Breaking the Laws Of Robotics @TR18 Davide Quarta @_ocean - - PowerPoint PPT Presentation

▶
breaking the laws of robotics tr18
SMART_READER_LITE
LIVE PREVIEW

Breaking the Laws Of Robotics @TR18 Davide Quarta @_ocean - - PowerPoint PPT Presentation

Apr 25, 2023 238 likes •1.12k views

Breaking the Laws Of Robotics @TR18 Davide Quarta @_ocean Marcello Pogliani @mapogli Mario Polino @jinblackx Federico Maggi @phretor Stefano Zanero @raistolo https://mg-iii.deviantart.com/art/I-Robot-54308587 8 Industrial robots?

slide-1
SLIDE 1

Breaking the Laws Of Robotics @TR18

Davide Quarta @_ocean Marcello Pogliani @mapogli Mario Polino @jinblackx Federico Maggi @phretor Stefano Zanero @raistolo

https://mg-iii.deviantart.com/art/I-Robot-54308587 8

slide-2
SLIDE 2

Industrial robots?

slide-3
SLIDE 3

Industrial Robot Architecture (Standards)

Controller

slide-4
SLIDE 4
slide-5
SLIDE 5

Flexibly programmable

& Connected

slide-6
SLIDE 6

Screenshot of teach pendant + formatted code snippet on the side

slide-7
SLIDE 7

“Implicit” parameters

slide-8
SLIDE 8

“Implicit” parameters

slide-9
SLIDE 9

Flexibly programmable &

Connected

(Part 1)

slide-10
SLIDE 10

They are already meant to be connected

slide-11
SLIDE 11

Attack surface

USB port LAN Radio

Services: Well-known (FTP) + custom (RobAPI)

slide-12
SLIDE 12

Connected Robots: Why?

  • Now:

○ Monitoring ○ maintenance ISO 10218-2:2011

slide-13
SLIDE 13
  • Near future: active production planning

and control ○ some vendors expose REST-like APIs ○ … up to the use of mobile devices for commands

Connected Robots: Why?

slide-14
SLIDE 14
  • Future: app/library stores

○ Robotappstore.com (consumer) ○ https://www.universal-robots.com/plus/ ○ https://www.myokuma.com ○ https://robotapps.robotstudio.com

Connected Robots: Why?

slide-15
SLIDE 15

Connected?

Do you consider

cyber attacks

against robots a

realistic threat?

slide-16
SLIDE 16

Do you consider

cyber attacks

against robots a

realistic threat?

slide-17
SLIDE 17

What

consequences

do you foresee?

slide-18
SLIDE 18

What are the most

valuable assets at risk?

slide-19
SLIDE 19

impact is much more important

than the vulnerabilities alone.

slide-20
SLIDE 20

How do we assess the impact

  • f an attack against

industrial robots?

slide-21
SLIDE 21

Reason on

requirements

slide-22
SLIDE 22

Requirements: "Laws of Robotics"

Safety Accuracy Integrity

slide-23
SLIDE 23

Requirements: "Laws of Robotics"

Safety Accuracy Integrity

Acknowledgements T.U. Munich, YouTube -- Dart Throwing with a Robotic Manipulator

slide-24
SLIDE 24

Requirements: "Laws of Robotics"

Safety Accuracy Integrity

slide-25
SLIDE 25

violating any of these requirements via a digital vector

Robot-Specific Attack

Safety Accuracy Integrity

slide-26
SLIDE 26

Control Loop Alteration

Safety Integrity Attack 1 Accuracy

slide-27
SLIDE 27

Control Loop Alteration

Safety Integrity Attack 1 Accuracy

slide-28
SLIDE 28

Control Loop Alteration

Safety Integrity Attack 1 Accuracy

slide-29
SLIDE 29
slide-30
SLIDE 30

Calibration Tampering

Safety Accuracy Integrity Attack 2

slide-31
SLIDE 31

Calibration Tampering

Safety Accuracy Integrity Attack 2

slide-32
SLIDE 32

Production Logic Tampering

Safety Accuracy Integrity Attack 3

slide-33
SLIDE 33

Production Logic Tampering

Safety Accuracy Integrity Attack 3

slide-34
SLIDE 34

Displayed or Actual State Alteration

Safety Accuracy Integrity Attacks 4+5

slide-35
SLIDE 35

Displayed or Actual State Alteration

Safety Accuracy Integrity Attacks 4+5

slide-36
SLIDE 36

Malicious DLL

Displayed State Alteration PoC

Teach Pendant

slide-37
SLIDE 37

Displayed State Alteration PoC

Teach Pendant Malicious DLL

slide-38
SLIDE 38

Is the Teach Pendant part of the safety system?

slide-39
SLIDE 39

Is the Teach Pendant part of the safety system? NO

slide-40
SLIDE 40

Are the

standard safety measures too limiting?

slide-41
SLIDE 41

Do you

"customize"

the safety measures in your deployment?

slide-42
SLIDE 42

Standards & Regulations vs. Real World

slide-43
SLIDE 43

...so far, we assumed the attacker has already compromised the controller...

slide-44
SLIDE 44

… let’s compromise the controller!

slide-45
SLIDE 45

Attack surface

USB port LAN Radio

Services: Well-known (FTP) + custom (RobAPI)

slide-46
SLIDE 46

VxWorks 5.x RTOS (x86) VxWorks 5.x RTOS (PPC) Windows CE (ARM) .NET >=3.5 FTP, RobAPI, ...

slide-47
SLIDE 47

User Authorization System

User ∈ roles → grants Authentication: username + password Used for FTP, RobAPI, …

slide-48
SLIDE 48

User Authorization System

slide-49
SLIDE 49

User Authorization System

tl;dr; read deployment guidelines & deactivate the default user

slide-50
SLIDE 50

Update problems

FlexPendant Axis Computer Microcontrollers

slide-51
SLIDE 51

Update problems

FlexPendant Axis Computer Microcontrollers

How? FTP at boot .... plus, no code signing, nothing

slide-52
SLIDE 52

Update problems

FlexPendant Axis Computer Microcontrollers

FTP? Credentials? Any credential is OK during boot!

ABBVU-DMRO-124644

slide-53
SLIDE 53

Autoconfiguration is magic!

slide-54
SLIDE 54

Autoconfiguration is magic!

ABBVU-DMRO-124642

slide-55
SLIDE 55

FTP RETR /command/[anything] read system info FTP STOR /command/<command> execute “commands”

Enter /command

ABBVU-DMRO-124642

slide-56
SLIDE 56

FTP RETR /command/[anything] read system info FTP STOR /command/<command> execute “commands”

Enter /command

ABBVU-DMRO-124642

slide-57
SLIDE 57

FTP GET /command/[anything] read, e.g., env. vars FTP PUT /command/<command> execute “commands” shell reboot shell uas_disable + hard-coded credentials? → remote command execution

Enter /command

ABBVU-DMRO-124642

slide-58
SLIDE 58

Let’s look at cmddev_execute_command: shell → sprintf(buf, "%s", param)

  • ther commands → sprintf(buf, "cmddev_%s",

arg)

  • verflow buf (on the stack) → remote code execution

Enter /command

ABBVU-DMRO-128238

slide-59
SLIDE 59
  • Ex. 1: RobAPI
  • Unauthenticated API endpoint
  • Unsanitized strcpy()

→ remote code execution

  • Ex. 2: Flex Pendant (TpsStart.exe)
  • FTP write /command/timestampAAAAAAA…..AAAAAAA
  • file name > 512 bytes ~> Flex Pendant DoS

Other buffer overflows

ABBVU-DMRO-124641, ABBVU-DMRO-124645

slide-60
SLIDE 60

Takeaways Some memory corruption Mostly logical vulnerabilities All the components blindly trust the main computer (lack of isolation)

slide-61
SLIDE 61

Complete attack chain (1)

slide-62
SLIDE 62

Complete attack chain (2)

slide-63
SLIDE 63

Complete attack chain (3)

slide-64
SLIDE 64

“Sensitive” files:

  • Users’ credentials and permissions
  • Sensitive configuration parameters (e.g., PID)
  • Industry secrets (e.g., workpiece parameters)

File protection

slide-65
SLIDE 65

“Sensitive” files:

  • Users’ credentials and permissions
  • Sensitive configuration parameters (e.g., PID)
  • Industry secrets (e.g., workpiece parameters)

Obfuscation: bitwise XOR with a “random” key. Key is derived from the file name. Or from the

  • content. Or …

File protection

slide-66
SLIDE 66

That’s how we implemented the attacks

slide-67
SLIDE 67

Attack Surface

?

slide-68
SLIDE 68

Flexibly programmable &

Connected

(Part 2)

slide-69
SLIDE 69
slide-70
SLIDE 70

Ethernet Wireless

slide-71
SLIDE 71

WAN

slide-72
SLIDE 72

Not so many...

(yesterday I've just found 10 more)

Remote Exposure of Industrial Robots

Search Entries Country ABB Robotics 5 DK, SE FANUC FTP 9 US, KR, FR, TW Yaskawa 9 CA, JP Kawasaki E Controller 4 DE Mitsubishi FTP 1 ID Overall 28 10

slide-73
SLIDE 73

Remote Exposure of Industrial Routers

...way many more!

Unknown which routers are actually robot-connected

slide-74
SLIDE 74

Typical Issues

Trivially "Fingerprintable"

  • Verbose banners (beyond brand or model name)
  • Detailed technical material on vendor’s website

○ Technical manual: All vendors inspected ○ Firmware: 7/12 vendors

slide-75
SLIDE 75

Typical Issues (1)

Outdated Software Components

  • Application software (e.g., DropBear SSH,

BusyBox)

  • Libraries (including crypto libraries)
  • Compiler & kernel
  • Baseband firmware
slide-76
SLIDE 76

Typical Issues (2)

Insecure Web Interface

  • Poor input sanitization
  • E.g., code coming straight from a "beginners" blog

Cut & paste

slide-77
SLIDE 77

Bottom line Connect your robots with care

(follow security best practices & your robot vendor’s guidance)

slide-78
SLIDE 78

Robots are increasingly being connected Industrial robot-specific class of attacks Barrier to entry: quite high, budget-wise Black Hat Sound Bytes

slide-79
SLIDE 79

Hints on Countermeasures

Short term Attack detection and deployment hardening Medium term System hardening Long term New standards, beyond safety issues

slide-80
SLIDE 80

What About Now?

slide-81
SLIDE 81

Collaborative Robots

slide-82
SLIDE 82
  • Disclaimer:

disclosing with ICS-CERT, > 90 days elapsed

  • What’s new?
  • Death-by-text-editor
  • Autorun is back from the grave!
  • DSLRF (a.k.a. SSRF on robots)

More vulnerabilities

slide-83
SLIDE 83

New incidents

slide-84
SLIDE 84

Conclusions

slide-85
SLIDE 85

Davide Quarta

davide.quarta@polimi.it @_ocean

Papers, slides, and FAQ http://robosec.org — http://bit.ly/2qy29oq

Questions?

slide-86
SLIDE 86

Questions?