Ros 2 vulnerability lets attackers fake robot sensor signals remotely
Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics
RoboticsCryptography and Security
Summary
Robots sometimes work together, trusting that their sensor data shows what they really do. This paper shows attackers can sneak in fake data by changing just one setting in ROS 2, a common system robots use. That lets them secretly make a robot do dangerous things while pretending everything is normal. The authors tested this trick on a real robot arm and found it could fool even advanced AI detectors.
What this means in practice
- •For robotics developers: Detect and defend against covert manipulation of telemetry data in robots running ROS 2 to improve multi-robot task trustworthiness.
- •For cybersecurity teams: Audit third-party Docker containers and ROS 2 environments to prevent hidden hooks that allow attackers to spoof robot behavior remotely.
Authors
Leming Shen, Shikai Geng, Yuanqing Zheng, Chris Xiaoxuan Lu
Abstract
In multi-robot collaboration, task handovers rely on downstream verifiers performing remote attestation, which inspects sensor telemetry to ensure a robot's physical behavior strictly matches its assigned task. But can this telemetry be trusted? We show that it often cannot. In this paper, we uncover a severe vulnerability in Robot Operating System (ROS) 2: by modifying a single environment variable, an adversary can execute a pre-built hook to covertly intercept and inject both telemetry and control signals before they are published. Consequently, adversaries can hijack a robot to perform dangerous tasks while spoofing downstream verifiers with synthesized fake telemetry. Worse still, by exploiting the widespread reliance on third-party Docker containers and auxiliary tools, attackers can distribute compromised packages embedded with these malicious hooks to launch such attacks easily. On a physical Franka Emika robotic arm running Secure ROS 2, our attack injects fabricated telemetry in real time with only around 3 ms of jitter, preserving temporal synchronization and hardware integrity while achieving an 87% success rate even against an AI-based detector. We have responsibly disclosed these findings to the ROS 2 development team. We prepared a demo video available at https://youtu.be/ExeiGqUrnhQ.