Because robots can directly perceive and affect the physical world, security issues take on particular importance. In this paper, we describe the results of our work on scanning the entire IPv4 address space of the Internet for instances of the Robot Operating System (ROS), a widely used robotics platform for research. Our results identified that a number of hosts supporting ROS are exposed to the public Internet, thereby allowing anyone to access robotic sensors and actuators. As a proof of concept, and with consent, we were able to read image sensor information and move the robot of a research group in a US university. This paper gives an overview of our findings, including the geographic distribution of publicly-accessible platforms, the sorts of sensor and actuator data that is available, as well as the different kinds of robots and sensors that our scan uncovered. Additionally, we offer recommendations on best practices to mitigate these security issues in the future.
OSRF is developing a set of security enhancement to ROS, termed Secure Robot Operating System (SROS) . As of the current writing, its website declares that this effort is highly experimental and must not be considered production-grade.'' It includes TLS @cite_2 support for all socket transport within ROS, certificates for chains of trust, as well as namespace and node restrictions. This effort would certainly mitigate the security issues we have discovered; a properly configured chain of trust would only allow authorized nodes to publish commands to topics that cause the robot to move. However, given the current state of the software, it is not yet in wide use. propose a new architecture for an authentication and authorization services that can limit access to ROS services. Additionally, we suspect that a more systemic solution should be deployed in addition to these methods: the port 11311 should be filtered, by most hosts, rather than configuring a complicated authentication authorization infrastructure.
@cite_2
2266218113
This document specifies Version 1.2 of the Transport Layer Security (TLS) protocol. The TLS protocol provides communications security over the Internet. The protocol allows client server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. [STANDARDS-TRACK]