The Serious Security Problem Looming Over Robotics, Researchers at Brown University have compromised Herb 2, it’s a dapper robot. They’ve shown how they can scan for internet-connected research robots in labs and take command. Humans to Robots lab that systems controlling hundreds of research robots are vulnerable to attacks by hackers.
THEY CALL IT Herb2. It’s a dapper robot, wearing a bowtie even while it sits at home in its lab at the University of Washington. Its head is a camera, which it cranes up and down, taking in the view of a dimly lit corner where two computer monitors sit.
All perfectly normal stuff for a robot—until the machine speaks: “Hello from the hackers.”
Clear across the country at Brown University, researchers have compromised Herb2. They’ve showed how they can scan for internet-connected research robots in labs and take command—with the blessing of the robot’s owners at the University of Washington, of course.
“We could read the camera, essentially spying,” says roboticist Stefanie Tellex. “We could see where its arms were and they were moving. There was a text-to-speak API so we could have the robot mysteriously talk to you.”
The researchers looked specifically at the Robot Operating System, or ROS, a favorite in robotics labs. Really, the name of it is a bit misleading—it’s more middleware that runs on top of something like Linux. But if you’ve got something like a Baxter research robot, you can use ROS to get the thing to do science. Maybe you want to teach it to manipulate objects, for instance.
So the researchers went a-hunting for robots running ROS that were hooked up to the internet, knowing that the operating system doesn’t come with security built in. Usually, that’s OK, because researchers tend to keep the things on their own secure networks, not a public one like the internet. “When we started work on ROS over 10 years ago we explicitly excluded security features from the design,” says Brian Gerkey, CEO of Open Robotics. “We wanted the system to be as flexible and as easy to use as possible and we didn’t want to invent our own security mechanisms and potentially get them wrong.”
But if you connect your ROS-loaded robot to the internet, someone is liable to find it and get in. The Brown researchers used a tool called ZMap to do a scan of nearly 4 billion internet addresses. “What ZMap can do is send a package to every single host on the internet on a certain port and it will see if it gets a response back,” says security researcher Nicholas DeMarinis, of Brown. Different ports handle different services—web traffic is either 80 or 443, for instance, and ROS is on port 11311. “So if we ping every host on port 11311 and we get a response back, that might be something running ROS.
READ MORE ON(The Serious Security Problem Looming Over Robotics): Wired
