Breaking the Laws of Robotics Attacking Industrial Robots Davide - - PowerPoint PPT Presentation

▶
breaking the laws of robotics
SMART_READER_LITE
LIVE PREVIEW

Breaking the Laws of Robotics Attacking Industrial Robots Davide - - PowerPoint PPT Presentation

Dec 31, 2023 192 likes •1.03k views

Breaking the Laws of Robotics Attacking Industrial Robots Davide Quarta , Marcello Pogliani , Mario Polino, Federico Maggi , Andrea M. Zanchettin, Stefano Zanero Industrial robots? Industrial Robot Architecture (Standards) Controller Flexibly

slide-1
SLIDE 1

Breaking the Laws of Robotics

Attacking Industrial Robots

Davide Quarta, Marcello Pogliani, Mario Polino, Federico Maggi, Andrea M. Zanchettin, Stefano Zanero

slide-2
SLIDE 2

Industrial robots?

slide-3
SLIDE 3

Industrial Robot Architecture (Standards)

Controller

slide-4
SLIDE 4
slide-5
SLIDE 5

Flexibly programmable

& Connected

slide-6
SLIDE 6

Screenshot of teach pendant + formatted code snippet on the side

slide-7
SLIDE 7

“Implicit” parameters

slide-8
SLIDE 8

“Implicit” parameters

slide-9
SLIDE 9

Flexibly programmable &

Connected

(Part 1)

slide-10
SLIDE 10

They are already meant to be connected

slide-11
SLIDE 11

Attack surface

USB port LAN Radio

Services: Well-known (FTP) + custom (RobAPI)

slide-12
SLIDE 12

Connected Robots: Why?

  • Now: monitoring & maintenance ISO 10218-2:2011
  • Near future: active production planning and control

○ some vendors expose REST-like APIs ○ … up to the use of mobile devices for commands

  • Future: app/library stores

○ “Industrial” version of robotappstore.com?

slide-13
SLIDE 13

Connected?

Do you consider

cyber attacks

against robots a

realistic threat?

slide-14
SLIDE 14

Do you consider

cyber attacks

against robots a

realistic threat?

slide-15
SLIDE 15

What

consequences

do you foresee?

slide-16
SLIDE 16

What are the most

valuable assets at risk?

slide-17
SLIDE 17

impact is much more

important than the

vulnerabilities alone.

slide-18
SLIDE 18

How do we assess the impact

  • f an attack against

industrial robots?

slide-19
SLIDE 19

We assess impact by reasoning on

requirements

slide-20
SLIDE 20

Requirements: "Laws of Robotics"

Safety Accuracy Integrity

slide-21
SLIDE 21

Requirements: "Laws of Robotics"

Safety Accuracy Integrity

Acknowledgements T.U. Munich, YouTube -- Dart Throwing with a Robotic Manipulator

slide-22
SLIDE 22

Requirements: "Laws of Robotics"

Safety Accuracy Integrity

slide-23
SLIDE 23

violating any of these requirements via a digital vector

Robot-Specific Attack

Safety Accuracy Integrity

slide-24
SLIDE 24

Control Loop Alteration

Safety Integrity Attack 1 Accuracy

slide-25
SLIDE 25

Control Loop Alteration

Safety Integrity Attack 1 Accuracy

slide-26
SLIDE 26

Control Loop Alteration

Safety Integrity Attack 1 Accuracy

slide-27
SLIDE 27
slide-28
SLIDE 28

Calibration Tampering

Safety Accuracy Integrity Attack 2

slide-29
SLIDE 29

Calibration Tampering

Safety Accuracy Integrity Attack 2

slide-30
SLIDE 30

Production Logic Tampering

Safety Accuracy Integrity Attack 3

slide-31
SLIDE 31

Production Logic Tampering

Safety Accuracy Integrity Attack 3

slide-32
SLIDE 32

Displayed or Actual State Alteration

Safety Accuracy Integrity Attacks 4+5

slide-33
SLIDE 33

Displayed or Actual State Alteration

Safety Accuracy Integrity Attacks 4+5

slide-34
SLIDE 34

Malicious DLL

Displayed State Alteration PoC

Teach Pendant

slide-35
SLIDE 35

Displayed State Alteration PoC

Teach Pendant Malicious DLL

slide-36
SLIDE 36

Is the Teach Pendant part of the safety system?

slide-37
SLIDE 37

Is the Teach Pendant part of the safety system? NO

slide-38
SLIDE 38

Are the

standard safety measures too limiting?

slide-39
SLIDE 39

Do you

"customize"

the safety measures in your deployment?

slide-40
SLIDE 40

Standards & Regulations vs. Real World

slide-41
SLIDE 41

...so far, we assumed the attacker has already compromised the controller...

slide-42
SLIDE 42

… let’s compromise the controller!

slide-43
SLIDE 43

Attack surface

USB port LAN Radio

Services: Well-known (FTP) + custom (RobAPI)

slide-44
SLIDE 44

VxWorks 5.x RTOS (x86) VxWorks 5.x RTOS (PPC) Windows CE (ARM) .NET >=3.5 FTP, RobAPI, ...

slide-45
SLIDE 45

User Authorization System

User ∈ roles → grants Authentication: username + password Used for FTP, RobAPI, …

slide-46
SLIDE 46

User Authorization System

slide-47
SLIDE 47

User Authorization System

tl;dr; read deployment guidelines & deactivate the default user

slide-48
SLIDE 48

Update problems

FlexPendant Axis Computer Microcontrollers

slide-49
SLIDE 49

Update problems

FlexPendant Axis Computer Microcontrollers

How? FTP at boot .... plus, no code signing, nothing

slide-50
SLIDE 50

Update problems

FlexPendant Axis Computer Microcontrollers

FTP? Credentials? Any credential is OK during boot!

ABBVU-DMRO-124644

slide-51
SLIDE 51

Autoconfiguration is magic!

slide-52
SLIDE 52

Autoconfiguration is magic!

ABBVU-DMRO-124642

slide-53
SLIDE 53

FTP RETR /command/whatever read system info FTP STOR /command/command execute “commands”

Enter /command

ABBVU-DMRO-124642

slide-54
SLIDE 54

FTP RETR /command/whatever read system info FTP STOR /command/command execute “commands”

Enter /command

ABBVU-DMRO-124642

slide-55
SLIDE 55

FTP GET /command/whatever read, e.g., env. vars FTP PUT /command/command execute “commands” shell reboot shell uas_disable + hard-coded credentials? → remote command execution

Enter /command

ABBVU-DMRO-124642

slide-56
SLIDE 56

Let’s look at cmddev_execute_command: shell → sprintf(buf, "%s", param)

  • ther commands → sprintf(buf, "cmddev_%s", arg)
  • verflow buf (on the stack) → remote code execution

Enter /command

ABBVU-DMRO-128238

slide-57
SLIDE 57
  • Ex. 1: RobAPI
  • Unauthenticated API endpoint
  • Unsanitized strcpy()

→ remote code execution

  • Ex. 2: Flex Pendant (TpsStart.exe)
  • FTP write /command/timestampAAAAAAA…..AAAAAAA
  • file name > 512 bytes ~> Flex Pendant DoS

Other buffer overflows

ABBVU-DMRO-124641, ABBVU-DMRO-124645

slide-58
SLIDE 58

Takeaways Some memory corruption Mostly logical vulnerabilities All the components blindly trust the main computer (lack of isolation)

slide-59
SLIDE 59

Complete attack chain (1)

slide-60
SLIDE 60

Complete attack chain (2)

slide-61
SLIDE 61

Complete attack chain (3)

slide-62
SLIDE 62

“Sensitive” files:

  • Users’ credentials and permissions
  • Sensitive configuration parameters (e.g., PID)
  • Industry secrets (e.g., workpiece parameters)

File protection

slide-63
SLIDE 63

“Sensitive” files:

  • Users’ credentials and permissions
  • Sensitive configuration parameters (e.g., PID)
  • Industry secrets (e.g., workpiece parameters)

Obfuscation: bitwise XOR with a “random” key. Key is derived from the file name. Or from the content. Or …

File protection

slide-64
SLIDE 64

That’s how we implemented the attacks

slide-65
SLIDE 65

Attack Surface

?

slide-66
SLIDE 66

Flexibly programmable &

Connected

(Part 2)

slide-67
SLIDE 67
slide-68
SLIDE 68

Ethernet Wireless

slide-69
SLIDE 69

WAN

slide-70
SLIDE 70

Not so many...

(yesterday I've just found 10 more)

Remote Exposure of Industrial Robots

Search Entries Country ABB Robotics 5 DK, SE FANUC FTP 9 US, KR, FR, TW Yaskawa 9 CA, JP Kawasaki E Controller 4 DE Mitsubishi FTP 1 ID Overall 28 10

slide-71
SLIDE 71

Remote Exposure of Industrial Routers

...way many more!

Unknown which routers are actually robot-connected

slide-72
SLIDE 72

Typical Issues

Trivially "Fingerprintable"

  • Verbose banners (beyond brand or model name)
  • Detailed technical material on vendor’s website

○ Technical manual: All vendors inspected ○ Firmware: 7/12 vendors

slide-73
SLIDE 73

Typical Issues (1)

Outdated Software Components

  • Application software (e.g., DropBear SSH, BusyBox)
  • Libraries (including crypto libraries)
  • Compiler & kernel
  • Baseband firmware
slide-74
SLIDE 74

Typical Issues (2)

Insecure Web Interface

  • Poor input sanitization
  • E.g., code coming straight from a "beginners" blog

Cut & paste

slide-75
SLIDE 75

Bottom line Connect your robots with care

(follow security best practices & your robot vendor’s guidance)

slide-76
SLIDE 76

Conclusions

slide-77
SLIDE 77

Robots are increasingly being connected Industrial robot-specific class of attacks Barrier to entry: quite high, budget-wise Black Hat Sound Bytes

slide-78
SLIDE 78

Vendors are very responsive As a community we really need to push hard for countermeasures What should we do now?

slide-79
SLIDE 79

Hints on Countermeasures

Short term Attack detection and deployment hardening Medium term System hardening Long term New standards, beyond safety issues

slide-80
SLIDE 80

Davide Quarta

davide.quarta@polimi.it @_ocean

Federico Maggi

federico_maggi@trendmicro.com @phretor

Marcello Pogliani

marcello.pogliani@polimi.it @mapogli

Papers, slides, and FAQ http://robosec.org — http://bit.ly/2qy29oq

Questions?

slide-81
SLIDE 81

Questions?

slide-82
SLIDE 82

Breaking the Laws of Robotics

Attacking Industrial Robots

Davide Quarta, Marcello Pogliani, Mario Polino, Federico Maggi, Andrea M. Zanchettin, Stefano Zanero