Cybersecurity in robotics is a rapidly growing field attracting practitioners’ and researchers’ attention. Increased cyberattacks, combined with automated processes, present new threats that must be addressed to protect information assets and promote trust in robotics systems.
As a result, because robotics can be applied to many aspects of an organization and adopted in various industries, it’s crucial to assess cybersecurity risks in robotics platforms and understand how robots will impact tomorrow’s cybersecurity strategy.
When it comes to cyber-security in robotics, no single issue needs to be analyzed to ensure full protection. Given the increasing inter-connectedness of robotic devices, attackers have found ways to perform multiple attacks and overcome traditional barriers. One of the best cybersecurity practices is creating a comprehensive architecture to mitigate attacks.
Some of the most common examples of attacks on robotics systems have been identified as follows:
1. Distributed Denial of Service (DDoS)
From January to June 2020, Kaspersky experts reported a 350% increase in Distributed Denial of Service (DDoS) attacks compared to the same period in 2019. DoS attacks are a type of attack that aims to drain a network until the server crashes. During a Denial of Service (DoS) attack, cyber-criminals attempt to overload the network server with requests until it crashes, causing significant inconvenience to users, including the inability to access services.
While DoS attacks involve only one attacking computer, DDoS (Distributed Denial of Service) attacks exploit a ”botnet,” a series of infected computers capable of carrying out tasks simultaneously. DDoS attacks are particularly problematic because they can last from a couple of days to a few weeks, causing disruption of activity and denying people access to important content.
2. Spoofing
Spoofing refers to a situation in which an attacker impersonates another device or user on a network. Using this technique is to steal data, spread malware, or bypass access controls. The most common forms include spoofing an IP address, email address, or a Domain Name System (DNS) server. In robotics, a spoofing attack may force a robot to behave incorrectly. Spoofing threats such as GPS spoofing may cause users to lose control over drones. The technique used by an attacker to perform GPS spoofing on drones is to transmit fake GPS coordinates to the control system of the drone and change its trajectory.
3. Man-in-the-middle (MitM)
Man-in-the-middle (MitM) is a cyber-attack that enables cyber attackers to intercept and manipulate internet traffic. This type of attack often targets robots. As previously mentioned, several studies found that most robots have authentication and authorization problems, use unsecured communications and weak encryption, expose private information, have weak default configurations, and were built using open source frameworks and libraries. Some robots can be controlled by mobile applications or programmed with software installed on computers. Other robots communicate through cloud-based services to receive updates and software applications. If the communication channels between these different components are insecure and encrypted, attackers can launch man-in-the-middle attacks and insert malicious software commands or updates executed by robots. Safety features are subject to man-in-the-middle or interface-manipulation attacks. For example, an attacker can cause a denial of service (DoS) by forcefully stopping the robot during normal operation. In this context, an attacker can disable safety features, thus preventing legitimate users from activating necessary procedures in an emergency. This attack may have significant implications for the safety of the operator.
An example of a Man-in-the-Middle attack is Eavesdropping: The attacker creates independent connections with the victims and re-transmits messages to make them believe they are communicating directly over a private connection. In reality, the attacker controls the entire conversation and can intercept all the important messages exchanged between the two victims and inject new ones. In many circumstances, this is a simple attack to perform. For example, an attacker can assume the role of a network observer to eavesdrop on packets between a surgeon and a robot. Thus, an attacker can inject new, malicious packets into the network to impact the surgical procedure. Researchers propose a decentralized multi-authority anonymous authentication scheme to avoid the authentication problems; when an entity wants to prove the possession of the attribute credentials to a verifier, it generates proof of the credentials in a zero-knowledge or witness-indistinguishable way.
4. Tampering
A Tampering attack generally involves manipulating parameters exchanged between client and server to modify and compromise application data. Examples of data targeted by this type of attack include user credentials and permissions, etc. There are different types of tampering attacks, such as Tampering with Calibration Parameters, where the attacker attempts to change the calibration to make the robot move unexpectedly or inaccurately. There may be robot damages and safety, integrity, and accuracy issues in this case. Another attack described in this work is Tampering with the Production Logic. In this case, the attacker manipulates the program executed by the robot to maliciously introduce a flaw into the workpiece.
5. Replay attack
A replay attack is performed how a network attack in which a valid data transmission is maliciously repeated or delayed. In particular, the malicious operator intercepts the data among users and re-transmits it (sniffs hash and replays hash); this type of attack is a version of the Man in the middle(MiM), while MiM is in real-time, the Replay attack can be executed asynchronously.
6. Fault Injection attack
Fault Injection is a physical attack on the data and behavior of an Integrated Circuit. Therefore, Fault Injection is a physical attack to bypass secure boot mechanisms, acquire a secret key, disrupt a program counter, etc. It can also be implemented via software and be developed using data injection in the embedded code.
7. Sybil Attack
The Sybil attack is performed to Network Layer (ISO/OSI); in particular, this attack uses multiple false identities to deny the information passing procedure. It can damage the distance-based/location-based routing protocol.
8. Jamming Attack
The Jamming attack is a type of DoS attack on the wireless network. This attack prevents other nodes from communicating by occupying the channel, usually transmitting on the same frequency, and modulation of the signal is prevented. To avoid this problem, different solutions are being studied, including developing detection algorithms. Researchers developed a machine learning-based technique to detect and classify different types of jamming attacks on RF channels, focusing on the importance of classifying the type of attack to implement the necessary countermeasures.
9. HW Backdoor attack
Usually, a backdoor bypasses the authentication procedure or encryption in a PC/System. It can be created directly through the manufacturing process of ICs (integrated circuits); it is activated from an event (trigger) hardware (tun on of component) or software (execute code after the hardware trigger.
10. RAT Attack
The Remote Access Trojan is a malware that permits the malicious user to obtain administrative control over the target device. This attack uses a backdoor to introduce the target system downloaded with a user-requested program or sent as an email attachment. So, from the target device compromised, the malicious user can send RATs toward the other vulnerable devices to create a botnet;
11. Stealthy Attack
The Stealth attack is the type of attack in which the cost and visibility of the attacker have to be minimized. To perform it, a good knowledge of the target system or device; based on the type of target, the stealth attack is composed of different stages of actuation (communication, execution, and propagation).
12. Homing Attack
It’s an attack in which the attacker analyzes the network traffic to identify particular cluster heads or base stations; once done, the attacker can perform the attack toward the critical nodes to compromise or destroy the entire network.
13. Teardrop Attack
This is a DoS attack, in particular, operating on sending mangled IP fragments with overlapping, oversize payloads to the target device. Therefore a server vulnerable is unable to reassemble the packets and is used to compromise the communication between the user and teleoperated device.
14. Hijacking Attack
Hijacking is a type of network security attack in which the attacker takes control of communication. In particular, the attacker first assumes the role of observer to eavesdrop on packets between client and server, after can compromise the session by stealing or predicting a valid session to gain unauthorized access.
