Call an Exorcist! My Robot’s Possessed!

This McAfee ATR report presents a deep technical analysis of four vulnerabilities in Robotemi's temi teleconference robot and Android app that allowed attackers to (1) join any ongoing call by using a hard-coded Agora App ID with predictable six-digit channel names, (2) intercept or take over calls by subscribing/publishing to MQTT topics tied to client IDs (MD5 of phone numbers), (3) add contacts via forged synccontacts messages, and (4) escalate privileges to OWNER and remotely control the robot by spoofing owners messages; the vendor was notified and patches were released by July 15, 2020.