0
$\begingroup$

Rosanswers logo

As far as I'm aware, when a ROS master starts up on a machine, it opens a port for any network machine to attach to. This means that any machine with a route to the ROS machine can freely ask that ROS master for anything it has control over, for example, setting up ROSTCP/UDP connections with nodes running under that master. From an exploiter's point of view, this means that one has access to many avenues of exploitation on a machine running ROS. In the worst case, if a node running with sufficient privilege can potentially allow for an exploiter to run arbitrary code on the ROS machine with administrative privileges. Even on your average case, an exploiter can ask to connect to a topic such as a velocity command on a ROS system connected to mechanical hardware and actually manipulate hardware.

Are there any security measures in place for preventing this kind of situation? If not, are there any plans for adding measures, for example: credentials, to future distros of ROS?


Originally posted by GreatSuccess on ROS Answers with karma: 78 on 2013-12-04

Post score: 6

$\endgroup$

3 Answers 3

0
$\begingroup$

Rosanswers logo

Your observations are correct. There are no authentication mechanisms that I know of.

The usual answer/solution is: Put it in a VPN.


Originally posted by dornhege with karma: 31395 on 2013-12-04

This answer was ACCEPTED on the original site

Post score: 3


Original comments

Comment by GreatSuccess on 2013-12-04:
A VPN would be fine for a single machine, but this approach could get clunky for weaker computers (i.e. running ROS on a RasberryPi, Beagleboard, Panda etc). This could also be troublesome for multi-robot systems.

$\endgroup$
0
$\begingroup$

Rosanswers logo

A VPN, which is tunneled encrypted traffic, is a good start. But, I'm concerned that users may believe that this provides all the needed cyber security for the robotic system. There are numerous other network security issues with which to contend. For instance, the VPN implementation itself may have vulnerabilities. Another major issue is that if a single node in a network of platforms connected by VPN is compromised, then that platform can serve as the conduit for an attacker to jump from one platform to the next. All within the security of the provided VPN.


Originally posted by DavidV with karma: 31 on 2015-01-22

This answer was NOT ACCEPTED on the original site

Post score: 2

$\endgroup$
0
$\begingroup$

Rosanswers logo

I know this is an old question, but I'm going to respond here for visibility.
Please check out the new SROS project for new developments to secure ROS.
You can read more about the announcement here:
http://discourse.ros.org/t/announcing-sros-security-enhancements-for-ros/536


Originally posted by ruffsl with karma: 1094 on 2016-10-15

This answer was NOT ACCEPTED on the original site

Post score: 2

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.