Written by I recently had dinner with an old friend, Jesse Hones, the Engineering Manager of Systems / Senior Software Developer of Aprel. I remember when we first met he explained that he designed and programmed robots to measure radio frequencies at extremely precise levels. Fast forward a decade; I am an ethical hacker and he is designing more complex robots than ever before. So I did what anyone would do; I asked him to come on the OWASP DevSlop show and talk about hacking robots.
His answer was “Not yet. I can’t tell you what all the loopholes are, because I still need those to get my job done.”
Interest piqued.
He explained that previously robot firmware was all custom; each system it’s own unique snowflake. Like custom software is today, ripe with vulnerabilities, however you can only hack them one system at a time. Recently this has changed, he explained, things are standardizing and many use the same components, which all run the same firmware. I asked if this was like Windows XP back in the day, in that almost everyone is running it so when a bug is discovered *every* system is vulnerable. He said yes.
But Jesse is a developer, not a security person, so he looks at it with the “I need to make sure this runs properly” lens, not the “I want to make this robot do my bidding!” viewpoint of an ethical hacker.
Obviously, I had to threat model the situation immediately. Poor Jesse.
Me: What if malware is created that stops production for all affected robots?
Jesse: Yes, this would be costly.
Me: What about ransomware?
Jesse: <unhappy face>
Me: What if someone takes over the robots and has them implant something in every 20th chip it makes to spy on the users? As a supply chain attack?
Jesse: Yes, that would be very bad. However this could change soon; we may be switching over to Windows Embedded.
Me: Okay…. But what if a company used robots Stuxnet style and slowly sabotaged their competitors? So they could never quite finish their R&D on a product? Meanwhile stealing their ideas? Think Stuxnet meets Schindler’s List.
Jesse: …
Me: What if someone uses them to mine bitcoin? Robot Crypto Pirates!
Jesse: I guess tha-
Me: What if robots become the weak point of most networks and are used regularly as pivot points by hackers?
At this point Jesse has resorted to quietly waiting for me to calm down. I look at him.
Me: What if a robot murders someone?
Jesse: That would be the end. The industry could not survive. That cannot be allowed to happen. Ever.
Sounds like we need more robot hackers.