BobDaHacker ๐ณ๏ธโโง๏ธ๐ค Hacked China's Biggest Robotics Company (Pudu Robotics)
Pudu makes those cat-faced BellaBot robot waiters you see in restaurants, plus cleaning robots, disinfection bots, and even FlashBots with mechanical arms for offices.
Found critical vulnerabilities in their app controlling their entire global fleet:
- Zero authentication on APIs
- Could control any robot worldwide
- Accept 20k store IDs in single request, no rate limiting
- Could steal food, documents, redirect hospital medicine delivery
- FlashBot with arms could grab files & use elevators
Reported Aug 12. Sent emails to sales, support, tech teams - all ignored.
Had to email Skylark Holdings (7000+ restaurants) and Zensho directly about their compromised robots.
Pudu responded in 48hrs with obvious ChatGPT template - forgot to replace "[Your Email Address]" placeholder. Fixed 2 days later.
Thousands of robots (BellaBots, KettyBots, FlashBots, etc) in hospitals, restaurants, offices worldwide were vulnerable for a long time.
Full Technical Writeup: https://bobdahacker.com/blog/hacked-biggest-chinese-robot-company
#infosec #robotics #BellaBot #PuduRobotics #security #vulnerability #responsibleDisclosure #cybersecurity
I Hacked BellaBot and Every Robot from China's Biggest Robotics Company (Pudu Only Fixed It When I Told Their Clients)
Critical vulnerabilities in Pudu Robotics allowed unauthorized control of every Pudu Robotics Robot worldwide. They ignored emails until I contacted Skylark Holdings and Zensho about their compromised robot fleets.
Marche mates
Walking Stick Mobility