Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Saturday, 9 December, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Channel News
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Channel News
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Severe Security Vulnerabilities in Home, Business and Industrial Robots – Industry Reaction

by The Gurus
March 2, 2017
in Editor's News
Share on FacebookShare on Twitter

Yesterday, IOActive released a report exposing numerous vulnerabilities found in multiple home, business and industrial robots on the market today.

The Guru reached out to several security experts to get their take on the report.

Mike Ahmadi, global director – critical systems security at Synopsys:

“The consequential damage of a hacked robot, or any hacked system, is directly commensurate with the amount of trust put into the system.  This becomes extremely problematical as technology improves, and we become more reliant and more trusting of the systems.  Once external connectivity is introduced, industrial robots become potential security time bombs, wherein any system where vulnerabilities are not constantly audited and managed eventually becomes easier to compromise over time, as the number of vulnerabilities climbs.  The amount of damage that can be done is fully dependent on the capabilities of the robot, and simply hacking a robot to operate slightly out of a specified configuration mode can lead to everything from minor damage to death.”

Mark Kuhr, Co-Founder and CTO at Synack:

“The consequences of a hacked robot depend upon its functionality.  Let’s think about a car factory…If the robot is in charge of putting wheels on a car, an adversary could plant malware to alter the lug nuts installation tightness such that the wheels fall off at high rates of speed.  We need to use our imagination on the worst case scenarios here when it comes to industrial robotics.

“This is definitely a real-world problem.  These systems are built with the same technology that we’ve found vulnerable in other use cases, and it really is only as secure as developed.  See above example for what kind of damage could be done…but we can get really creative here when it comes to industrial robots.

“In the age of the Internet of Things, there is a huge amount of change and flux in an IT environment. There are constantly new devices and SaaS apps being added to the network, creating a rise of traffic in and out of an organisation’s perimeters. The robot vendors, like any other software vendor, need to perform security assessments regularly and as systems are being developed. Secure development lifecycles apply to any system, and robotics manufacturers need to be aware of the avenues of attack on these systems by a determined adversary. 

“In general, the networks for command and control of the robots need to be isolated and air-gapped from the rest of the corporate network.  The update paths to the robot, including the supply chain, need to be verified as secure so we can protect these systems from malware or remote command injections.”

Adam Brown, manager, security solutions at Synopsys: 

“As we saw with Stuxnet in 2010, the consequences of this type of hacking can be devastating for the victim. In this case the control systems for Iran’s uranium enrichment machines were compromised causing substantial damage to the programme.

“Confidentiality breaches could mean intellectual property could be leaked. As the report states, microphones and cameras could be breached allowing sensitive conversations or views outside of the perimeter. Furthermore, input from sensors could reveal accurate measurements of potentially secret methods applied in manufacture.

“Integrity issues could mean that malicious actors could have introduced quality defects into a production line, enabling competitors or vandals to affect manufacturing processes just enough to cause reliability or safety problems in finished products.

“Availability issues could cease the manufacturing process or cause delays at critical points in time.

“Like with all information systems, vendors should apply software security to their development lifecycle for any internally created applications, and should invest in a software supply chain process for externally procured applications, libraries and software.

“Operators can scan the firmware that run these robots, in effect creating a software supply chain process themselves to keep vendors in check. It has long been known that vendors of all types of devices, not just robots supply products with vulnerabilities. The challenge is not so much detecting vulnerabilities but getting vendors to remediate them.”

Art Swift, president of the prpl Foundation: 

“Robots present a great opportunity to automate tasks and make human life more efficient, but equally can present a grave danger to the public if internal security controls are not properly addressed at the development stages.  We see it time and again in the consumer market where really fantastic products that “work” are rushed to market and later we find out that security is nonexistent and at worst privacy may be affected due to data leakage. But when we apply this same rushed logic to the robotics industry, it could quite literally be lives on the line.  Security has to be core to the development of these types of robotic devices and if they’re not secure, then they have no business being integrated with human lives.”  

FacebookTweetLinkedIn
ShareTweet
Previous Post

Luxembourg state servers attacked – industry reaction

Next Post

Email security must be a priority for businesses, urges IT expert

Recent News

New Synopsys Report Reveals Application Security Automation Soars

December 5, 2023
Over 80% of IT Leaders Want to Move Their On-Prem PAM Solution to the Cloud

Over 80% of IT Leaders Want to Move Their On-Prem PAM Solution to the Cloud

December 5, 2023
Centripetal real logo

Centripetal Announces Partnership With Tiger to Provide Cybersecurity Innovation to the UK Market

December 7, 2023
Google bins inactive accounts

Google bins inactive accounts

December 1, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Channel News
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information