Popular robots are dangerously easy to hack, researchers say

Bloomberg

Some of the most popular industrial and consumer robots are dangerously easy to hack and could be turned into bugging devices or weapons, IOActive Inc. said.

The Seattle cybersecurity firm found major security flaws in industrial models sold by Universal Robots, a division of U.S. technology company Teradyne Inc. It also cited issues with consumer robots Pepper and NAO, which are manufactured by Japan’s Softbank Group, and the Alpha 1 and Alpha 2 made by China-based UBTech Robotics.

These vulnerabilities could allow the robots to be turned into surveillance devices, surreptitiously spying on their owners, or let them to be hijacked and used to physically harm people or damage property, the researchers wrote in a report Tuesday.

Universal Robots’ devices are designed to work directly alongside humans without being confined to a cage for safety, as with many other industrial models. But IOActive was able to remotely hack the software that controls the robot and disable key safety features. This could result in them being programmed to injure the humans around them.

This is particularly worrying, IOActive said, because these machines are large enough and have enough power that “even running at low speeds, their force is more than sufficient to cause a skull fracture.”

With the robots intended for home use — SoftBank’s Pepper and NAO — IOActive found that cyberattackers could use them to record audio and video and secretly transmit this data to an external server. UBTech’s Alpha series home robots did not encrypt sensitive information they captured before storing or transmitting it, opening an avenue for cybercriminals to potentially steal important personal information, IOActive said.

As with the Universal Robots machines, these home robots could also be made to carry out physical attacks. Although they are much less powerful than the industrial models from Universal Robots, IOActive released a video of a test in which an otherwise cute NAO robot suddenly begins laughing in an evil and maniacal way and uses a screwdriver to repeatedly stab a tomato. While the video is clearly intended to be humorous, IOActive’s researchers said it had a serious intent: one could imagine the robot potentially launching a similar attack against an infant, toddler or pet.

“If we know about these vulnerabilities, chances are that we’re not the only ones,” said Lucas Apa, security consultant at IOActive.

Universal Robots spokesman Thomas Stensbol said the company was aware of IOActive’s report. “We have a constant focus on our product improvement and industrial hardening for the sake of our customers,” he said. “This includes monitoring any potential vulnerability, not just cyber-security.” He said the company’s products “undergo rigorous safety certification.”

SoftBank spokesman Vincent Samuel said the company would provide a response to IOActive’s report but it had not done so as of press time. UBTech didn’t respond to requests to comment on IOActive’s findings.

Apa said that SoftBank had told IOActive that it planned to issue patches to address security flaws researchers found, but that no fixes had been released.

IOActive issued an initial report highlighting many of these vulnerabilities in March but withheld the specific techniques used to hack into the software that controls the robots in order to give manufacturers time to fix flaws. On Tuesday, the cybersecurity firm made technical details of the hacks public.

“We contacted all the vendors in January but sadly there’s little to suggest that the 50-plus vulnerabilities we demonstrated have been fixed,” Apa said. “Most vendors were not forthcoming when we contacted them in private, so going public was the only option left available to us.”

Apa said the intent was to make the public aware of the risks and prod manufacturers to fix the flaws.

He said IOActive wanted to highlight the need for robotics companies to think about cybersecurity at every stage of their design process. “These are early days for the robotics industry, but as it grows, we want to make sure it has a more secure future,” he said.

Talk to us

> Give us your news tips.

> Send us a letter to the editor.

> More Herald contact information.

More in Business

A closing sign hangs above the entrance of the Big Lots at Evergreen and Madison on Monday, July 22, 2024, in Everett, Washington. (Ryan Berry / The Herald)
Big Lots announces it will shutter Everett and Lynnwood stores

The Marysville store will remain open for now. The retailer reported declining sales in the first quarter of the year.

George Montemor poses for a photo in front of his office in Lynnwood, Washington on Tuesday, July 30, 2024.  (Annie Barker / The Herald)
Despite high mortgage rates, Snohomish County home market still competitive

Snohomish County homes priced from $550K to $850K are pulling in multiple offers and selling quickly.

Henry M. Jackson High School’s robotic team, Jack in the Bot, shake hands at the 2024 Indiana Robotics Invitational.(Henry M. Jackson High School)
Mill Creek robotics team — Jack in the Bot — wins big

Henry M. Jackson High School students took first place at the Indiana Robotic Invitational for the second year in a row.

The computer science and robotics and artificial intelligence department faculty includes (left to right) faculty department head Allison Obourn; Dean Carey Schroyer; Ishaani Priyadarshini; ROBAI department head Sirine Maalej and Charlene Lugli. PHOTO: Arutyun Sargsyan / Edmonds College.
Edmonds College to offer 2 new four-year degree programs

The college is accepting applications for bachelor programs in computer science as well as robotics and artificial intelligence.

FILE — Boeing 737 MAX8 airplanes on the assembly line at the Boeing plant in Renton, Wash., on March 27, 2019. Boeing said on Wednesday, Feb. 21, 2024, that it was shaking up the leadership in its commercial airplanes unit after a harrowing incident last month during which a piece fell off a 737 Max 9 jet in flight. (Ruth Fremson/The New York Times)
Federal judge rejects Boeing’s guilty plea related to 737 Max crashes

The plea agreement included a fine of up to $487 million and three years of probation.

Neetha Hsu practices a command with Marley, left, and Andie Holsten practices with Oshie, right, during a puppy training class at The Everett Zoom Room in Everett, Washington on Wednesday, July 3, 2024. (Annie Barker / The Herald)
Tricks of the trade: New Everett dog training gym is a people-pleaser

Everett Zoom Room offers training for puppies, dogs and their owners: “We don’t train dogs, we train the people who love them.”

Andy Bronson/ The Herald 

Everett mayor Ray Stephenson looks over the city on Tuesday, Jan. 5, 2015 in Everett, Wa. Stephanson sees  Utah’s “housing first” model – dealing with homelessness first before tackling related issues – is one Everett and Snohomish County should adopt.

Local:issuesStephanson

Shot on: 1/5/16
Economic Alliance taps former Everett mayor as CEO

Ray Stephanson will serve as the interim leader of the Snohomish County group.

Molbak's Garden + Home in Woodinville, Washington will close on Jan. 28. (Photo courtesy of Molbak's)
After tumultuous year, Molbak’s is being demolished in Woodinville

The beloved garden store closed in January. And a fundraising initiative to revitalize the space fell short.

Everett Mayor Cassie Franklin, Advanced Manufacturing Skills Center executive director Larry Cluphf, Boeing Director of manufacturing and safety Cameron Myers, Edmonds College President Amit Singh, U.S. Rep. Rick Larsen, and Snohomish County Executive Dave Somers participate in a ribbon-cutting ceremony on Tuesday, July 2 celebrating the opening of a new fuselage training lab at Paine Field. Credit: Arutyun Sargsyan / Edmonds College
‘Magic happens’: Paine Field aerospace center dedicates new hands-on lab

Last month, Edmonds College officials cut the ribbon on a new training lab — a section of a 12-ton Boeing 767 tanker.

Gov. Jay Inslee presents CEO Fredrik Hellstrom with the Swedish flag during a grand opening ceremony for Sweden-based Echandia on Tuesday, July 30, 2024, in Marysville, Washington. (Ryan Berry / The Herald)
Swedish battery maker opens first U.S. facility in Marysville

Echandia’s marine battery systems power everything from tug boats to passenger and car ferries.

Helion Energy CEO and co-founder David Kirtley talks to Governor Jay Inslee about Trenta, Helion’s 6th fusion prototype, during a tour of their facility on Tuesday, July 9, 2024 in Everett, Washington. (Olivia Vanni / The Herald)
State grants Everett-based Helion a fusion energy license

The permit allows Helion to use radioactive materials to operate the company’s fusion generator.

People walk past the new J.sweets storefront in Alderwood Mall on Thursday, July 25, 2024, in Lynnwood, Washington. (Olivia Vanni / The Herald)
New Japanese-style sweets shop to open in Lynnwood

J. Sweets, offering traditional Japanese and western style treats opens, could open by early August at the Alderwood mall.

Support local journalism

If you value local news, make a gift now to support the trusted journalism you get in The Daily Herald. Donations processed in this system are not tax deductible.