ABSTRACT: Industrial robots are complex cyber-physical systems used for manufacturing, and a critical component of any modern factory. These robots aren't just electromechanical devices but include complex embedded controllers, which are often interconnected with other computers in the factory network, safety systems, and to the Internet for remote monitoring and maintenance. In this scenario, industrial routers also play a key role, because they directly expose the robot's controller. Therefore, the impact of a single, simple vulnerability can grant attackers an easy entry point. The talk will discuss how remote attackers are able to attack such robots up to the point where they can alter the manufactured product, physically damage the robot, steal industry secrets, or injure humans. BIO: Stefano Zanero received a PhD in Computer Engineering from Politecnico di Milano, where he is currently a full professor with the Dipartimento di Elettronica, Informazione e Bioingegneria. His research focuses on malware analysis, cyber-physical security, and cybersecurity in general. Besides teaching “Computer Security” and “Digital Forensics and Cybercrime” at Politecnico, he has extensive speaking and training experience in Italy and abroad. He co-authored over 100 scientific papers and books. He is a Senior Member of the IEEE and the IEEE Computer Society, which has named him a Distinguished Lecturer and Distinguished Contributor; he is a lifetime senior member of the ACM, which has named him a Distinguished Speaker; and has been named a Fellow of the ISSA (Information System Security Association). Stefano is also a co-founder and chairman of Secure Network, a leading cybersecurity assessment firm, and a co-founder of BankSealer, a startup in the FinTech sector that addresses fraud detection through machine learning techniques.

1. Breaking the laws of robotics
Attacking industrial robots
Stefano Zanero
Politecnico di Milano
Partially based upon work with present and former colleagues and students:
D. Quarta, M. Pogliani, M. Polino, F. Maggi, A. Zanchettin, M. Vittone

2. Originally disconnected systems
Now opening up to the Internet
Security as an afterthought
Industrial CPS traits

3. Production-critical systems
Difficult to update
Long service life and forever days
Not necessarily managed by corp. IT (“IT vs OT”)
Industrial CPS traits

4. Cyber-Physical Systems
Influence the physical environment
Sometimes, critical systems (safety-wise, critical infra)
Industrial CPS traits

5. CIA triad not so important, but:
● Safety
○ people, environment, equipment
● Production continuity
○ Production plant halting
○ Ransomware (“oh, I could ransom that, too”)
● Production outcome alteration
○ → safety?
Threat Scenarios

6. Example: additive manufacturing micro-defects
dr0wned - Cyber-Physical Attack with Additive Manufacturing, Sofia Belikovetsky, Mark Yampolskiy, Jinghui Toh, Yuval Elovici, WOOT ‘17

7. Industrial robots?

9. Screenshot of teach pendant + formatted code snippet on the side
1) Robots are flexibly programmable...

10. … and the program doesn’t say it all

11. 2) Robots are extensible & connected
source: http://developercenter.robotstudio.com
source: abb.com
source: https://universal-robots.com/plus

12. 3) Robots are (sometimes) collaborative

13. We assess
attack impactby
reasoning on
requirements

14. Requirements
Safety
I/O Accuracy
Integrity

15. violating any of these
requirements
via a digital vector
Requirements → Robot-Specific Attack
Safety
I/O Accuracy
Integrity

16. Control Loop or Calibration Tampering
Safety
Accuracy
Integrity
Attack 2

17. Production Logic Tampering
Safety
Accuracy
Integrity
Attack 3

18. Displayed or Actual State Alteration
Safety
Accuracy
Integrity
Attacks 4+5
Displayed or Actual State Alteration

19. Displayed State Alteration Example
Teach Pendant
Malicious DLL

20. Compromising robot
controllers

22. Attack surface
USB port
LAN
Radio
Services:
Well-known (FTP) +
custom (RobAPI)

23. Plenty of vulnerabilities
● BOF leading to RCE ABBVU-DMRO-124641
● BOF in FlexPendant ABBVU-DMRO-124645
● BOF in /command endpoint ABBVU-DMRO-128238
● Command Injection ABBVU-DMRO-124642
● Authentication bypass ABBVU-DMRO-124644

24. Takeaways
Some memory corruption
Mostly logical vulnerabilities
Unprotected sensitive files (e.g. config)
All the components blindly trust the
main computer (lack of isolation)

25. Full Controller Exploitation

26. That’s how we implemented the attacks

27. What’s the
Attack Surface?

28. Robots are meant to be connected

29. Connected Robots: Why?
● Now: monitoring & maintenance ISO 10218-2:2011
● Enter the I4.0: active production planning/control
○ some vendors expose REST-like APIs
○ … up to the use of mobile devices for commands
● Future: app/library stores
○ “Industrial” version of robotappstore.com?

30. More in general: the “smart factory” ecosystem

31. ICS on the Internet

32. Not so many...
Remote Exposure of Industrial Robots
Search Entries Country
ABB Robotics 5 DK, SE
FANUC FTP 9 US, KR, FR, TW
Yaskawa 9 CA, JP
Kawasaki E Controller 4 DE
Mitsubishi FTP 1 ID
Overall 28 10

33. Remote Exposure of Industrial Routers
...way more!
Unknown which routers are actually robot-connected

34. Trivially “Fingerprintable” (banners, firmware, manuals)
Outdated Software Components
Insecure Web Interface
Industrial Routers: Typical Issues
Cut & paste

35. Proprietary Languages
Language Vendor
RAPID ABB
KRL KUKA
MELFA BASIC Mitsubishi
AS Kawasaki
PDL2 COMAU
PacScript DENSO
URScript Universal-Robot
KAREL FANUC

36. The DSL rabbithole

37. Vendor
File
System
Directory
Listing
ABB ✔ ✔
KUKA ✔
Mitsubishi ✔
Kawasaki
COMAU ✔ Indirect
DENSO
Universal-Robot
FANUC ✔ ✔
Features: Handle File Resources

38. Features: Load new Code at Runtime
Vendor
File
System
Directory
Listing
Load Module From
File
Call By
Name
ABB ✔ ✔ ✔ ✔
KUKA ✔
Mitsubishi ✔
Kawasaki
COMAU ✔ Indirect ✔ ✔
DENSO ✔ ✔
Universal-Robot
FANUC ✔ ✔ ✔ ✔

39. Features: Network Communication
Vendor
File
System
Directory
Listing
Load Module From
File
Call By
Name
Communication
ABB ✔ ✔ ✔ ✔ ✔
KUKA ✔ ✔
Mitsubishi ✔ ✔
Kawasaki ✔
COMAU ✔ Indirect ✔ ✔ ✔
DENSO ✔ ✔ ✔
Universal-Robot ✔
FANUC ✔ ✔ ✔ ✔ ✔

40. We Asked Automation Engineers...
What language features do you use when programming robots?

41. We Found out that…
•Developers can introduce vulnerabilities that can be
exploited
• Yes, we found vulnerable code published on
GitHub
•Threat actors can abuse the language features to write
malware
• Yes, we were able to write a network-capable,
self-spreading malware dropper

42. Example: a vulnerable web server in RAPID

43. Example
Web server root
Robot
controller
Secrets
stolen
Outside
the
root

44. Sources and Sinks
Attacker-controlled input concrete impact
sensitive sources sensitive sinks
File
Inbound communication
(e.g., network)
Teach Pendant (UI)
Robot Movement
File Handling (e.g., read)
File Modification (e.g.,
write configuration)
Call by Name

45. 1 2 3 4
We built an analyzer for (some) DSL
CFG
Generation
Dataflow
Analysis
Task program’s
source code
Parsing
RAPID parser
KRL parser
...
MoveJ point0
WaitTime 4
MoveL point1
WaitTime 5
...
ICFG
Generatio
n
Potential
Vulnerabilities
Potentially
Abused Features
Insecure Patterns
&
Malicious
Patterns

46. Detection Results
•Hard to find public code (it’s intellectual property)
•100 RAPID and KRL files on public repo (e.g., GitHub and
GitLab)
Vulnerability Projects Files Root Cause
Network → Remote
Function Exec
2 2 Dynamic code loading
Network → File Access 1 4 Unfiltered open file
Network → Arbitrary
Movement
13 34 Unrestricted Move
Joint or Move to point
Detection Errors 2 12 Interrupts

47. •Exchange files via network
Are These Languages Good to Write Malware?
Vendor
File
System
Directory
Listing
Load Module From
File
Call By
Name
Communication
ABB ✔ ✔ ✔ ✔ ✔
KUKA ✔ ✔
Mitsubishi ✔ ✔
Kawasaki ✔
COMAU ✔ Indirect ✔ ✔ ✔
DENSO ✔ ✔ ✔
Universal-Robot ✔
FANUC ✔ ✔ ✔ ✔ ✔

48. •Load or send data via network
•Jump to code available at runtime
Are These Languages Good to Write Malware?
Vendor
File
System
Directory
Listing
Load Module From
File
Call By
Name
ABB ✔ ✔ ✔ ✔
KUKA ✔
Mitsubishi ✔
Kawasaki
COMAU ✔ Indirect ✔ ✔
DENSO ✔ ✔
Universal-Robot
FANUC ✔ ✔ ✔ ✔

49. •Load or send data via network
•Jump to code available at runtime
•Scan the network for targets
Are These Languages Good to Write Malware?
Vendor Communication
ABB ✔
KUKA ✔
Mitsubishi ✔
Kawasaki ✔
COMAU ✔
DENSO ✔
Universal-Robot ✔
FANUC ✔

50. •Load or send data via network
•Jump to code available at runtime
•Scan the network for targets
•Turing-complete language
Are These Languages Good to Write Malware?

53. Conclusions

54. Manufacturing systems increasingly connected
Industrial-specific classes of attacks
Domain-specific languages vulnerabilities
Cooperative robotics challenges
Conclusions

55. Stefano Zanero
stefano.zanero@polimi.it
@raistolo
For further details, scientific papers, and more:
http://robosec.org
Questions?