Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

12:30 PM
Connect Directly

Hacked Robots Present a New Insider Threat

Robots and their control software are rife with critical and painfully obvious security flaws that make them easily hackable, new research shows.

Popular robotics products contain glaring and serious security vulnerabilities that could easily be exploited to hack and take control of a robot's movements and operations for spying or causing physical damage - and even posing a danger to humans.

Call it the new insider threat:  IOActive researchers Cesar Cerrudo and Lucas Apa have discovered some 50 flaws in popular robots and robot-control software used in businesses, industrial sites, and homes that could allow a hacker to remotely manipulate a robot moving about the office, plant floor, or home, to infiltrate other networks there, spy and steal information, and even wreak physical destruction.

Robots are getting "smarter" and in some cases, with more human-like qualities such as facial recognition features, all of which is helping propel their popularity and usability. IDC estimates that in 2020, worldwide spending on robotics will be at $188 billion. Robots today are mostly in the manufacturing industry, but the consumer and healthcare sectors are up-and-coming in their robotics adoption, according to IDC.

"A robot being inside [an organization] is actually a reality" today, notes IOActive's Apa, pointing to the rise of use in smart robotics technology. "And it's very difficult to distinguish between a robot that's been hacked" and one that's not, he says. 

A hacked robot could silently be used to go rogue and hack other networks within the office, or even other robots, according to the researchers, who say robots indeed could be the next-generation insider threat.

Apa, who is a senior security consultant with IOActive, and Cerrudo, IOActive's CTO, in their new research, studied robots and robotics control software products from Softbank Robotics, UBTECH Robotics, Robotis, Universal Robots, Rethink Robotics, and Asratec Corp. The researchers say they wanted to drill down on the security issues now, before robots become mainstream.

The robots and their control software were rife with some of the same security flaws common in notoriously insecure Internet of Things devices: insecure communications weaknesses such as cleartext or weak encryption between the robot and its components that provide its commands and software updates; a lack of authentication (no credentials required to access a robot's services, for example); and lack of authorization measures, which could leave a robot at the mercy of a nefarious attacker.

In addition, they found weak cryptography in the devices and their software that leave sensitive data and information stored in the robots at risk, such as passwords, crypto keys, and vendor service credentials, for example. Some of the devices also come with weak default configurations that don't properly lock down the robots and their operations, and Cerrudo and Apa found that some of these devices couldn't even be properly retrofitted with new passwords, nor even fixed once they had been hacked.

"It can be hard to restore a robot to its original [uncompromised] state," Apa says. "With some vendors' products we analyzed, it was impossible," so the customer is stuck with a hacked robotic system, he says.

Turns out robots also suffer from some of the same open-source framework and library vulnerabilities of other software systems. Many robots run on the the Robot Operating System (ROS), which comes with cleartext communication, authentication, and weak authorization features, according to IOActive. "In the robotics community, it seems common to share software frameworks, libraries, operating systems, etc., for robot development and programming. This isn’t bad if the software is secure; unfortunately, this isn't the case here," the researchers wrote in their report published today.

Don Bailey, founder and CEO of Lab Mouse Security, says robot vulnerabilities are another example of the flaws found in embedded, IoT devices. "They're all embedded systems. You're going to keep seeing the same threats, over and over," says Bailey, an IoT security expert.

The bigger risk of today's robotics-type devices, he says, is data leaking and privacy breaches. The Amazon Alexa and Apple Siri-style smart devices and others can be used more for espionage, he says. "As they [robots] grow into more substantial technologies, we'll see more [physical] danger to humans," Bailey says.

A serious concern today is the provisioning and sunsetting of robotics products, he says. "How a robot associates itself with its owner" and what happens when that owner hands it over to another owner or user, pose security and privacy risks, he says. It's unclear how a new "owner" could be protected from the previous one still having access to the robot, for example.

IOActive's Apa and Cerrudo aren't releasing vulnerability details at this time, as they await responses from the vendors. So far, they've only heard back from four of them. "Only two said they are going to fix" the flaws, Cerrudo says. The other two indicated they understood they should "do something about it," he says.

They weren't able to actually test all of the robots, due to the expense of some of the devices as well as global shipping restrictions, so they mainly analyzed robot software, including mobile apps, operating systems, and firmware images. Those are core elements of robotic systems, they say, so they could get a good take on the security from them as well as from the physical robots they did have in hand.

Interestingly, the researchers say they easily found the flaws without drilling down too deeply in their security audit of the products, since their aim was to get a more high-level sense of robot security today. They aren't finished, though, and plan to do some deeper dives, they say.

"We consider many of the vulnerabilities we found simple to exploit," Apa says. "Anyone with a phone and app can remotely control the robot [via these bugs]. They don't need to develop an exploit."

Among the products with flaws were SoftBank Robotics' NAO and Pepper robots; UBTECH Robotics' Alpha 1S and Alpha 2 robots; ROBOTIS's OP2 and THORMANG3 robots; Universal Robots' UR3, UR5, and UR10 robots; Rethink Robotics's Baxter and Sawyer robots; and Asratec Corp.'s robots using V-Sido.

In one especially creepy scenario, the researchers say robots with face-recognition features in order to work with humans could be hacked and even manipulate their co-workers. Robots often come with microphones and cameras, so an attacker could employ the robot like a spy to get information, for example. "If an attacker can control this, they can use the built-in features to get information about the faces the robot recognizes," Apa says.

IOActive isn't the first to explore robot security: Researchers at the University of Washington in 2015 hacked a surgical robot to demonstrate how a bad guy could hijack and take control of a robot during surgery.

For now, business and home robotics users are basically at the mercy of their insecure robots, the researchers say. What can they do to protect themselves: "Pray," Cerrudo quips. "If I was a robot user, I would unplug it when I'm away at night," for example, he says.

Related Content:

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
Page 1 / 2   >   >>
User Rank: Apprentice
3/1/2017 | 4:22:49 PM
this goes to remind us that after all it's just software
As I wrote in "Artificial Intelligence For Better Or Worse?" on i-programmer ,this goes to remind us that after all it's just software, thus prone to the same issues that any program faces throughout its existence.

Software glitch aside, there are other issues too like who can tell what will happen if the software agents that power robotic hardware gets hacked or infected with a virus? How can we make adequate precautions against such an act?

And let's not forget about Microsoft's AI Twitter chatbot Tay which turned malevolent and racist far too easily.

So if we want to let AI evolve there many such issues to be solved first, letting alone the aspects of work displacement and ethics.


User Rank: Apprentice
3/8/2017 | 12:40:15 PM
Re: this goes to remind us full stop punctuation
Agree with your assertion dear, hacked robots can reveal all insider stuff.
User Rank: Apprentice
3/9/2017 | 6:31:09 PM
Re:my instagram
I hope the researchers of IOActive find a way to drill down on the security issues now, before robots become mainstream. I could imagine how big the damage would be if a robot hacks other networks within the office.
User Rank: Apprentice
3/13/2017 | 2:27:43 PM
A.I. website Roblox
I do love the fact technology is evolving. I do worry for our future tho, can we every fully trust robots? 
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
3/16/2017 | 1:38:20 PM
Re: this goes to remind us that after all it's just software
All good points, @nikosvg. There are a lot of angles to robot security issues. In some ways, it's just another IoT problem. That being said, with the "human-like" qualities evolving with these systems, there also are major insider threat possibilities here, and they're even more direct and potentially damaging than that of your printer, fridge/microwave/toaster.
User Rank: Apprentice
3/17/2017 | 9:20:22 PM
A.I. website free instagram followers
 I could imagine how big the damage would be if a robot hacks other networks within the office.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
3/27/2017 | 8:48:13 PM
Re: A.I. website free instagram followers
That's a chilling but real threat, @Ludivina. Code can be used for evil just as much as for good.
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
4/1/2017 | 5:14:03 PM
Re: this goes to remind us that after all it's just software
@Kelly: That's an eye-opening way of framing it, Kelly -- because the corollary is that IoT is just as scary as robots and a potential robot uprising.

Reminds me of the Futurama episode where the robots revolt and the toaster is the most vicious-minded of all.
User Rank: Apprentice
4/2/2017 | 8:15:57 AM
I Remembered . . .
Made me go find and read Asimov's short "Robot Dreams".  Used to be Science FICTION!
Judy Myerson
Judy Myerson,
User Rank: Apprentice
4/3/2017 | 4:26:37 AM
Re: I Remembered . . .
You made me look for Issac Asimov's books on robots. I will re-read them when I get a chance.
Page 1 / 2   >   >>
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-03-06
Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service sc...
PUBLISHED: 2021-03-05
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
PUBLISHED: 2021-03-05
Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution.
PUBLISHED: 2021-03-05
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
PUBLISHED: 2021-03-05
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.