Friday Rant – Rise of the Rogue-Bots? – Diginomica

(Pixabay)

The rogue robot is a familiar sci-fi trope: images of a compromised machine waving its arms and shouting Warning! Does not compute! as explosions shake the polystyrene set. But what if that rogue robot were an industrial machine in an automotive, electronics, avionics, or pharmaceuticals factory? What if it were an entire smart facility?

The question chimes with the ongoing tabloid obsession with Terminators, malignant AIs, and job-stealing robots; it seems designed to stoke public fears about the rise of machine automation, a process that has been ongoing since the Eighteenth Century. And it comes inevitably from an enterprise cybersecurity provider with something to sell, Trend Micro.

The company has produced a detailed, 45-page report, Rogue Automation: Vulnerable and Malicious Code in Industrial Programmingwhich at least grounds the issue in something prosaic and machine readable.

Ironically, the medias concerns are often rooted in a binary view of society: that anything that is on for machines must be off for humans as though there is a finite list of tasks in the world, more and more of which are being taken away from people. The real-world economy doesnt work like that; it creates new jobs, new services, new companies. But are Trend Micros fears more justified? The short answer is: yes.

The crux of the matter isnt so much the future as the past, explains the report: legacy code in proprietary industrial automation routines, allowing attackers to exfiltrate files from a robot and/or introduce malware:

We examined 100 open-source automation programs for robots and discovered that most of them were affected by vulnerabilities that could allow an attacker to control or disrupt a robots movements. Fortunately, the most critical ones remote function execution vulnerabilities were in demonstrator code. We hope that no one has ever used that code to teach class or, worse, derive production code.

Indeed, but the report goes onto explain that programmers in this field tend to copy and paste code, causing vulnerabilities to propagate across open-source projects, sometimes even into commercial, mission-critical products. An interesting use of hope, then.

The report explains:

Our findings are relevant to the modern and future factory because the flaws we found are descended from design choices made decades ago. These decisions determined the technology, techniques, and tools that are still used today to program industrial machines.

What does this mean? To create an assembly line in a factory, designers have little choice but to rely on custom, proprietary, or legacy programming languages, few of which have been designed with an active-attacker model in mind, says Trend Micro:

Some lack features, such as cryptographic functions, that are essential to implementing modern security measures. The platforms offered by some vendors do implement a few security mechanisms, most of which are bolt on and do not integrate well with the programming environment.

As a result, while the operating system may have security features such as authentication and access control, the programming layer is a black box with no fine-grained security control. This leaves it open to attackers.

In short, vendors have locked customers in to antiquated code, but not out of malice. The problem then becomes that it is impractical to fix these design flaws, because legacy programming environments cant be easily ripped out and replaced in manufacturing any more than they can in healthcare, another sector where highly regulated systems are being networked that were never designed to be.

Nick Tudor is Director of D-RisQ, a company specialising in assurance and trust systems for robotics. He tells me that it is this exposing of systems to the networked world that creates unnecessary problems:

If they are air-gapped, none at all [threats], but a big problem is if they start hooking them up to the net. Some are now considering adding 5G to these machines in various ways. The attack surface is about to get significantly larger.

At this point we should look at the big picture: the threat outside the factory walls, rather than lurking in the code or the bare metal. Are malicious actors actually targeting factories and other industrial systems? The answer again is: yes.

Reports published earlier this year by SonicWall, Dragos, and others, revealed that hackers are increasingly targeting the Internet of Things (IoT) and industrial control systems (ICS), including with new ransomware variants that lock up ICS functions and demand cryptocurrency payments. These came to light between December 2019 and February. Since then, the world has had other problems to contend with.

Meanwhile, Capgeminis 2020 reportSmart Factories at Scalefound that one-quarter of all manufacturers have experienced a cyber-attack on their connected systems over the last year, with the impetus behind it invariably being financial.

That report got straight to the heart of the matter. While logic dictates that it is better to design something from the ground up than to retrofit ageing systems, it is a hell of a lot more expensive:

In our previous research, we estimated the cost of setting up a new greenfield factory for a top-ten auto OEM to be between $1 billion to $1.3 billion. In comparison, the cost for a brownfield setup was estimated to be between $4 million to $7.4 million per factory.

Capgemini published other findings that contrasted starkly with the economic prize on offer: only 14 percent of the 1,000 organisations surveyed by the company described their smart factory projects as successful. Scaling programmes beyond the pilot phase can be overwhelmingly complex in IT and operational technology convergence, it found, compounded by legacy systems and a lack of skills.

So what does Trend Micro believe are the solutions to the reams of ancient code that allow modern hackers to slip into industrial systems unnoticed? Rather than simply flog its wares, the company has collaborated with Robot Operating System Industrial (ROS-Industrial), a consortium of original equipment manufacturers (OEMs) and research organisations.

Their joint recommendations are echoed by the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) of the US Cybersecurity and Infrastructure Security Agency (CISA), says Trend Micro. They include:

Network segmentation: Use proper network protection devices to isolate industrial robots that need to process data coming from other networks. This should be done with a physical cable to make spoofing possible only to an attacker who is physically on site.

Secure programming: Promote secure programming guidelines among control process engineers and programmers. This minimises the attack surface exposed by legacy automation code.

Automation code management: Know and keep track of the automation code that is produced by a system integrator and runs in the factory. This type of oversight is a fundamental prerequisite to finding, managing, and resolving vulnerabilities and other security issues, says the company.

The other issue is this: know your attacker, who is likely to be a highly skilled individual or organisation with specific knowledge of the target facility, including the industrial platform being targeted. They are likely to have the budget to set up a lab for experimentation:

The programming environments for industrial machinery make it easy for attackers to abuse any low-level system resources, because there is no differentiation between privileged and non-privileged instructions. This is in contrast to the state of almost all modern computing systems.

Danger, danger!

More:
Friday Rant - Rise of the Rogue-Bots? - Diginomica