Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

12:30 PM
Connect Directly

Hacked Robots Present a New Insider Threat

Robots and their control software are rife with critical and painfully obvious security flaws that make them easily hackable, new research shows.

Popular robotics products contain glaring and serious security vulnerabilities that could easily be exploited to hack and take control of a robot's movements and operations for spying or causing physical damage - and even posing a danger to humans.

Call it the new insider threat:  IOActive researchers Cesar Cerrudo and Lucas Apa have discovered some 50 flaws in popular robots and robot-control software used in businesses, industrial sites, and homes that could allow a hacker to remotely manipulate a robot moving about the office, plant floor, or home, to infiltrate other networks there, spy and steal information, and even wreak physical destruction.

Robots are getting "smarter" and in some cases, with more human-like qualities such as facial recognition features, all of which is helping propel their popularity and usability. IDC estimates that in 2020, worldwide spending on robotics will be at $188 billion. Robots today are mostly in the manufacturing industry, but the consumer and healthcare sectors are up-and-coming in their robotics adoption, according to IDC.

"A robot being inside [an organization] is actually a reality" today, notes IOActive's Apa, pointing to the rise of use in smart robotics technology. "And it's very difficult to distinguish between a robot that's been hacked" and one that's not, he says. 

A hacked robot could silently be used to go rogue and hack other networks within the office, or even other robots, according to the researchers, who say robots indeed could be the next-generation insider threat.

Apa, who is a senior security consultant with IOActive, and Cerrudo, IOActive's CTO, in their new research, studied robots and robotics control software products from Softbank Robotics, UBTECH Robotics, Robotis, Universal Robots, Rethink Robotics, and Asratec Corp. The researchers say they wanted to drill down on the security issues now, before robots become mainstream.

The robots and their control software were rife with some of the same security flaws common in notoriously insecure Internet of Things devices: insecure communications weaknesses such as cleartext or weak encryption between the robot and its components that provide its commands and software updates; a lack of authentication (no credentials required to access a robot's services, for example); and lack of authorization measures, which could leave a robot at the mercy of a nefarious attacker.

In addition, they found weak cryptography in the devices and their software that leave sensitive data and information stored in the robots at risk, such as passwords, crypto keys, and vendor service credentials, for example. Some of the devices also come with weak default configurations that don't properly lock down the robots and their operations, and Cerrudo and Apa found that some of these devices couldn't even be properly retrofitted with new passwords, nor even fixed once they had been hacked.

"It can be hard to restore a robot to its original [uncompromised] state," Apa says. "With some vendors' products we analyzed, it was impossible," so the customer is stuck with a hacked robotic system, he says.

Turns out robots also suffer from some of the same open-source framework and library vulnerabilities of other software systems. Many robots run on the the Robot Operating System (ROS), which comes with cleartext communication, authentication, and weak authorization features, according to IOActive. "In the robotics community, it seems common to share software frameworks, libraries, operating systems, etc., for robot development and programming. This isn’t bad if the software is secure; unfortunately, this isn't the case here," the researchers wrote in their report published today.

Don Bailey, founder and CEO of Lab Mouse Security, says robot vulnerabilities are another example of the flaws found in embedded, IoT devices. "They're all embedded systems. You're going to keep seeing the same threats, over and over," says Bailey, an IoT security expert.

The bigger risk of today's robotics-type devices, he says, is data leaking and privacy breaches. The Amazon Alexa and Apple Siri-style smart devices and others can be used more for espionage, he says. "As they [robots] grow into more substantial technologies, we'll see more [physical] danger to humans," Bailey says.

A serious concern today is the provisioning and sunsetting of robotics products, he says. "How a robot associates itself with its owner" and what happens when that owner hands it over to another owner or user, pose security and privacy risks, he says. It's unclear how a new "owner" could be protected from the previous one still having access to the robot, for example.

IOActive's Apa and Cerrudo aren't releasing vulnerability details at this time, as they await responses from the vendors. So far, they've only heard back from four of them. "Only two said they are going to fix" the flaws, Cerrudo says. The other two indicated they understood they should "do something about it," he says.

They weren't able to actually test all of the robots, due to the expense of some of the devices as well as global shipping restrictions, so they mainly analyzed robot software, including mobile apps, operating systems, and firmware images. Those are core elements of robotic systems, they say, so they could get a good take on the security from them as well as from the physical robots they did have in hand.

Interestingly, the researchers say they easily found the flaws without drilling down too deeply in their security audit of the products, since their aim was to get a more high-level sense of robot security today. They aren't finished, though, and plan to do some deeper dives, they say.

"We consider many of the vulnerabilities we found simple to exploit," Apa says. "Anyone with a phone and app can remotely control the robot [via these bugs]. They don't need to develop an exploit."

Among the products with flaws were SoftBank Robotics' NAO and Pepper robots; UBTECH Robotics' Alpha 1S and Alpha 2 robots; ROBOTIS's OP2 and THORMANG3 robots; Universal Robots' UR3, UR5, and UR10 robots; Rethink Robotics's Baxter and Sawyer robots; and Asratec Corp.'s robots using V-Sido.

In one especially creepy scenario, the researchers say robots with face-recognition features in order to work with humans could be hacked and even manipulate their co-workers. Robots often come with microphones and cameras, so an attacker could employ the robot like a spy to get information, for example. "If an attacker can control this, they can use the built-in features to get information about the faces the robot recognizes," Apa says.

IOActive isn't the first to explore robot security: Researchers at the University of Washington in 2015 hacked a surgical robot to demonstrate how a bad guy could hijack and take control of a robot during surgery.

For now, business and home robotics users are basically at the mercy of their insecure robots, the researchers say. What can they do to protect themselves: "Pray," Cerrudo quips. "If I was a robot user, I would unplug it when I'm away at night," for example, he says.

Related Content:

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
Judy Myerson
Judy Myerson,
User Rank: Apprentice
4/3/2017 | 4:26:37 AM
Re: I Remembered . . .
You made me look for Issac Asimov's books on robots. I will re-read them when I get a chance.
User Rank: Apprentice
4/2/2017 | 8:15:57 AM
I Remembered . . .
Made me go find and read Asimov's short "Robot Dreams".  Used to be Science FICTION!
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
4/1/2017 | 5:14:03 PM
Re: this goes to remind us that after all it's just software
@Kelly: That's an eye-opening way of framing it, Kelly -- because the corollary is that IoT is just as scary as robots and a potential robot uprising.

Reminds me of the Futurama episode where the robots revolt and the toaster is the most vicious-minded of all.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
3/27/2017 | 8:48:13 PM
Re: A.I. website free instagram followers
That's a chilling but real threat, @Ludivina. Code can be used for evil just as much as for good.
User Rank: Apprentice
3/17/2017 | 9:20:22 PM
A.I. website free instagram followers
 I could imagine how big the damage would be if a robot hacks other networks within the office.
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
3/16/2017 | 1:38:20 PM
Re: this goes to remind us that after all it's just software
All good points, @nikosvg. There are a lot of angles to robot security issues. In some ways, it's just another IoT problem. That being said, with the "human-like" qualities evolving with these systems, there also are major insider threat possibilities here, and they're even more direct and potentially damaging than that of your printer, fridge/microwave/toaster.
User Rank: Apprentice
3/13/2017 | 2:27:43 PM
A.I. website Roblox
I do love the fact technology is evolving. I do worry for our future tho, can we every fully trust robots? 
User Rank: Apprentice
3/9/2017 | 6:31:09 PM
Re:my instagram
I hope the researchers of IOActive find a way to drill down on the security issues now, before robots become mainstream. I could imagine how big the damage would be if a robot hacks other networks within the office.
User Rank: Strategist
3/8/2017 | 1:42:52 PM
This is insane! Word needs to be spread about this issue.
User Rank: Apprentice
3/8/2017 | 12:40:15 PM
Re: this goes to remind us full stop punctuation
Agree with your assertion dear, hacked robots can reveal all insider stuff.
<<   <   Page 2 / 3   >   >>
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-11-24
Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authentication of administrators and the product's settings may be changed without the user's intention or consent via unspecified vectors.
PUBLISHED: 2020-11-24
Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
PUBLISHED: 2020-11-24
includes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS via a qbfind message supplied by an administrator.
PUBLISHED: 2020-11-24
The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question, entered during Special:CreatePoll or Special:UpdatePoll.
PUBLISHED: 2020-11-24
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into the r...