Consumer and IoT privacy exposures from insecure device data handling and wireless identifiers

Multiple disclosures highlighted privacy and safety risks stemming from insecure data handling in connected devices and services. A server-side storage weakness in DJI Romo robot vacuums allowed a researcher to obtain access tokens for more than 6,700 other vacuums and view sensitive user data such as home floor plans, live video feeds, and microphone input; reporting indicated some issues were patched, but residual risk remained (e.g., the ability to stream video without a security PIN). Separately, the game Dungeon Crusher exposed user information after a misconfigured Elasticsearch instance leaked 24.5 million in-game chat records and purchase-related data, including IP addresses, email addresses, and partial payment card details, creating downstream risk for fraud and targeted phishing.

Academic research also demonstrated how everyday systems can leak exploitable signals or be manipulated in the physical world. UC Irvine researchers presented FlyTrap, a physical-world attack against autonomous target-tracking drones in which AI-generated umbrella patterns can cause drones to approach an attacker closely enough to be captured or crashed, raising concerns for deployments in surveillance and security contexts. IMDEA Networks and partners showed that Tire Pressure Monitoring System (TPMS) sensors broadcast a fixed unique ID in cleartext radio signals, enabling low-cost receiver networks to track vehicles over time without line-of-sight, based on signals collected from 20,000+ vehicles during a multi-week study.