{"id":56067,"date":"2026-07-02T11:44:17","date_gmt":"2026-07-02T15:44:17","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=56067"},"modified":"2026-07-02T11:44:17","modified_gmt":"2026-07-02T15:44:17","slug":"yarbo-robot-lawn-mower-hacked-2","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/yarbo-robot-lawn-mower-hacked-2\/56067\/","title":{"rendered":"Yarbo’s robot mower: a backdoor in your backyard"},"content":{"rendered":"

If machines ever rise against humans, which smart appliance do you think you should fear most? Your blender, your smart kettle, or maybe your robot vacuum cleaner? My money is on\u2026 robot lawn mowers\u00a0\u2014 and I bet that after reading this post, you\u2019ll be eyeing them suspiciously too. This story covers the recent findings of independent security researcher<\/a> Andreas Makris, who was tracking six thousand Yarbo mowers when his study was published. Even worse, if he wanted to, he could take total control of any unit: boot it up, steer it remotely, snap photos with the built-in camera, and plenty more. Read on to find out exactly how he pulled it off.<\/p>\n

What exactly are Yarbo robot mowers?<\/h2>\n

Calling a Yarbo device a mere lawn mower doesn\u2019t really do it justice. In reality, these high-tech machines are autonomous mini-tractors built to tackle a wide range of chores. Beyond just cutting grass, they can clear snow, blow away fallen leaves, haul heavy loads, patrol your property, and more. And to handle all these different outdoor tasks, the manufacturer offers a whole suite of interchangeable attachments.<\/p>\n

\"Yarbo<\/a>

Yarbo is a modular yard-care robot. Depending on the attachment used, it can function as a lawn mower, trimmer, snowblower, leaf blower, or utility cart. Source<\/a><\/p><\/div>\n

None of this comes cheap: in Europe, the base robot alone will set you back over \u20ac5000, while individual attachments cost anywhere from \u20ac1500 to \u20ac2500 each. If you want the full setup, including the robot and every available module\u00a0\u2014 the mower, trimmer, snow blower, leaf blower, and towing module\u00a0\u2014 you\u2019re looking at a grand total of over \u20ac12\u00a0000.<\/p>\n

As a lawn mower, this robotic tractor boasts some seriously impressive specs<\/a>. It features a cutting width of about 50cm, thanks to dual cutting discs outfitted with five blades each. A single charge covers roughly a thousand square meters. Once the battery drops to 20%, the robot drives itself back to the charging station and, once topped up, picks up right where it left off\u00a0\u2014 just like a robot vacuum; except on a completely different scale: in mowing mode, this machine can maintain properties of up to 25\u00a0000 square meters, and in towing mode it can handle up to 125\u00a0000 square meters of land.<\/p>\n

\"The<\/a>

The Yarbo robot configured for snow removal. Source <\/a><\/p><\/div>\n

For lawn care and landscaping, it all sounds like a dream come true. But imagine what could happen if you lost control of such a powerful machine. Well, <em>The Verge<\/em> reporter Sean Hollister doesn\u2019t have to imagine. He teamed up with researcher Andreas Makris for an experiment where the researcher, sitting in Germany, remotely hijacked a Yarbo mower and ran over the journalist as he lay on his lawn back in the U.S. We\u2019ll dive into all the details in the next sections.<\/p>\n

\"The<\/a>

Yarbo\u2019s complete package, featuring every attachment offered by the manufacturer: a setup that runs to well over \u20ac12 000 in Europe. Source<\/a><\/p><\/div>\n

How the researcher hijacked the Yarbo devices<\/h2>\n

We\u2019ve mentioned<\/a> before on our blog that all smart devices are essentially computers\u00a0\u2014 often on wheels. Most of the time, they run on Linux, and Yarbo\u2019s robots are no exception. While digging into the device\u2019s firmware, Makris discovered a built-in mechanism<\/a> that maintains a constant connection with the company\u2019s servers.<\/p>\n

This kind of setup isn\u2019t unusual in and of itself: most robot vacuums, smart cameras, smart speakers, and other IoT gadgets regularly ping the manufacturer\u2019s infrastructure for things like software updates. But with Yarbo, this mechanism wasn\u2019t just passing along telemetry data and pulling down updates; it did double duty as a monitoring and remote access tool. In theory, a manufacturer might use this kind of access for completely legitimate reasons, like remote troubleshooting or tech support.<\/p>\n

To figure out exactly what this access could do, Makris dug into its configuration. As it turned out, the system allowed anyone to connect to the mower with top-tier administrative privileges and execute any command they wanted.<\/p>\n

Making matters worse, the connection relied on the \u201croot\u201d account: the primary administrative login in Linux that has total control over the system. Since that username is standard across Linux systems, an attacker wouldn\u2019t even have to guess a login.<\/p>\n

And that\u2019s where Makris hit another nasty surprise: the password for that root account was hardcoded right into the firmware, meaning it was exactly the same across every single Yarbo device. The password itself wasn\u2019t the strongest\u00a0\u2014 just nine characters\u00a0\u2014 but in this scenario, that didn\u2019t matter. The researcher didn\u2019t need to crack or brute-force the root password because it was sitting out in the open, hardcoded into one of the system components for anyone to find.<\/p>\n

\"The<\/a>

The root password for all Yarbo robots is hardcoded into one of the system components. Source<\/a><\/p><\/div>\n

To be absolutely clear, this password didn\u2019t just unlock one specific lawn mower\u00a0\u2014 it opened the door to every single Yarbo robot on the planet. What\u2019s worse, even if a tech-savvy owner managed to change their root password to something unique, the system would automatically reset it back to the default factory password during the next update.<\/p>\n

This means that to gain remote access to any of the thousands of Yarbo robots out there, all an attacker needed was the device\u2019s serial number and the universal root password. To make things even easier, the serial numbers follow a predictable format and serve as the robot\u2019s ID within Yarbo\u2019s ecosystem. The owner didn\u2019t have to click a thing or do anything wrong for their mower to be compromised.<\/p>\n

What an attacker can do with a Yarbo mower<\/h2>\n

Andreas Makris took a close look at exactly what this remote access allowed him to do<\/a>, and he gave <em>The Verge<\/em> reporter Sean Hollister a live demonstration of the capabilities, which included:<\/p>\n