Vulnerabilities / Threats
3/1/2017
12:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Hacked Robots Present a New Insider Threat

Robots and their control software are rife with critical and painfully obvious security flaws that make them easily hackable, new research shows.

Popular robotics products contain glaring and serious security vulnerabilities that could easily be exploited to hack and take control of a robot's movements and operations for spying or causing physical damage - and even posing a danger to humans.

Call it the new insider threat:  IOActive researchers Cesar Cerrudo and Lucas Apa have discovered some 50 flaws in popular robots and robot-control software used in businesses, industrial sites, and homes that could allow a hacker to remotely manipulate a robot moving about the office, plant floor, or home, to infiltrate other networks there, spy and steal information, and even wreak physical destruction.

Robots are getting "smarter" and in some cases, with more human-like qualities such as facial recognition features, all of which is helping propel their popularity and usability. IDC estimates that in 2020, worldwide spending on robotics will be at $188 billion. Robots today are mostly in the manufacturing industry, but the consumer and healthcare sectors are up-and-coming in their robotics adoption, according to IDC.

"A robot being inside [an organization] is actually a reality" today, notes IOActive's Apa, pointing to the rise of use in smart robotics technology. "And it's very difficult to distinguish between a robot that's been hacked" and one that's not, he says. 

A hacked robot could silently be used to go rogue and hack other networks within the office, or even other robots, according to the researchers, who say robots indeed could be the next-generation insider threat.

Apa, who is a senior security consultant with IOActive, and Cerrudo, IOActive's CTO, in their new research, studied robots and robotics control software products from Softbank Robotics, UBTECH Robotics, Robotis, Universal Robots, Rethink Robotics, and Asratec Corp. The researchers say they wanted to drill down on the security issues now, before robots become mainstream.

The robots and their control software were rife with some of the same security flaws common in notoriously insecure Internet of Things devices: insecure communications weaknesses such as cleartext or weak encryption between the robot and its components that provide its commands and software updates; a lack of authentication (no credentials required to access a robot's services, for example); and lack of authorization measures, which could leave a robot at the mercy of a nefarious attacker.

In addition, they found weak cryptography in the devices and their software that leave sensitive data and information stored in the robots at risk, such as passwords, crypto keys, and vendor service credentials, for example. Some of the devices also come with weak default configurations that don't properly lock down the robots and their operations, and Cerrudo and Apa found that some of these devices couldn't even be properly retrofitted with new passwords, nor even fixed once they had been hacked.

"It can be hard to restore a robot to its original [uncompromised] state," Apa says. "With some vendors' products we analyzed, it was impossible," so the customer is stuck with a hacked robotic system, he says.

Turns out robots also suffer from some of the same open-source framework and library vulnerabilities of other software systems. Many robots run on the the Robot Operating System (ROS), which comes with cleartext communication, authentication, and weak authorization features, according to IOActive. "In the robotics community, it seems common to share software frameworks, libraries, operating systems, etc., for robot development and programming. This isn’t bad if the software is secure; unfortunately, this isn't the case here," the researchers wrote in their report published today.

Don Bailey, founder and CEO of Lab Mouse Security, says robot vulnerabilities are another example of the flaws found in embedded, IoT devices. "They're all embedded systems. You're going to keep seeing the same threats, over and over," says Bailey, an IoT security expert.

The bigger risk of today's robotics-type devices, he says, is data leaking and privacy breaches. The Amazon Alexa and Apple Siri-style smart devices and others can be used more for espionage, he says. "As they [robots] grow into more substantial technologies, we'll see more [physical] danger to humans," Bailey says.

A serious concern today is the provisioning and sunsetting of robotics products, he says. "How a robot associates itself with its owner" and what happens when that owner hands it over to another owner or user, pose security and privacy risks, he says. It's unclear how a new "owner" could be protected from the previous one still having access to the robot, for example.

IOActive's Apa and Cerrudo aren't releasing vulnerability details at this time, as they await responses from the vendors. So far, they've only heard back from four of them. "Only two said they are going to fix" the flaws, Cerrudo says. The other two indicated they understood they should "do something about it," he says.

They weren't able to actually test all of the robots, due to the expense of some of the devices as well as global shipping restrictions, so they mainly analyzed robot software, including mobile apps, operating systems, and firmware images. Those are core elements of robotic systems, they say, so they could get a good take on the security from them as well as from the physical robots they did have in hand.

Interestingly, the researchers say they easily found the flaws without drilling down too deeply in their security audit of the products, since their aim was to get a more high-level sense of robot security today. They aren't finished, though, and plan to do some deeper dives, they say.

"We consider many of the vulnerabilities we found simple to exploit," Apa says. "Anyone with a phone and app can remotely control the robot [via these bugs]. They don't need to develop an exploit."

Among the products with flaws were SoftBank Robotics' NAO and Pepper robots; UBTECH Robotics' Alpha 1S and Alpha 2 robots; ROBOTIS's OP2 and THORMANG3 robots; Universal Robots' UR3, UR5, and UR10 robots; Rethink Robotics's Baxter and Sawyer robots; and Asratec Corp.'s robots using V-Sido.

In one especially creepy scenario, the researchers say robots with face-recognition features in order to work with humans could be hacked and even manipulate their co-workers. Robots often come with microphones and cameras, so an attacker could employ the robot like a spy to get information, for example. "If an attacker can control this, they can use the built-in features to get information about the faces the robot recognizes," Apa says.

IOActive isn't the first to explore robot security: Researchers at the University of Washington in 2015 hacked a surgical robot to demonstrate how a bad guy could hijack and take control of a robot during surgery.

For now, business and home robotics users are basically at the mercy of their insecure robots, the researchers say. What can they do to protect themselves: "Pray," Cerrudo quips. "If I was a robot user, I would unplug it when I'm away at night," for example, he says.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
Ludivina
50%
50%
Ludivina,
User Rank: Strategist
4/21/2017 | 7:45:09 PM
A.I. website free instagram followers
It does not even have to get infected, what if it get programmed that way? The A.I. sector has many pluses as well as twice the bad stuff that can go wrong.
ameliamartin
50%
50%
ameliamartin,
User Rank: Apprentice
4/19/2017 | 9:54:35 AM
Re: A.I. website free instagram followers
It does not even have to get infected, what if it get programmed that way? The A.I. sector has many pluses as well as twice the bad stuff that can go wrong.
Shantaram
50%
50%
Shantaram,
User Rank: Strategist
4/17/2017 | 3:09:49 AM
Re: 192.168.0.1
Thanks Kelly. Very useful information, i'll share it with my friends
forskolinfuel
50%
50%
forskolinfuel,
User Rank: Apprentice
4/16/2017 | 5:22:05 AM
Re: A.I. website forskolin reviewsphen375 reviewphenq review
Thanks for the share. Such an informative post!
forskolinfuel
50%
50%
forskolinfuel,
User Rank: Apprentice
4/13/2017 | 1:22:38 PM
Re: A.I. website forskolin reviewsphen375 reviewsphenq reviews
Thanks for the share. Such an informative post!
ameliamartin
50%
50%
ameliamartin,
User Rank: Apprentice
4/5/2017 | 1:43:51 PM
Re: A.I. website TechUnmasked
Thanks for info
ameliamartin
50%
50%
ameliamartin,
User Rank: Apprentice
4/5/2017 | 1:43:25 PM
Re: A.I. website forskolin reviewsphen375 reviewphenq review
Thanks for the share. Such an informative post!
vladdight
50%
50%
vladdight,
User Rank: Apprentice
4/4/2017 | 9:09:45 AM
Re: A.I. website TechUnmasked
Thanks for the share. Such an informative post!
vladdight
100%
0%
vladdight,
User Rank: Apprentice
4/4/2017 | 9:09:04 AM
Re: A.I. website free instagram followers
This issue is crazy....I can't believe more people aren't talking about it!
Judy Myerson
50%
50%
Judy Myerson,
User Rank: Apprentice
4/3/2017 | 4:26:37 AM
Re: I Remembered . . .
You made me look for Issac Asimov's books on robots. I will re-read them when I get a chance.
Page 1 / 3   >   >>
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.