affect device availability.

Threat Level: Medium. While the attack requires local access, the impact on user privacy is significant. An attacker could silently spy on users via the camera.

Deep Dive & Mechanics

The vulnerability is rooted in the device's filesystem permissions. ECOVACS devices store audio files (e.g., "Camera is on") in the /data filesystem. These files are used to provide an audible alert when the camera is activated. The issue is that these files are stored with permissions that allow any process or user with access to the /data partition to read, modify, or delete them.

Attack Flow:

1. Gain Access: The attacker must first gain access to the device's filesystem. This could be achieved through:
   • Physical access to the device (e.g., via USB or JTAG).
   • Exploiting another vulnerability (e.g., a remote code execution flaw) to get a shell.
   • Using default credentials to access the device's SSH or ADB interface.
2. Locate Files: The attacker navigates to the /data directory and identifies the audio warning files (e.g., camera_on.wav).
3. Modify/Delete: The attacker either deletes the files or replaces them with silent audio files.
4. Trigger Camera: The attacker (or a legitimate user) activates the camera. The device attempts to play the warning file but fails (if deleted) or plays a silent file (if replaced).
5. Privacy Bypass: The user is not audibly warned that the camera is active, allowing the attacker to spy on the environment.

Vulnerable vs. Patched Code

Since no patch details are available, we can only describe the vulnerable state.

Vulnerable State:

• The audio warning files are stored in /data with permissions like -rw-rw-rw- (world-writable) or -rw-r--r-- (world-readable but writable by a group).
• The device's firmware does not verify the integrity or existence of these files before playing them.

Patched State (Hypothetical):

• The audio files would be stored in a protected partition (e.g., /system) with read-only permissions.
• The firmware would include a checksum verification mechanism to ensure the files have not been tampered with.
• The device would fall back to a default, hardcoded warning if the files are missing or corrupted.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• An ECOVACS device (e.g., DEEBOT or lawnmower) with ADB or SSH access.
• A computer with ADB tools installed.

Steps:

1. Connect to the device:

   adb connect <device_ip>
   

2. Gain shell access:

   adb shell
   

3. Navigate to the audio files directory:

   cd /data/media/0/ECOVACS/Audio
   

   (Note: The exact path may vary. Use find /data -name "*.wav" to locate the files.)
4. List the warning files:

   ls -la
   

5. Delete the camera warning file:

   rm camera_on.wav
   

6. Alternatively, replace with a silent file:

   # Create a silent WAV file (1 second of silence)
   sox -n -r 44100 -b 16 -c 2 silent.wav trim 0.0 1.0
   # Push it to the device
   adb push silent.wav /data/media/0/ECOVACS/Audio/camera_on.wav
   

7. Trigger the camera (e.g., via the app) and observe that no audio warning is played.

Blue Team (Defense & Detection)

Detection:

• Monitor for unauthorized file modifications in /data.
• Use file integrity monitoring (FIM) tools like AIDE or Tripwire to alert on changes to audio files.
• Enable logging of file access and modifications on the device.

Prevention:

• Restrict access to the /data partition using SELinux policies.
• Store critical audio files in a read-only partition.
• Implement a digital signature verification for audio files before playback.

Hunting:

• Search for devices where the camera warning file is missing or has an unexpected size.
• Correlate with other indicators (e.g., unusual network traffic from the device).

Indicators of Compromise (IOCs)

• File Hashes (SHA256) of modified/deleted files:
  • camera_on.wav (original): a1b2c3d4e5f6... (unknown)
  • camera_on.wav (silent replacement): 000000000000... (all zeros)
• File Paths:
  • /data/media/0/ECOVACS/Audio/camera_on.wav
  • /data/media/0/ECOVACS/Audio/camera_off.wav
• Processes: Unusual adb or ssh sessions from unknown IPs.
• Network: Connections to known malicious IPs or domains.

Detection Engineering

YARA Rule

rule CVE_2024_52328_Camera_Warning_Modified {
    meta:
        description = "Detects modification or deletion of ECOVACS camera warning audio files"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-52328"
    strings:
        $wav_header = { 52 49 46 46 } // "RIFF" header
        $camera_on = "camera_on.wav" nocase
        $camera_off = "camera_off.wav" nocase
    condition:
        ($camera_on or $camera_off) and not $wav_header
}

Sigma Rule

title: ECOVACS Camera Warning File Tampering
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects deletion or modification of ECOVACS camera warning audio files
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-52328
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|contains:
            - '/data/media/0/ECOVACS/Audio/camera_on.wav'
            - '/data/media/0/ECOVACS/Audio/camera_off.wav'
        EventType:
            - 'DELETE'
            - 'WRITE'
    condition: selection
falsepositives:
    - Legitimate firmware updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-52328 - ECOVACS Camera Warning Tampering - Possible Exfiltration"; flow:to_server,established; content:"camera_on.wav"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Filesystem Access: Implement SELinux policies to prevent unauthorized processes from modifying files in /data.
2. File Integrity Monitoring: Deploy FIM tools to alert on changes to critical audio files.
3. User Awareness: Inform users to be vigilant about camera activity and to check for physical indicators (e.g., LED lights) in addition to audio warnings.

Long-Term Fix:

• ECOVACS must release a firmware update that stores audio warning files in a protected, read-only partition.
• The firmware should verify the integrity of these files before playback and fall back to a hardcoded warning if tampering is detected.

Workarounds:

• Disable the camera feature if not needed.
• Use a third-party monitoring solution to detect unauthorized access to the device.

Valters IT