Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
I am writing this specifically because the issues raised in the latest security report should be addressed directly, not by the company.
On May 7, 2026, security researcher Andreas Makris published a detailed report identifying vulnerabilities in Yarbo’s remote sensing, profile management, and data management. Technical results are accurate. I would like to thank Mr. Andreas Makris for his work in identifying these issues and his persistence in bringing them to us. I also realize that our initial response did not adequately reflect the seriousness of the issues identified. As a co-founder, I am responsible for what is posted on our products, and I am responsible for the response.
Our engineering, marketing, legal, and customer service teams are working on innovation as a priority. What follows is my story of what was discovered, what we’ve already fixed, what we’re currently working on, and what we’re doing to change the way we work moving forward.
Based on our initial analysis, the challenges are largely related to previous design decisions in some areas of Yarbo’s remote monitoring, access management, and data management.
Specifically, some legacy and maintenance capabilities didn’t give users enough visibility or control, and some authentication and profile management systems didn’t meet the security standards we expect from today’s products.
We have also identified areas where access permissions, backend system configurations, and data flow between devices and cloud services require strong security and control.
We recognize the seriousness of this issue and the concerns it may cause to our customers and our community. We sincerely apologize for the impact this has caused, and we are committed to addressing these issues in an open and transparent manner.
We’re strengthening system security by reducing old access methods, tightening permissions, and moving to more transparent device controls. To make our revisions clear, we are separating the past from the current work.
What We Have Already Done
What We’re Working On Now
Older servers and legacy access systems will continue to be phased out one by one as part of this maintenance.
We are also accelerating OTA security updates and server-side security updates. The first update is expected to start rolling out within a week. Requirements: The security firmware update is being pushed to all Yarbo devices. To receive these updates, please connect your Yarbo to the Internet. Once the changes are applied, you can return to your preferred network settings. If you want to keep your device offline for now, you can do so without voiding your warranty or service coverage. We will let you know when the update is ready so you can connect briefly to use it.
This update is not just a one-time update or software update. We are using this method to strengthen the long-term security architecture and management of our products.
This includes strengthening the human resources process, improving the legal and regulatory processes, increasing the visibility of the users and monitoring of remote events, and also reducing the unnecessary support of entering different systems and infrastructures.
We will also continue to expand our internal security audits, remediation, and control measures to support strong long-term security measures. Our goal is to ensure that security, transparency, and user reliability are built into the foundation of Yarbo’s future operations and services.
Some items in the external report describe specific safety issues, while others require clarification because they do not apply to Yarbo’s currently posted products or do not represent an independent risk.
FRP Auto-Restart and Persistence
The report also states that the FRP client can restart scheduled services or service recovery procedures. We acknowledge that this can make manual stoppages of remote transport difficult, but the main problem lies in the existence, permissions, and policies of remote transport. Our refactoring focuses on blocking or disabling tunnels, enabling authentication and auditing, and removing unnecessary remote access paths.
File Management and Automatic Recovery
The report lists file management systems that can restore deleted files or other services. This system was originally designed as a reliable way to protect important files from accidental deletion or corruption. By itself, it is not intended to function as a remote control.
That said, we recognize that any approach that makes remote access devices difficult for users to remove can cause concern. We are also evaluating which files should continue to be protected and which components should be removed, modified, or placed in the hands of users.
Old or Outdated Changes
Some of the findings include legacy infrastructure, legacy cloud services, changes in sales processes, or internal testing settings. This is still being discussed and refined if necessary, but should be distinguished from the default behavior of the production units posted here.
Our goal is to be precise: we will not minimize the security issues, but we also want users to understand what is being used in the production equipment, what works for old or customized updates, and what is being addressed as part of the incentives.
To improve security reporting in the future, we are introducing a security response system and a security communication system for better risk reporting and disclosure:
The public can also access our security information at Yarbo Security Center page under the “Explore” section of our official website.
We are also looking into the possibility of implementing a debt settlement program as part of our long-term security.
We appreciate the work that independent investigators take in identifying potential incidents, and we remain committed to strengthening the security, transparency, and reliability of our products.
As research and development work continues, I will provide further updates as they become available.
Kenneth Kohlmann
Co-founder, Yarbo
new York
