As serious concerns over the safety and security of Internet of Things (IoT) devices continue to mount, researchers have discovered that industrial robots can be remotely hacked to cause potentially devastating damage. Researchers at security firm Trend Micro and Italy’s Politecnico Milano found that many internet-connected industrial machines run on outdated software or have poor software protection. The experts targeted an ABB IRB140 industrial robot, capable of carrying a payload of up to 6kg, that was programmed to draw a straight line. By exploiting a remote code vulnerability in the robot’s controller software, they reverse engineered the RobotWare control program and RobotStudio software and were able to inject faults and microdefects into the workpie. IT security experts from prpl Foundation and Nozomi Networkscommented below.
Cesare Garlati, Chief Security Strategist at prpl Foundation:
“Robots present a great opportunity to automate tasks and make human life more efficient, but equally can present a grave danger to the public if internal security controls are not properly addressed at the development stages.
The example here is that the Robot is still drawing a straight line. That is what it was programmed to do. However, the consequences, should a robot be infiltrated and hacked, could be calamitous. If on the manufacturing line a hacker could configure new code to adjust certain measurements or rules for the robot, the final product could be compromised and this would potentially endanger the consumer. A prime example could be when manufacturing cars. If this is the road manufacturers want to go down, security at the development stage must be at core when these industrial robots are created. And that goes for all IoT connected devices. If they’re not secure, then they have no business being integrated or introduced to society.”
“Manufacturers are always looking for ways to produce items as efficiently and cost effectively as possible, and that includes automating their production lines. The challenge is when they then take this further and introduce remote connectivity without properly evaluating the security of doing so. Each device with an IP address is a tiny pinprick the plants perimeter defences and hackers are looking for these insecure connections to wreak havoc. In IT, basic security hygiene uses security visibility tools – technologies that document and visualize systems and that detect intrusion. Up until recently these systems were not available for SCADA systems as they interfered with high availability requirements and didn’t work with OT’s unique communication protocols. That is changing with passive monitoring systems that utilise artificial intelligence and machine learning to help deal with the complexity of industrial systems to provide visibility and control without impacting availability.”
ISBuzz Team embodies the collaborative efforts of the dedicated staff at Information Security Buzz, converging a wide range of skills and viewpoints to present a unified, engaging voice in the information security realm. This entity isn't tied to a single individual; instead, it's a dynamic embodiment of a team diligently working behind the scenes to keep you updated and secure. When you read a post from ISBuzz Team, you're receiving the most relevant and actionable insights, curated and crafted by professionals tuned in to the pulse of the cybersecurity world. ISBuzz Team - your reliable compass in the fast-evolving landscape of information security
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.