August 24, 2017 By Shane Schick 2 min read

A string of security weaknesses in areas such as default configurations, authentication mechanisms and open source components could enable cybercriminals to easily take over robots used in industrial settings, researchers warned.

An analysis of major industrial and collaborative robots, or cobots, by IOActive revealed close to 50 vulnerabilities that, if exploited, could harm the people who work with them. The firm created a series of videos to demonstrate what tampering with cobots could look like, including swinging robotic arms that have had safety features and emergency settings disabled.

Industrial Cobots Put Workers at Risk

The general public might not be familiar with cobots, but they are far more advanced than you might expect. Companies such as Rethink Robotics, Baxter/Sawyer and Universal Robots have designed cobots to assist human employees with various tasks, using microphones and cameras to see and hear, SecurityWeek reported. That potentially makes them even more dangerous if threat actors hijack them for malicious purposes.

Some of the biggest security holes the researchers discovered involve the way industrial cobots communicate, according to The Daily Mail, as well as poor password protection and lack of authentication. The research concluded that, in some cases, cybercriminals could gain remote access privileges with relative ease, giving them the ability to crush human skulls with a mechanical arm, for example.

Protecting Cobots From Cybercriminals

Bloomberg contacted several of the cobot manufacturers called out in the research, some of which said they were aware of the findings and were already working on fixes. A few did not respond or were unable to confirm whether all the potential holes had been patched. Given how widely cobots are being deployed in many industrial environments, however, there may be more pressure from customers to ensure that they’re safe from cybercriminals.

Even if cobots aren’t manipulated to attack human beings, they could also be used to spy on organizations, Threatpost suggested. Of course, there have been no reports of any such incidents yet.

As more companies are starting to pay attention to security risks associated with the Internet of Things (IoT), cobots may become another endpoint that requires increased vigilance as threat actors learn more about the potential to turn them to their advantage.

More from

Ransomware payouts hit all-time high, but that’s not the whole story

3 min read - Ransomware payments hit an all-time high of $1.1 billion in 2023, following a steep drop in total payouts in 2022. Some factors that may have contributed to the decline in 2022 were the Ukraine conflict, fewer victims paying ransoms and cyber group takedowns by legal authorities.In 2023, however, ransomware payouts came roaring back to set a new all-time record. During 2023, nefarious actors targeted high-profile institutions and critical infrastructure, including hospitals, schools and government agencies.Still, it’s not all roses for…

What should an AI ethics governance framework look like?

4 min read - While the race to achieve generative AI intensifies, the ethical debate surrounding the technology also continues to heat up. And the stakes keep getting higher.As per Gartner, “Organizations are responsible for ensuring that AI projects they develop, deploy or use do not have negative ethical consequences.” Meanwhile, 79% of executives say AI ethics is important to their enterprise-wide AI approach, but less than 25% have operationalized ethics governance principles.AI is also high on the list of United States government concerns.…

Hive0051 goes all in with a triple threat

13 min read - As of April 2024, IBM X-Force is tracking new waves of Russian state-sponsored Hive0051 (aka UAC-0010, Gamaredon) activity featuring new iterations of Gamma malware first observed in November 2023. These discoveries follow late October 2023 findings, detailing Hive0051's use of a novel multi-channel method of rapidly rotating C2 infrastructure (DNS Fluxing) to deliver new Gamma malware variants, facilitating more than a thousand infections in a single day. An examination of a sample of the lures associated with the ongoing activity reveals…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today