Hacking

Thousands of Xiaomi FURRYTAIL pet feeders exposed to hack

A Russian security researcher accidentally discovered API and firmware issues that allowed her to take over all Xiaomi FurryTail pet feeders.

The Russian security researcher Anna Prosvetova, from Saint Petersburg, has accidentally discovered API and firmware issues that allowed her to take over all Xiaomi FurryTail pet feeders.

Last week, Prosvetova revealed on her private Telegram channel (@theyforcedme) to have discovered the flaw in the Xiaomi FurryTail pet feeders.

“While studying the feeder API, I discovered some records that run on the screen of any of these devices, as well as data on the WiFi networks of the people who bought them.” explained the experts. “After a couple of clicks I was able to feed any dog or cat, although it also has a malicious use, as it is possible to delete the schedules programmed by the user, which would leave the pets without food.”

Xiaomi FurryTail pet feeders are smart pet food dispensers that can be controlled via a mobile app to release certain quantities of food at specific times of the day.

Prosvetova bought a Xiaomi FurryTail pet feeder from AliExpress for $80, and testing the API implemented by the device she was able to find 10,950 active devices worldwide.

The researcher explained that the devices were exposed online without authentication, she was able to change feeding schedules. The expert also discovered that the devices were also using the Wi-Fi ESP8266 chipset that is affected by a flaw that could be exploited by an attacker to download and install new firmware, and reboot Xiaomi FurryTail pet feeders.

Attackers could abuse the issue to carry out various malicious activities, including DoS and DDoS attacks.

“At first she only found 800 of these devices online, although soon after this figure increased to 6, 500, to finish its count in almost 11 thousand feeders. Fortunately, Prosvetova claims that she would be unable to use these devices to negatively impact any cat or dog.” reads the post published by SecurityNewspaper.

“According to cybersecurity experts, this flaw exists because these devices have an ESP8266 driver, which allows the installation of a fake firmware to compromise their security and perform other activities, such as formatting, botnet integration, among others”

The researcher notified Xiaomi of the security vulnerabilities she discovered that acknowleding them and announced it will fix the issue as soon as possible.

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Xiaomi FURRYTAIL, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…

4 hours ago

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

15 hours ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

19 hours ago

CISA adds Microsoft SharePoint bug disclosed at Pwn2Own to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint vulnerability disclosed at the…

1 day ago

The DDR Advantage: Real-Time Data Defense

This is the advantage of Data Detection and Response (DDR) for organizations aiming to build…

1 day ago

Finnish police linked APT31 to the 2021 parliament attack

The Finnish Police attributed the attack against the parliament that occurred in March 2021 to…

1 day ago

This website uses cookies.