Saturday , January 23 2021

Robots running the industrial world are open to cyber attacks

Bloomberg

Industrial robots are now being used to assemble everything from airplanes to smartphones, using human-like arms to mechanically repeat the same processes over and over, thousands of times a day with nanometric precision.
But according to a new report entitled “Rogue Automation,” some robots have flaws that could make them vulnerable to advanced hackers, who could steal data or alter a robot’s movements remotely, like a scene out of science fiction.
“Attacks on industrial environments in these sectors could have serious consequences, including operational failure, physical damage, environmental harm and injury or loss of life,” according to Federico Maggi, a researcher at Trend Micro Inc., and Marcello Pogliani, an information security researcher at Politecnico di Milano, in a research report reviewed by Bloomberg. The report will be presented at a virtual forum organised by Black Hat, which provides cybersecurity events around the world.
Robots are often connected to networks and run via software, according to the report, and previously unknown vulnerabilities could allow hackers to hide malicious code in them and other automated, programmable manufacturing machines. The researcher found flaws in software produced and distributed by the Swedish-Swiss multinational ABB Ltd, one among world’s largest industrial robot maker. They also found other vulnerabilities in one of industry’s most popular open source software called “Robot Operating System Industrial”, or Ros-I, adapted for ABB and for Kuka AG, a German robot maker.
Maggi and Pogliani said two years ago they “stumbled upon something we had never seen before,” an app store run by ABB for heavy industrial machines including robots. The apps were written in ABB’s proprietary programming language used to automate industrial machines, the types of robots used to assemble cars or handle processed food. They downloaded and reverse engineered some of the apps to figure out how they worked and discovered a vulnerability in one of the apps for ABB robots — just the type of thing a hacker could exploit, they said.
The flaw would have allowed an attacker on the network to exfiltrate any files from the robot controller, including potentially sensitive data. ABB’s app store itself also had a vulnerability, according to the researchers. Hackers could upload apps from the store by bypassing validation procedures and making them immediately available to the public even if still pending approval, the researchers said.
“Industrial secrets are traded for very high prices in underground marketplaces and have become one of the main targets of cyber warfare operations,” the paper said. A vulnerability scanner designed by researchers discovered another class of flaws into a Ros-I’s software component for Kuka and ABB robots that could have allowed an attacker to interfere with robots’ movements, according to report.
Vulnerabilities related to ABB have been acknowledged and solved by the company while flaws found into Ros-I software have been mitigated by Ros consortium and confirmed by the US Cybersecurity & Infrastructure Security Agency, also known as CISA.
A spokesman for ABB said the company “has fixed the concerns in the Trend Micro tests, which helped us provide greater security for equipment in the market.” There is no indication of data exfiltration nor any customers affected by it, he added.
Industrial robots are a fast-growing area in the industrial sector, with historical growth rates exceeding 20% in unit terms, with an annual value of $16 billion, based on International Federation of Robotics data, Bloomberg Intelligence analyst Mustafa Okur said. Even as China’s foray into the robots is slowing and the sector may see a decline in 2020, long-term fundamentals remain largely intact, driven by factors such as aging demographics and demand for quality, he added.

About Admin

Check Also

BlackBerry, Facebook resolve global patent fight

Bloomberg BlackBerry Ltd. said it’s settled a dispute with Facebook Inc. over patent royalties for ...

Leave a Reply

Your email address will not be published. Required fields are marked *