robot_hacking_manual - Robot Hacking Manual (RHM). From robotics to cyber

项目说明

RHM: Robot Hacking Manual

<ins>Download in PDF RHM v0.5<ins> ┃ <span style="background-color: #FFFF00">Read online</span> | Research note | v0.4 archival note | <span style="background-color: #FFFF00">Robot hacks</span>

The *Robot Hacking Manual* (RHM) is an introductory series about cybersecurity for robots, with an attempt to provide comprehensive case studies and step-by-step tutorials with the intent to raise awareness in the field and highlight the importance of taking a *security-first*[^0] approach. The material a here is also a personal learning attempt and it's disconnected from any particular organization. Content is provided as is and by no means I encourage or promote the unauthorized tampering of robotic systems or related technologies.

Cite this work:

Disclaimer

History

Moti

A containerized approach

Contribute back

Cite this work

Introduction

- About robot cybersecurity
- Robot hacks

<ins>Case studies</ins>

- Uni Robots' UR3 (hacking a collaborati arm)
- Mobile Industrial Robots' MiR100 (hacking an industrial mobile robot)
- Robot Operating System (hacking ROS 1)
- Robot Operating System 2 (hacking ROS 2)
- TurtleBot 3 (hacking TurtleBot 3)
- PX4 autopilot

[Writeups]()

- <ins>Reconaissance</ins>
- Footprinting
- Tutorial 1: Footprinting ROS systems
- Tutorial 2: Footprinting Secure ROS systems
- Tutorial 3: Footprinting ROS 2 and DDS systems
- <ins> research</ins>
- Static analysis
- Tutorial 5: Static analysis of PyRobot
- Dynamic analysis
- Tutorial 1: Robot sanitizers in ROS 2 Dashing
- Tutorial 2: Robot sanitizers in MoveIt 2
- Tutorial 3: Debugging output of robot sanitizers with GDB, hunting and fixing bugs
- ~~Tutorial 4: Robot sanitizers with Gazebo~~
- Tutorial 5: Static analysis of PyRobot
- Tutorial 6: Looking for in ROS 2
- Tutorial 7: Analyzing Turtlebot 3
- Tutorial 8: SROS and SROS 2, exploring
- Tutorial 9: Looking at DDS middleware flaws
- <ins>Exploitation</ins>
- General
- Tutorial 1: Buffer o
- Tutorial 2: Building shellcode
- Tutorial 3: Exploiting
- Tutorial 4: Return to libc
- Tutorial 5: Return-Oriented Programming (ROP)
- Tutorial 6: Remote shell
- Tutorial 7: pwntools - CTF toolkit
- Tutorial 8: Linux Binary Protections (external)
- Tutorial 9: Building a pwnbox
- Tutorial 10: Bypassing NX with Return Oriented Programming (WIP, unfinished)
- Robotics-specific
- Tutorial 11: Unauthenticated registration/unregistration with ROS Master API
- Tutorial 12: Unauthenticated updates in publisher list for specified topic
- Tutorial 13: Sockets left open and in CLOSE_WAIT state in ROS
- <ins>Forensics</ins>
- Tutorial 1: Basic robot forensics, an unauthenticated unregistration in ROS
- Tutorial 2: Locating ROS logs in memory (failed)
- Tutorial 3: Capturing memory in Linux-based robots
- Tutorial 4: Basic robot forensics 2, unauthenticated updates in publisher list for specified topic (unfinished)
- <ins>Hardening</ins>
- Tutorial 1: A study of container technologies

Talks:

- <ins>2016</ins>
- Securing ROS over the wire, in the graph, and through the kernel, ROSCon 2016
- <ins>2017</ins>
- Hacking Robots Before Skynet, Ekoparty Security Conference 2017
- An Experimental Security Analysis of an Industrial Robot Controller, IEEE Symposium on Security and Privacy 2017
- SROS: Current Progress and De, ROSCon 2017
- Breaking the Laws of Robotics: Attacking Industrial Robots, Black Hat USA 2017
- <ins>2018</ins>
- Introducing the Robot Security Framework (spanish), Navaja Negra Conference 2018
- Arm DDS Security library: Adding secure security to ROS2, ROSCon 2018
- Le DDS Security in ROS 2, ROSCon 2018
- <ins>2019</ins>
- Defensive and offensi security, ROS-Industrial Conference 2019
- Black Block Recorder: Immutable Black Box Logging and DLTs, ROSCon 2019
- *Lessons learned on real-time and security* (slides, research note), ROS 2 Real-Time Workshop, ROSCon 2019
- <ins>2020</ins>
- Current security threat landscape in robotics, European Robotics Forum (ERF) 2020
- Security in ROS & ROS 2 robot setups, European Robotics Forum (ERF) 2020
- Akerbeltz, industrial robot ransomware, International Workshop on Engineering Resilient Robot Software Systems, International Conference on Robotic Computing (IRC 2020).
- Zero Trust Architecture in Robotics, Workshop on Security and Privacy in Robotics, ICRA 2020
- The cybersecurity status of PX4, PX4 De Summit 2020
- Detecting Insecure Code Patterns in Industrial Robot Programs, Proceedings of the 15th ACM Asia Conference on Computer and Communications Security 2020
- Protecting robot endpoints against cyber-threats, ROS-Industrial Conference 2020
- Robots and Privacy, Shmoocon 2020
- <ins>2021</ins>
- Unco Planned Obsolescence Practices in Robotics and What This Means for Cybersecurity, BlackHat USA 2021
- The Data Distribution Service (DDS) Protocol is Critical: Let's Use it Securely!, BlackHat Europe 2021
- Breaking ROS 2 security assumptions: Targeting the top 6 DDS implementations, ROS-Industrial Conference 2021
- DDS and ROS 2 cybersecurity, ROS 2 Security Working Group
- <ins>2022</ins>
- A Deep Dive Into The DDS Protocol (*to appear*), S4x22 Security Conference

Robot hacks

A non-exhaustive list of cybersecurity research in robotics containing related robot and attacks due to cybersecurity issues.

| 👹 Codename/theme | 🤖 Robotics technology affected | 👨‍🔬 Researchers | 📖 Description | 📅 Date |
|-----|-------|-------------|-------------|------|
| | Reverse engineering and hacking Ecovacs robots (slides), video), news article)) | Dennis Giese, Braelynn | and security risks of Ecovacs smart home robots, highlighting serious flaws such as broken encryption, missing certificate , inadequate access control, and unauthorized li access. Building on years of experience hacking devices from brands like Roborock and Xiaomi, the presenters dive into the alarming security issues within Ecovacs robots, the market leader in home robotics. The talk covers the difficulties of reporting bugs to the company and warns against relying on third-party certifications. It emphasizes the importance of being cautious with device choices and e relationships, due to the potential privacy risks in. | 24-08-2024 |
| | iRobot’s Roomba J7 series robot | N/A | Personal pictures in a home en were found in the Internet taken by an iRobot’s Roomba J7 series robot . The photos vary in type and in sensitivity. The most intimate image we saw was the series of video stills featuring the young woman on the toilet, her face blocked in the lead image but unobscured in the grainy scroll of shots below. In another image, a boy who appears to be eight or nine years old, and whose face is clearly , is sprawled on his stomach across a hallway floor. A triangular flop of hair spills across his forehead as he stares, with apparent amusement, at the object recording him from just below eye level. other home pictures that tag objects in the en were found. | 19-19-2022 |
| | Unitree's Go1 | d0tslash (MA in GitHub) | A hacker found a kill switch for a gun–wielding legged robot[^19][^20][^21][^22]. The hack itself le a kill switch functionality/technology that ships in all units of the robot and that listens for a particular signal at 433Mhz. When it hears the signal, the robot shuts down. d0tslash used a portable multi-tool for pentesters (Flipper Zero) to emulate the shutdown, copying the signal the robot dog’s remote broadcasts over the 433MHz frequency. | 09-08-2022 |
| | Enabot's Ebo Air | Modux[^1] | Researchers from Modux found a security *flaw* in Enabot Ebo Air #robot and responsibly disclosed their findings. Attack could lead to remote-controlled *robot* spy units. Major entry point appears to be a hardcoded system administrator password that is weak and shared across all of these robots. Researchers also found information disclosure issues that could lead attackers to exfiltrate home (e.g. home WiFi password) that could then be used to pivot into other devices through local network. | 21-07-2022 |
| <ins>Analyzing the Data Distribution Service (DDS) Protocol for Critical Industries</ins>[^6] | ROS 2, eProsima's Fast-DDS, OCI's OpenDDS, ADLINK's (*now ZettaScale's*) CycloneDDS, RTI's ConnextDDS, Gurum Networks's GurumDDS and Twin Oaks Computing's CoreDX DDS | Ta-Lun Yen, Federico Maggi, Víctor Mayoral-, Erik Boasson *et al.* ()[^6] | This research looked at the OMG Data Distribution Service (DDS) standards and its implementations from a security angle. 12 CVE IDs were discovered 🆘, 1 specification-le identified 💻, and 6 DDS implementations were analyzed (3 open source, 3 proprietary). Results hinted that DDS's security mechanisms were not secure and much effort on this side was required to protect sensiti and military systems powered by this communication middleware. The research group detected that these security issues were present in almost 650 different devices exposed on the Internet, across 34 countries and affecting 100 organizations through 89 Internet Service Pro (ISPs). | 19-04-2022 |
| <ins>Hacking ROS 2, the Robot Operating System</ins>[^16] | ROS 2 | Víctor Mayoral- *et al.* ()[^16][^17] | A team of security researchers led by the spanish firm Alias Robotics on their robotics focus discovered security that led to compromising the Robot Operating System 2 (ROS 2) through its underlying communication middleware (the DDS communications middleware). Researchers demonstrated how to dissect ROS 2 communications and perform ROS 2 reconnaissance, ROS 2 network denial of service through reflection attacks, and ROS 2 (Node) crashing by exploiting memory o which could lead to remote execution of arbitrary code. To mitigate these security , Alias Robotics contributed to open source tools including to SROS2[^17] with a series of de tool extensions that help detect some of these insecurities in ROS 2 and DDS. ROS 2 *community-owner* Open Robotics did not follow up with these results or contributions and disregarded o its relevance, pushing security responsibility aside[^18]| 22-04-2022 |
| <ins>JekyllBot:5</ins>[^7] | Aethon TUG smart robots () | Cynerio[^7] | JekyllBot:5 is a collection of fi zero-day that enable remote control of Aethon TUG smart autonomous mobile robots and their online console, devices that are increasingly used for deli in global hospitals. More tech details about security findings at [^8]. | 01-04-2022 |
| <ins>Robot Teardown, stripping industrial robots for good</ins>[^5] | Uni Robots' UR3, UR5, UR10, UR3e, UR5e, UR10e and UR16e | Víctor Mayoral- *et al.* ()[^15]| This research led by Alias Robotics introduced and ad for robot teardown as an approach to study robot hardware architectures and fuel security research. Security researchers showed how teardown can help understanding the underlying hardware for unco security . The group showed how robot teardown helped uncover more than 100 security flaws with 17 new CVE IDs granted over a period of two years. The group also demonstrated how robot manufacturers are employing planned obsolescense practices and how through teardown, planned obsolescence hardware limitations can be identified and bypassed obtaining full control of the hardware and giving it back to users, which poses both an opportunity to claim the *right to repair* as well as a threat to robot manufacturers’ business models | 20-07-2021|
| <ins>Rogue Automation</ins>[^5] | (* robotic programming languages/frameworks*) ABB's Rapid, Comau's PDL2, Denso's PacScript, Fanuc's Karel, Kawasaki's AS, Kuka's KRL, Mitsubishi's Melfa, and Uni Robots's URScript| Federico Maggi, Marcello Pogliani ()[^5]| This research unveils hidden risks of industrial automation programming languages and frameworks used in robots from ABB, Comau, Denso, Fanuc, Kawasaki, Kuka, Mitsubishi, and Uni Robots. The security analysis performed in here reveals critical flaws across these technologies and their repercussions for smart factories.| 01-08-2020|
| <ins>Securing disinfection robots in times of CO</ins>[^12][^13] | U' U® Model B, U® Model A | Víctor Mayoral- *et al.* (Alias Robotics)[^12][^13] | The robots used in many medical centres to fight against CO for disinfection tasks were found to pre reported (see [^11]) while using Ultra (U, which can affect humans causing suntan, sunburn or even a reportedly increased risk of skin cancer, among others. The team at Alias Robotics confirmed experimentally these issues and found many of these robots insecure, with many unpatched security flaws and easily accessible in public spaces. This led them to develop mitigations for these outstanding security flaws and offered free licenses[^13] for such patches to hospitals and industry during the pandemic | 19-09-2020 |
| <ins>The week of Mobile Industrial Robots' bugs</ins>[^11] | Mobile Industrial Robots' MiR100, MiR200, MiR250, MiR500, MiR600, MiR1000, MiR1350, Easy Robotics' ER200, Enabled Robotics' ER-FLEX, ER-LITE, ER-ONE, U' U® Model B, U® Model A | Víctor Mayoral- *et al.* (Alias Robotics)[^10] | Having identified relevant preliminary security issues, after months of failed interactions with Mobile Industrial Robots’ (MiR) robot manufacturer while trying to help secure their robots, with this disclosure, Alias Robotics decided to empower end-users of Mobile Industrial Robots’ with information. The disclosure included a week of hacking efforts that finalized with the public release of 14 cybersecurity affecting MiR industrial robots and other downstream manufacturers, impacting thousands of robots. More than 10 different robot types were affected operating across industrial spaces and all the way to public en, such as airports and hospitals. 11 new CVE IDs were assigned as part of this effort | 24-06-2020 |
| <ins>Attacks on Smart Manufacturing Systems</ins>[^4] | Mitsubishi Melfa V-2AJ | Federico Maggi, Marcello Pogliani ()[^4] | Systematic security analysis exploring a of attack on a real smart manufacturing system, assessing the attacks that could be feasibly launched on a complex smart manufacturing system | 01-05-2020 |
| <ins>The week of Uni Robots' bugs</ins>[^10] | Uni Robots' UR3, UR5, UR10, UR3e, UR5e, UR10e and UR16e | Víctor Mayoral- *et al.* (Alias Robotics)[^10] | For years Uni Robots did not care nor responded about cybersecurity issues with their products. Motivated by this attitude, Alias Robotics' team launched an initiative to empower Uni Robots' end-users, distributors and system integrators with the information they so much require to make use of this technology securely. This effort was called the *week of Uni Robots' bugs* and in total, more than 80 security issues were reported in the robots of Uni robots| 31-03-2020 |
| <ins>Akerbeltz: Industrial robot ransomware</ins>[^14] | Uni Robots' UR3, UR5, UR10 | Víctor Mayoral- *et al.* (Alias Robotics)[^14] | In an attempt to raise awareness and illustrate the *”insecurity by design in robotics”*, the team at Alias Robotics created *Akerbeltz*, the first known instance of industrial robot ransomware. The malware was demonstrated using the UR3 robot from a leading brand for industrial collaborati, Uni Robots. The team of researchers discussed the general flow of the attack including the initial cyber-intrusion, lateral mo and later control phase | 16-12-2019 |
| <ins>Rogue Robots</ins>[^3] | ABB’s IRB140| Federico Maggi, Davide Quarta *et al.* ()[^3]| Explored, theoretically and experimentally, the challenges and impacts of the security of modern industrial robots. Researchers also simulated an entire attack algorithm from an entry point to infiltration and compromise to demonstrate how an attacker would make use of existing in order to perform attacks. | 01-05-2017 |
| <ins>Hacking Robots Before Skynet</ins>[^2] | SoftBank Robotics's NAO and Pepper, UBTECH Robotics' Alpha 1S and Alpha 2, ROBOTIS' OP2 and THORMANG3, Uni Robots' UR3, UR5, UR10, Rethink Robotics' Baxter and Sawyer and several robots from Asratec Corp | Lucas Apa and César Cerrudo (IOActive)[^2]| Discovered critical cybersecurity issues in several robots from multiple which hinted about the lack of security concern and awareness in robotics. | 30-01-2017 |
| <ins>Robot Operating System (ROS): Safe & Insecure</ins>[^9] | ROS | Lubomir Stroetmann (softSCheck)[^9] | This is one of the earliest studies touching on ROS and offers security insights and examples about the lack of security considerations in ROS and the wide attack surface exposed by it. The author hints that with ROS, protection mechanism depends on the (security) expertise of the user, which is not a good assumption in the yet security-immature robotics community. Moreover the author hints about that are easily exploitable due to the XMLRPC adoption within the ROS message-passing infrastructure including XML bomb attacks (e.g. "billion laughs") | 28-02-2014 |

[^0]: Read on what a security-first approach in here.
[^1]: Serious security issues uncovered with the Enabot Smart Robot Flaws in Enabot Ebo Air Home Security Robot Allowed Attackers to Spy on Users Enabot Ebo Air smart robot hacking flaw found, and fixed
[^2]: Hacking Robots Before Skynet
[^3]: Rogue Robots: Testing the Limits of an Industrial Robot’s Security
[^4]: Attacks on Smart Manufacturing Systems A Forward-looking Security Analysis
[^5]: Rogue Automation: and Malicious Code in Industrial Programming
[^6]: Analyzing the Data Distribution Service (DDS) Protocol for Critical Industries
[^7]: JekyllBot:5
[^8]: JekyllBot:5 allows attackers who exploit these to: a) See real-time footage ofa hospital through the robots’ cameras, b) Take and pictures of patients and hospital interiors, c) Interfere with critical or time-sensiti care and operations by shutting down or obstructing hospital ele and door locking systems, d) Access patient medical records in of HIPAA and other international regulations regarding the protection ofpersonal health information, e) Take control of the robots’ mo and crash them into people and objects, or use them to harass patients and staff, f) Disrupt the regular maintenancetasks regularly performed by the robots, including house keeping, cleaning, and delivery errands, g) Disrupt or block robot delivery of critical patient medication, or stealit outright, with potentially damaging or fatal patient outcomes as a result, h) Hijack legitimate administrative user sessions in the robots’ online portal and inject malware through their browser to perpetrate further cyberattacks on IT and security team members at healthcare facilities.
[^9]: Robot Operating System (ROS): Safe & Insecure, Security In of the Robot OS (ROS)
[^10]: The week of Uni Robots' bugs
[^11]: The week of Mobile Industrial Robots' bugs
[^12]: Securing disinfection robots in times of CO
[^13]: Insecure robots during CO (see for a in spanish)
[^14]: Industrial robot ransomware: Akerbeltz (HTML reading edition)
[^15]: Robot teardown, stripping industrial robots for good (HTML reading edition)
[^16]: Case study, hacking the *Robot Operating System (ROS) 2* See the research note, and for public announcements. See for some public discussions
[^17]: SROS2: Usable Cyber Security Tools for ROS 2 (paper, research note)
[^18]: Alias Robotics Claims to Find Security Flaws in ROS 2; Open Robotics Responds
[^19]: Hacker detects a kill switch to take down the gun-toting robot dog
[^20]: Hacker Finds Kill Switch for Submachine Gun–Wielding Robot Dog
[^21]: HangZhou Yushu Technology (Unitree) go1 de notes
[^22]: Russia's new 'robot dog war machine' is just Chinese household 'toy' with gun taped on

项目信息

开发语言：TeX

Star 数：412

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Robot Hacking Manual (RHM). From robotics to cybersecurity. Papers, notes and writeups from a journey into robot cybersecurity.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。