Robotics developers who already have to deal with security vulnerabilities have yet another concern: robot ransomware.
A team of researchers from the company IOActive presented a proof of concept with a ransomware attack on two popular company robots: Pepper and NAO , from SoftBank Robotics. Both are programmable and autonomous robots designed to interact with humans. One of IOActive’s experts, Lucas Apa, demonstrated that he could take control of a robot and insert malicious code into its behavior modules over a public Wi-Fi network.
After taking control of the robot in a matter of seconds, a hacker could turn it into a ransomware tool, for example demanding money in exchange for its recovery, just as this malicious software can hold a computer system or other device connected to the network. .
How to make robots safer against cyberattacks?
“With our research, we want companies to be aware of potential threats and to start implementing security at an early stage , because otherwise it becomes too costly to fix these problems,” Apa clarifies.
In their study, they comment that most robots do not have an easy solution when software malfunctions.
“Ironically, during our investigation, our robot started to malfunction.” Shipping the robot to the United States and dealing with shipping costs and customs handling turned out to be expensive, “they clarify.” Most companies will probably not want customers to return the robots if they suffer a ransomware attack, “he added. .
The ransomware robot demo was created from previous research that IOActive experts created in 2017, when they discovered nearly 50 vulnerabilities in 13 different robots, which included bugs that could allow hackers to spy on people through the microphone and the camera of a robot. These flaws could also allow someone to make an industrial robot cause physical harm.
Examples of robot ransomware
In the ransomware example, possible attacks could include service interruptions, use of offensive speech, or even display pornographic content on the robot’s screen.
An infected robot could also be used as an entry point to access other devices within an internal network , allowing hackers to steal more valuable data from a company.
One of the ‘problems’ is that the firmware images for many of these robots are freely available on the Internet.
Also, an attacker would not need to have physical access to the robot to test his attack, as many of these robotics companies offer developers emulators and simulators for the robots. “You don’t need a robot to test,” Apa said.
