As serious concerns over the safety and security of Internet of Things (IoT) devices continue to mount, researchers have discovered that industrial robots can be remotely hacked to cause potentially devastating damage. Researchers at security firm Trend Micro and Italy’s Politecnico Milano found that many internet-connected industrial machines run on outdated software or have poor software protection. The experts targeted an ABB IRB140 industrial robot, capable of carrying a payload of up to 6kg, that was programmed to draw a straight line. By exploiting a remote code vulnerability in the robot’s controller software, they reverse engineered the RobotWare control program and RobotStudio software and were able to inject faults and microdefects into the workpie. IT security experts from prpl Foundation and Nozomi Networks commented below.
Cesare Garlati, Chief Security Strategist at prpl Foundation:
“Robots present a great opportunity to automate tasks and make human life more efficient, but equally can present a grave danger to the public if internal security controls are not properly addressed at the development stages.
The example here is that the Robot is still drawing a straight line. That is what it was programmed to do. However, the consequences, should a robot be infiltrated and hacked, could be calamitous. If on the manufacturing line a hacker could configure new code to adjust certain measurements or rules for the robot, the final product could be compromised and this would potentially endanger the consumer. A prime example could be when manufacturing cars. If this is the road manufacturers want to go down, security at the development stage must be at core when these industrial robots are created. And that goes for all IoT connected devices. If they’re not secure, then they have no business being integrated or introduced to society.”
Edgard Capdevielle, CEO at Nozomi Networks:
“Manufacturers are always looking for ways to produce items as efficiently and cost effectively as possible, and that includes automating their production lines. The challenge is when they then take this further and introduce remote connectivity without properly evaluating the security of doing so. Each device with an IP address is a tiny pinprick the plants perimeter defences and hackers are looking for these insecure connections to wreak havoc. In IT, basic security hygiene uses security visibility tools – technologies that document and visualize systems and that detect intrusion. Up until recently these systems were not available for SCADA systems as they interfered with high availability requirements and didn’t work with OT’s unique communication protocols. That is changing with passive monitoring systems that utilise artificial intelligence and machine learning to help deal with the complexity of industrial systems to provide visibility and control without impacting availability.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.