Cybersecurity in robotics demands capabilities beyond what current security technologies offer. When a robot is tasked with delivering a small package to a destination, multiple factors must be considered to ensure safety and stealth. The robot should be capable of landing safely by intelligently detecting the environment. From the recognition of the destination’s entrance to the connection of the system via Universal Serial Bus (USB), the robot must operate stealthily to avoid detection. It should be dexterous enough to avoid obstacles and adaptable in case of damage. Additionally, it must be easy to reconfigure and modify if necessary.
As technology becomes smarter, so do the associated risks. For instance, we now have cars that can park themselves and cell phones that can efficiently detect heart rates. However, these advancements come with a greater likelihood of cyber threats. Smart devices can be compromised, and personal information can be extracted. A survey recently showed that over 69,000 wireless devices have been hacked. This article highlights several case studies illustrating the daily cybersecurity challenges faced by robotics.
Automotive Industry
The automotive industry has seen significant advancements with the development of intelligent cars that are partially or fully automated. These cars come equipped with numerous features such as smart keys, hands-free door locking, digital instrumentation, collision warnings, eco-fuel systems, and automatic signal generation. Major companies like Google, Audi AG, Hyundai, and Toyota are at the forefront of developing these autonomous vehicles. However, the complexity of these distributed systems makes them prime targets for hackers.
These automated machines rely on onboard computers connected through internal wired networks. Sensors in their wheels facilitate wireless communication, which can be exploited by hackers. Researchers have identified two primary areas of attack: short-range wireless networks and long-range cellular networks. A car’s software decodes radio signals, which can be manipulated by hackers. Using reverse engineering tools, hackers can access the internal network, creating variations in the speedometer, disabling brakes, and installing malware to compromise the entire system. They can also remotely spoof objects like people, vehicles, and obstacles.
One notable hacking event in the automotive industry occurred when researchers demonstrated how they could remotely take control of a Jeep Cherokee. By exploiting vulnerabilities in the vehicle’s Uconnect infotainment system, which was connected to the cellular network, the researchers were able to gain access to the car’s internal network. They manipulated various functions, including steering, braking, and transmission, effectively controlling the vehicle from a distance. This high-profile case highlighted the significant cybersecurity risks associated with modern, connected vehicles and prompted recalls and software updates from the manufacturer to address the vulnerabilities.
Stealth Drone Hacked by Iran
On December 4, 2011, the Iranian cyber warfare unit seized an unmanned aerial vehicle, the Lockheed Martin RQ 170, belonging to the United States. It is believed that the drone’s GPS coordinates were compromised and manipulated. Alternatively, electronic warfare experts may have interrupted the communication link by overwhelming it. The primary cause of this drone hacking was the leakage of encrypted signals, allowing fake GPS coordinates to be fed into the system. The compromised system forced the drone to land at a manipulated location. As these drones rely on satellite signals to confirm positions, a compromised system can lead to spoofed signals being used to perform breaches.
Medical-Surgical Robots
The Raven II is an advanced teleoperated robot used in medical surgeries, responding to inputs from surgeons. These robots rely on available networks, including ad hoc wireless and satellite networks, to transmit sensitive information such as video, audio, and other sensory data between surgeons and robots. Despite significant contributions to the medical field, this technology poses various cybersecurity risks due to its open and uncontrolled communication systems.
Researchers at the University of Washington in Seattle demonstrated multiple ways the Raven II could be disrupted by malicious attackers. The robot uses open standard software, Linux, the Robot Operating System, and the Interoperable Telesurgery Protocol, all of which are susceptible to cyber attacks. The public networks used by these robots make them vulnerable to intruders who can overwhelm and disrupt sensitive communications.
The researchers carried out three types of attacks:
- Command Manipulation: They altered commands sent to the robot, resulting in jerky movements and loss of control.
- Signal Modification: They changed the signal intensity, causing the robot to perform actions with varying intensities.
- Complete Hijacking: They took full control of the robot, leading to Denial-of-Service (DoS) attacks that prevented the robot from resetting.
Cybersecurity Attack Types in Robotics
Cyber attacks on robots generally fall into two categories: endpoint compromises and network communication-based attacks. Endpoint compromises render controllers unable to control the robot, while network communication-based attacks allow attackers to eavesdrop or inject malicious code. The feasibility of network communication-based attacks is higher due to the greater physical access to the network.
- Intention Modification Attacks: These attacks alter the robot’s actions by modifying message packets in transit, leading to Denial-of-Service (DoS) attacks that can halt or cause erratic movements in the robot.
- Intention Manipulation Attacks: These attacks reconstruct messages from robots to controllers, manipulating feedback and leading to unfavorable consequences.
- Hijacking Attacks: In these attacks, an adversary takes control of the communication between the controller and the robot, executing unethical actions and potentially causing permanent damage.
Vulnerabilities and Mitigation Strategies
Robots face several vulnerabilities, including remote identification and discovery, passive and active eavesdropping, and operational notifications. To mitigate these risks, several strategies have been proposed:
- Communication Robustness: Implementing encryption and authentication mechanisms over communication channels can reduce insecurities.
- Data Distribution Service (DDS) in ROS: Integrating DDS as a transport layer ensures authentication, access control, and cryptography.
- Authentication Mechanism in YARP: Introducing key exchange and port monitoring can enhance data security.
- Securing the Cloud: As cloud robotics rely on cloud storage, ensuring robust security measures for cloud infrastructure is crucial.
- Communication Buses: Utilizing Ethernet-based communication buses with TCP/UDP/IP features can improve secure communication.
By adopting these measures, the risks associated with cyber attacks on robotics can be significantly reduced, ensuring safer and more reliable robotic systems.
