rajivraj/robot_hacking_manual

Robot Hacking Manual (RHM). From robotics to cybersecurity. Papers, notes and writeups from a journey into robot cybersecurity.

RHM: Robot Hacking Manual

Download in PDF RHM v0.3 ┃ Read online

The Robot Hacking Manual (RHM) is an introductory series about cybersecurity for robots, with an attempt to provide comprehensive case studies and step-by-step tutorials with the intent to raise awareness in the field and highlight the importance of taking a security-first¹ approach. The material available here is also a personal learning attempt and it's disconnected from any particular organization. Content is provided as is and by no means I encourage or promote the unauthorized tampering of robotic systems or related technologies.

• Disclaimer
• History
• Motivation
• A containerized approach
• Contribute back
• Introduction
  • About robot cybersecurity
• Case studies
  • Universal Robots' UR3 (hacking a collaborative robot arm)
  • Mobile Industrial Robots' MiR100 (hacking an industrial mobile robot)
  • Robot Operating System 2 (hacking ROS 2)
  • TurtleBot 3 (hacking TurtleBot 3)
• Writeups
  • Reconaissance
    • Footprinting
      • Tutorial 1: Footprinting ROS systems
      • Tutorial 2: Footprinting Secure ROS systems
      • Tutorial 3: Footprinting ROS 2 and DDS systems
  • Vulnerability research
    • Static analysis
      • Tutorial 5: Static analysis of PyRobot
    • Dynamic analysis
      • Tutorial 1: Robot sanitizers in ROS 2 Dashing
      • Tutorial 2: Robot sanitizers in MoveIt 2
      • Tutorial 3: Debugging output of robot sanitizers with GDB, hunting and fixing bugs
      • Tutorial 4: Robot sanitizers with Gazebo
      • Tutorial 5: Static analysis of PyRobot
      • Tutorial 6: Looking for vulnerabilities in ROS 2
      • Tutorial 7: Analyzing Turtlebot 3
      • Tutorial 8: SROS and SROS 2, exploring
      • Tutorial 9: Looking at DDS middleware flaws
  • Exploitation
    • General
      • Tutorial 1: Buffer overflows
      • Tutorial 2: Building shellcode
      • Tutorial 3: Exploiting
      • Tutorial 4: Return to libc
      • Tutorial 5: Return-Oriented Programming (ROP)
      • Tutorial 6: Remote shell
      • Tutorial 7: pwntools - CTF toolkit
      • Tutorial 8: Linux Binary Protections (external)
      • Tutorial 9: Building a pwnbox
      • Tutorial 10: Bypassing NX with Return Oriented Programming (WIP, unfinished)
    • Robotics-specific
      • Tutorial 11: Unauthenticated registration/unregistration with ROS Master API
      • Tutorial 12: Unauthenticated updates in publisher list for specified topic
      • Tutorial 13: Sockets left open and in CLOSE_WAIT state in ROS
  • Forensics
    • Tutorial 1: Basic robot forensics, an unauthenticated unregistration in ROS
    • Tutorial 2: Locating ROS logs in memory (failed)
    • Tutorial 3: Capturing memory in Linux-based robots
    • Tutorial 4: Basic robot forensics 2, unauthenticated updates in publisher list for specified topic (unfinished)
  • Hardening
    • Tutorial 1: A study of container technologies

Footnotes

1. Read on what a security-first approach in here. ↩