There is no magic bullet for robot security. They are simply devices executing code, which are just as likely to be compromised as any other device in an organisation.
Securing The Robots
Kevin Curran | Ulster University
How secure are today
There is no magic bullet for robot security. They are simply devices executing code, which are just as likely to be compromised as any other device in an organisation.
Securing The Robots
Kevin Curran | Ulster University
How secure are today’s robots? Are some types considered more secure than others and if so, why?
Just recently, cybersecurity consultancy IOActive analyzed the mobile applications, operating systems, firmware images and other software used in home, business and industrial robots from multiple vendors including NAO and Pepper, Alpha 1S, Alpha 2, ROBOTIS OP2, THORMANG3, S, UR3, UR5, UR10, Baxter, Sawyer and several robots using the V-Sido robot control technology. They found that most robots had insecure communications, authentication issues, missing authorization schemes, weak cryptography, weak default configurations and were built using vulnerable open source frameworks and libraries.
A robot is only as secure as the operating system on which it resides. One of the most popular robotic middleware systems for robotics research is the Robot Operating System (ROS), which has, unfortunately, been shown to be vulnerable to injection and eavesdropping attacks. This, of course, can result in data loss, monetary damage or even physical injuries in the worst cases. Another example: real world industrial robots, for the most part, run firmware written in C and are specific to the processor types used inside the robot. They rarely use a real-time OS such as Linux. Here then is the difficulty in comparing the security of robots as the differ so much. In fact, one could argue that a robot that performs very limited tasks should be more secure than a more general-purpose robot due to the smaller footprint of code.
What are some of the hazards/risks associated with insecure (in terms of cybersecurity) robot applications?
One of the more famous studies on robot hacking was on a telesurgery robot called Raven II, which was developed at the University of Washington. Raven II has two surgical arms that are manipulated by a surgeon using a state-of-the-art control console that includes video and haptic feedback. The robot communicates with the control console using a standard communications protocol for remote surgery known as the Interoperable Telesurgery Protocol over public networks that are potentially accessible to anyone. Researchers showed how they could change the commands sent by the operator to the robot by deleting, delaying or re-ordering them, causing the robot’s movement to become jerky and difficult to control. They also were able to perform a denial of service attack on the robot. This is just an example highlighting how remote hackers could commandeer robots and get them to perform tasks of a destructive nature.
It is actually their kinetic abilities that make robots frightening. For instance, hacked robots could be used to damage objects and/or hurt people through sudden movements, start fires, unlock doors or deactivate burglar alarms – while it may seem far-fetched now, these threats are all realistic. People have already died when industrial robots have malfunctioned. That means the same is possible through hacking.
How can robots be better secured to defend against cybersecurity attacks?
There is always the risk of robots being hacked, which means additional measures need to be taken to secure them, such as implementing extra security authentication – perhaps facial recognition of the owner when opening panels. Costs can be higher than traditional systems, and many solutions also have monthly fees. Additionally, there is a real risk of privacy invasion, especially in the case of a robot that has complete freedom to roam inside the house, so surveillance footage needs to be securely stored. The main issue, however, is preventing remote hacks – owners need to ensure they keep the firmware & robot OS up-to-date and ensure long and complex passwords and other multi factor authentication methods are in place. Ultimately, a robot is just another networked device within an organization that needs to be included in risk assessment and patched as needed.
Are there any emerging technologies that are best to use to better secure robots? If so, which ones and why?
Considering their limited functionality, home robots to date do not pose a security threat other than through their “interface to the outside world.” That is to say that robots are a part of the Internet of Things (IoT) when they are connected to a home network. The danger is that owners never change the default passwords or use simple passwords that can be broken, allowing hackers to leverage their way onto a home network and use the robot as a pivot point for further exfiltration of sensitive data or to plant malware.
Building security into the life cycle of robot design as early as possible is seen as the best way to secure robots.
Is it the responsibility of the robot manufacturer, the integrator or the end user to ensure the installation is secure?
The issue of whether a manufacturer, integrator or end-user is responsible for security varies from robot to robot, country to country and use-case to use-case. Therefore, it is safer for a CISO and his or her IT team to just assume responsibility for all connected devices, including robots. No distinction should be made between a web enabled robot and a router in a back office.
The role of CISOs and CSOs in robotics security should be the same as security as it relates to Bring Your Own Device (BYOD) policies. Organizations that fail to address the broader security issues inherent in connecting robots may find themselves with significant financial and legal difficulties, as well 