Robotic manufacturing systems are wide open to attack, with 83,000 units exposed to the public facing internet and many not protected with authentication, according to new Trend Micro research.
With an estimated 1.3 million robotic units set to be deployed in factories around the world by 2018, in an ever-growing range of industries, the security vendor decided to see how resilient such systems are to attack.
It found such systems are generally poorly secured and exposed to a range of online threats. The software and operating systems powering industrial robots was frequently found to be outdated and sometimes relying on obsolete or broken cryptographic libraries, with weak authentication and sometimes default, unchangeable credentials.
What’s more, some 83,000 devices were found to be exposed to remote attackers via the internet, with 5100 having no authentication in place at all. In all, 64 known and zero-day vulnerabilities were discovered.
The report outlines five attack types which could damage equipment and even put human factory workers in physical danger. It also demonstrated a real-world attack on an ABB system.
The vulnerabilities Trend Micro researchers found could be put to various uses by financially motivated cybercrime gangs and state-sponsored operatives, the report found. In each case, the end result is significant financial loss and damaged reputation for the targeted company.
“The research highlights several attack scenarios which could be used against industrial robots, including sabotage, ransom, and even using unpatched robots as an entry point to the corporate network in data stealing attacks,” Trend Micro security strategist, Bharat Mistry, told Infosecurity Magazine.
“Attacks can be detected by identifying software and network anomalies. While patching is still recommended, system hardening is a reliable approach to protection as patches are difficult to maintain across complex software. Also, a secure software development life cycle is one of the best ways to mitigate this risk by eliminating vulnerabilities when the software is created.”