Kaspersky researchers have examined several popular smart pet feeders available on online marketplaces and have discovered that some of them have vulnerabilities, allowing to secretly spy on victims, steal data including camera and microphone recordings, gain access to other devices within the same network, and gain full control over the device.
Smart pet feeders dispense food based on a schedule and offer remote monitoring and communication through features like microphones, speakers, and cameras. They are controlled through a mobile app, enabling easy management and updates.
A Kaspersky study has uncovered several significant security issues with pet feeders, including the utilisation of hard-coded credentials and an insecure firmware update process. If exploited by a remote attacker, these vulnerabilities could enable unauthorised execution of code, modification of device settings, and theft of sensitive information, including live video feeds sent to the cloud server.
Such weaknesses could potentially transform the pet feeder into a surveillance tool, compromising user privacy and security.
The smart pet feeder under analysis is compatible with voice assistants, allowing users to control it using voice commands. However, a critical security flaw is present in its setup. The MQTT broker’s username and password are hardcoded into the executable, making them identical for all devices of the same model.
This vulnerability exposes a considerable risk, as an attacker who gains control of one feeder can exploit it to launch subsequent attacks on other network devices. Once compromised, the attacker can intercept and manipulate commands, potentially assuming full control over the device.
Finally, tampering with the feeding schedules could endanger the pet’s health and add an extra financial and emotional strain.
“As our lives become more entwined with smart devices, attackers are seizing the opportunity to exploit the weakest links in our interconnected ecosystem. It is essential that we recognise the potential risks posed by unexpected devices and maintain a constant state of vigilance. By staying informed, practicing good cybersecurity hygiene, and fostering a collective responsibility for security, we can thwart the advances of attackers and preserve the integrity of our interconnected world,” comments Roland Saco, security expert at Kaspersky.
The Kaspersky team has reported all vulnerabilities found to the vendor.