+
+ | Threat |
+ MARA Assets |
+ Entry Points |
+ SROS Enabled? |
+ Attack |
+ Mitigation |
+ Mitigation Result (redesign / transfer / avoid / accept) |
+ Additional Notes / Open Questions |
+
+
+
+ | Human Assets |
+ Robot App. |
+ ROS 2 API (DDS) |
+ Manufacturer CI/CD |
+ End-user CI/CD |
+ H-ROS API |
+ OTA |
+ Physical |
+
+
+ | Embedded / Software / Communication / Inter-Component
+ Communication |
|---|
+
+
+ | An attacker spoofs a software component identity. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ Without SROS any node may have any name so spoofing is trivial. |
+
+
+ - Enable SROS / DDS Security Extension to authenticate and encrypt DDS communications.
+
+ |
+ Mitigating risk requires implementation of SROS on MARA. |
+ No verification of components. An attacker could connect a fake joint directly. Direct access to the system is granted. (No NAC) |
+
+
+
+ | ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘/✓ |
+ An attacker deploys a malicious node which is not enabling DDS Security Extension and spoofs the `joy_node` forcing the robot to stop. |
+
+
+ - DDS Security Governance document must set `allow_unauthenticated_participants` to False to avoid non-authenticated participants to be allowed to communicate with authenticated nodes.
+ - DDS Security Governance document must set `enable_join_access_control` to True to explicitly whitelist node-to-node-communication. permissions.xml should be as restricted as possible."
+
+ |
+ Risk is mitigated |
+ |
+
+
+
+ | ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✓ |
+ An attacker steals node credentials and spoofs the joint node forcing the robot to stop. |
+
+
+ - Store node credentials in a secure location (secure enclave, RoT) to reduce the probability of having a private key leaked.
+ - Run nodes in isolated sandboxes to ensure one node cannot access another node data (including credentials)
+ - Permissions CA should digitally sign nodes binaries to prevent running tampered binaries.
+ - Permissions CA should be able to revoke certificates in case credentials get stolen.
+
+ |
+ Mitigation risk requires additional work. |
+
+
+ - AWS Robotics and Automation is currently evaluating the feasibility of storing DDS-Security credentials in a TPM.
+ - Complete mitigation would require isolation using e.g. Snap or Docker.
+ - Deploying an application with proper isolation would require us to revive discussions around [ROS 2 launch system][ros2_launch_design_pr]
+ - Yocto / OpenEmbedded / Snap support should be considered
+
+ |
+
+
+
+ | An attacker intercepts and alters a message. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ Without SROS an attacker can modify `/goal_axis` or `trajectory_axis` messages sent through a network connection to e.g. stop the robot.
+ |
+
+
+ - Enable SROS / DDS Security Extension to authenticate and encrypt DDS communications. Message tampering is mitigated by DDS security as message authenticity is verified by default (with preshared HMACs / digital signatures)
+
+ |
+ Risk is reduced if SROS is used. |
+ |
+
+
+
+ | An attacker writes to a communication channel without
+authorization. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ Without SROS, any node can publish to any topic. |
+
+
+ - Enable SROS / DDS Security Extension to authenticate and encrypt DDS communications.
+
+ |
+ |
+ |
+
+
+
+ | An attacker listens to a communication channel without authorization. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ Without SROS: any node can listen to any topic. |
+
+
+ - Enable SROS / DDS Security Extension to authenticate and encrypt DDS communications.
+
+ |
+ Risk is reduced if SROS is used. |
+ |
+
+
+
+ | ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ DDS participants are enumerated and [fingerprinted][aztarna] to look for potential vulnerabilities. |
+
+
+ - DDS Security Governance document must set `metadata_protection_kind` to ENCRYPT to prevent malicious actors from observing communications.
+ - DDS Security Governance document mus set `enable_discovery_protection` to True to prevent malicious actors from enumerating and fingerprinting DDS participants.
+ - DDS Security Governance document must `enable_liveliness_protection` to True
+
+ |
+ Risk is mitigated if DDS-Security is configured appropriately. |
+
+ |
+
+
+
+ | An attacker prevents a communication channel from being
+usable. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ Without SROS: any node can ""spam"" any other component. |
+
+
+ - Enable SROS to use the DDS Security Extension. This does not prevent nodes from being flooded but it ensures that only communication from allowed participants are processed.
+
+ |
+ Risk may be reduced when using SROS. |
+ |
+
+
+
+ | ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ A node can ""spam"" another node it is allowed to communicate with. |
+
+
+ - Implement rate limitation on topics
+ - Define a method for topics to declare their required bandwidth / rate.
+
+ |
+ Mitigating risk requires additional work. |
+ How to enforce when nodes are malicious? Observe and kill? |
+
+ | Embedded / Software / Communication / Remote Application Interface |
|---|
+
+ | An attacker gains unauthenticated access to the remote application interface. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ An attacker connects to the H-ROS API in an unauthenticated way. Reads robot configuration and alters configuration values. |
+
+
+ - Add authentication mechanisms to the H-ROS API.
+ - Enable RBAC to limit user interaction with the API.
+
+ |
+ Risk is mitigated. |
+ |
+
+
+ | An attacker could eavesdrop communications to the Robot’s remote application interface. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ An attacker executes a MitM attack, eavesdropping all unencrypted communications and commands sent to the API. |
+
+ Encrypt the communications through the usage of HTTPS.
+ |
+ Risk is mitigated. |
+ |
+
+
+ | An attacker could alter data sent to the Robot’s remote application interface. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ An attacker could execute a MitM attack and alter commands being sent to the API. |
+
+ Encrypt the communications through the usage of HTTPS.
+ |
+ Risk is mitigated. |
+ |
+
+ | Embedded / Software / OS & Kernel |
|---|
+
+
+ | An attacker compromises the real-time clock to disrupt the kernel RT scheduling guarantees. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✓ |
+ ✘/✓ |
+ A malicious actor attempts to write a compromised kernel to /boot |
+
+
+ - Enable verified boot on Uboot to prevent booting altered kernels.
+ - Use built in TPM to store firmware public keys and define an RoT.
+
+ |
+ Risk is mitigated. |
+ |
+
+
+
+ | An attacker compromises the OS or kernel to alter robot data. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✓ |
+ ✘/✓ |
+ A malicious actor attempts to write a compromised kernel to /boot |
+
+
+ - Enable verified boot on Uboot to prevent booting altered kernels.
+ - Use built in TPM to store firmware public keys and define an RoT.
+
+ |
+ Risk is mitigated. |
+ |
+
+
+
+ | An attacker compromises the OS or kernel to eavesdrop on robot
+data. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✓ |
+ ✘/✓ |
+ A malicious actor attempts to write a compromised kernel to /boot |
+
+
+ - Enable verified boot on Uboot to prevent booting altered kernels.
+ - Use built in TPM to store firmware public keys and define an RoT.
+
+ |
+ Risk is mitigated. |
+ |
+
+| Embedded / Software / Component-Oriented
+Architecture |
|---|
+
+
+ | A node accidentally writes incorrect data to a communication
+channel. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ A node writes random or invalid values to the /goal_axis topics. |
+
+
+ - Expand DDS IDL to allow users to embed validity criteria to automate input sanitization (i.e. validate ranges, etc.)
+ - Expand RMW to define per-topic strategies for invalid messages (drop, throw, abort, etc.).
+
+ |
+ Need to expand DDS IDL or RMW for mitigating the risk. |
+ |
+
+
+ | ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ A node could to write out of physical bounds values to the `/goal_axis` or `/trajectory_axis` topics, causing damage to the robot. |
+
+ - Define physical limitations of the different joints on the motor driver, limiting the possible movement to a safe range.
- Enable signature verification of executables to reduce the risks of inserting a malicious node.
- Limit control of actuators to only the required nodes. Enable AppArmor policies to isolate nodes.
+
+ |
+ Risk is mitigated when applying limits on actuator drivers. |
+ |
+
+
+
+ | An attacker deploys a malicious node on the robot. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✓ |
+ ✓ |
+ ✘/✓ |
+ An attacker deploys a malicious node to the robot. This node performs dangerous movements that compromise safety. The node attempts to perform physical or logical damage to the modules. |
+
+
+ - Run each node in an isolated environment with limited privileges(sandboxing).
+ - Enable signing and verification of executables.
+
+ |
+
+ - Running the component in a Ubuntu Core sandbox environment could limit the consequences of the attack.
+ - Enabling signature verification of executables would reduce the risks of inserting a malicious node.
+ - Limiting control of actuators to only the required nodes would reduce risk in case of a node compromise. Enable AppArmor policies to isolate nodes.
+ |
+ |
+
+
+
+ | An attacker can prevent a component running on the robot from executing
+normally. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘/✓ |
+ A malicious node running on the robot starts sending kill requests to other nodes in the system, disrupting the normal behaviour of the robot.
+ |
+ Having the abiliy to shutdown/kill nodes through API request supposes a problem on the ROS implementation. Deprecation of the function should be considered. Node restarting policie should be applied.
+ |
+ Deprecation of the shutdown API call needs to be considered. |
+
+
+ | Embedded / Software / Configuration Management |
|---|
+
+
+ | An attacker modifies configuration values without authorization. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ Node parameters are freely modifiable by any DDS domain participant. |
+ |
+ |
+ |
+ |
+
+
+
+ | An attacker accesses configuration values without authorization. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ Node parameters values can be read by any DDS domain participant. |
+ |
+ |
+ |
+ |
+
+
+
+ | A user accidentally misconfigures the robot. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ Node parameters values can be modified by anyone to any value. |
+ |
+ |
+ |
+ |
+
+
+ | Embedded / Software / Data Storage (File System) |
|---|
+
+
+ | An attacker modifies the robot file system by physically acessing it. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘/✓ |
+ An attacker modifies the filesystem data within the robot |
+ Enable filesystem encryption with LUKS or dm-crypt, storing keys on TPM device. |
+ Risk is mitigated. |
+ |
+
+
+
+ | An attacker eavesdrops on the robot file system by physically accessing it. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘/✓ |
+ An attacker physically accesses the memory chip to eavesdrop credentials, logs or sensitive data. |
+ Enable filesystem encryption with LUKS or dm-crypt, storing keys on TPM device. |
+ Risk is mitigated. |
+ |
+
+
+
+ | An attacker saturates the robot disk with data. |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✓ |
+ ✓ |
+ ✓ |
+ A malicious node writes random data that fills the robot disk.
+ |
+ Enable disk quotas on the system. Enable sandboxing of the processes. Separate disk into multiple partitions, sending non trivial data to temporary directories. |
+ Risk is partially mitigated. Disk cleanup routines and log rotation should also be implemented. |
+ |
+
+
+ | Embedded / Software / Logs |
|---|
+
+
+ | An attacker exfiltrates log data to a remote server. |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘/✓ |
+ An attacker compromising the OTA server could request device log data and eavesdrop sensitive information. |
+ Enable RBAC on the OTA server, limit access to sensitive functions.
+ |
+ Risk is mitigated. |
+ |
+
+
+ | Embedded / Hardware / Sensors |
|---|
+
+
+ | An attacker spoofs a robot sensor (by e.g. replacing the sensor itself or manipulating the bus). |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘/✓ |
+ An attacker could physically tamper the readings from the sensors.
+ |
+ Add noise or out-of-bounds reading detection mechanism on the robot, causing to discard the readings or raise an alert to the user. Add detection of sensor disconnections.
+ |
+ Risk is mitigated. |
+ |
+
+
+ | Embedded / Hardware / Actuators |
|---|
+
+
+ | An attacker spoofs a robot actuator. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ An attacker could insert a counterfeit modular joint in the robot, compromising the whole system (e.g. a modified gripper). |
+ - Implement network access control systems, performing a verification of the part before granting access to the system.
- Implement certificate based, 802.1x authentication for the communication with the nodes, discarding any new modules that do not authenticate on the system.
+ |
+ Risk is mitigated. |
+ Additional evaluation should be performed. Authenticating nodes via certificates would require shipping the nodes with client certificates, and the validated manufacturers would require a subordinate CA to sign their modules.(Kinda DRM-ish) |
+
+
+
+ | An attacker modifies the command sent to the robot actuators. (intercept & retransmit) |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ An attacker intercepts the communication channel traffic. The command is altered an retransmitted to the target joint. |
+ - Implement network access control systems, performing a verification of the part before granting access to the system.
- Implement certificate based, 802.1x authentication for the communication with the nodes, discarding any new modules that do not authenticate on the system.
|
+ Risk is mitigated. |
+ |
+
+| Embedded / Hardware / Communications |
|---|
+
+
+ | An attacker connects to an exposed debug port. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ An attacker could connect to an exposed debug port and gain control over the robot through the execution of arbitrary commands. |
+
+
+ - Limit access or remove exposed debug ports.
+ - Disable local debug terminals and functionality from the ports.
+ - Add authentication mechanisms to limit access to the ports only to authenticated devices and users.
+
+ |
+ Risk is mitigated. |
+ |
+
+
+
+ | An attacker connects to an internal communication bus. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘/✓ |
+ An attacker could connect to an internal communication bus to send arbitrary data or eavesdrop communication between different components of the robot. |
+
+
+ - Limit access or remove unused communication ports.
+ - Physically limit access to the internal robot components and communication buses.
+ - Add physical tamper detection sensors to detect physical intrussions to the robot.
+
+ |
+ Risk is mitigated. |
+ |
+
+
+ | Remote / Software Deployment |
|---|
+
+
+ | An attacker spoofs the deployment service. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘/✓ |
+ An attacker spoofs the update deployment server and serves malicious content to the devices. |
+ - Validate the deployment server through Public Key Infrastructure.
- Prevent insecure connections to the server from the devices through HTTPS and HSTS policies.
- Certificate pinning on devices.
+ |
+ Risk is mitigated. |
+ |
+
+
+
+ | An attacker modifies the binaries sent by the deployment service. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘/✓ |
+ An attacker intercepts the communication to the deployment server and serves malicious content to the devices.
+ |
+ - Validate the deployment server through Public Key Infrastructure.
- Prevent insecure connections to the server from the devices through HTTPS and HSTS policies.
+- Digitally sign the binaries sent to the devices.
+ |
+ Risk is mitigated. |
+ |
+
+
+
+ | An attacker intercepts the binaries sent by the depoyment service. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘/✓ |
+ An attacker intercepts the update communication and stores the binary sent to the devices, gaining access to intellectual property.
+ |
+ - Make use of secure, encrypted communication channels.
- Verify client devices through client certificates.
+- Sign and Encrypt update files.
+ |
+ Risk is mitigated. |
+ |
+
+
+
+ | An attacker prevents the robot and the deployment service from communicating. |
+ ✓ |
+ ✓ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✘ |
+ ✓ |
+ ✘ |
+ ✘/✓ |
+ An attacker blocks the robots update process. |
+
+
+ - Deploy multiple update server endpoints.
+ - Deploy a distributed update system.
+
+ |
+ Risk is partially mitigated. |
+ |
+
+
+