Industrial Robots IoT Cybersecurity Nightmare

Industrial Robots IoT Cybersecurity Nightmare

Nearly 50 vulnerabilities have been found in industrial collaborative robots which can be configured enable the robots to spy on their surroundings or cause physical harm to workers

Nearly 50 vulnerabilities have been found in industrial collaborative robots ­– machines that work side-by-side with humans in manufacturing settings – which can be configured enable the robots to spy on their surroundings or possibly cause physical harm to workers.

The researchers at IOActive who discovered the vulnerabilities, Cesar Cerrudo and Lucas Apal, said the collaborative robots, or “cobots,” can be remotely tampered with to alter safety configurations that, for example, prevent them from operating outside a designated safety boundary.

Cobots can learn movements, “see” through built-in cameras and “hear” through microphones, which the researchers said can all be accessed, opening up possibilities for commercial espionage.

“These new collaborative robots are smarter and can do a lot of different things. There, the threat is different,” Cerrudo said. “Once they are hacked, they have a lot of people around them; you’re talking about really powerful robots that can lift a lot of weight. It’s very possible they can end up seriously hurting a person.”

In their initial research published in February, titled “Hacking Robots Before Skynet,” Cerrudo and Apa studied publicly available firmware and software to learn how these machines work, learning their ecosystem, how they connect to local networks, including other robots, as well as to their respective vendors, including to cloud-based update systems.

IOActive published a paper this week building on the initial cobot research, further explaining technical details on the vulnerabilities and proof-of-concept exploits. They also included demonstrations and called out Universal Robots for failing to patch their machines’ major problems, including authentication, memory corruption and insecure communication vulnerabilities, since the company was privately contacted by the researchers in January.

“Right now, [cobots] are very insecure. If we don’t do anything about it and improve the security, then it will be a complete mess,” Cerrudo said. “They can end up doing really nasty things. The same problems you are seeing right now with IoT that are causing losses and being hacked every day will be 10 times worse with robots. They can move around, grab things, damage property, have camera, microphones, so the threat is a lot bigger.”

Featured

  • Survey: 54% of Organizations Cite Technical Debt as Top Hurdle to Identity System Modernization

    Modernizing identity systems is proving difficult for organizations due to two key challenges: decades of accumulated Identity and Access Management (IAM) technical debt and the complexity of managing access across multiple identity providers (IDPs). These findings come from the new Strata Identity-commissioned report, State of Multi-Cloud Identity: Insights and Trends for 2025. The report, based on survey data from the Cloud Security Alliance (CSA), highlights trends and challenges in securing cloud environments. The CSA is the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment. Read Now

  • Study: Nearly Half of Companies Exclude Cybersecurity Teams When Developing, Onboarding and Implementing AI Solutions

    Only 35 percent of cybersecurity professionals or teams are involved in the development of policy governing the use of AI technology in their enterprise, and nearly half (45 percent) report no involvement in the development, onboarding, or implementation of AI solutions, according to the recently released 2024 State of Cybersecurity survey report from ISACA, a global professional association advancing trust in technology. Read Now

  • New Report Series Highlights E-Commerce Threats, Fraud Against Retailers

    Trustwave, a cybersecurity and managed security services provider, recently released a series of reports detailing the threats facing the retail sector, marking the second year of its ongoing research into these critical security issues. Read Now

  • Stay Secure in 2024: Updated Cybersecurity Tips for the Office and at Home

    Cyber criminals get more inventive every year. Cybersecurity threats continue to evolve and are a moving target for business owners in 2024. Companies large and small need to employ cybersecurity best practices throughout their organization. That includes security integrators, manufacturers, and end users. Read Now

Featured Cybersecurity

Webinars

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3