# Analyzing Impact and Systemwide Effects of the SlowROS Attack in an Industrial Automation Scenario
## 6 Tests, Results, and Analysis
### Identification of the Connection Timeout Used by the ROS Master
* The time required by the server to return either an error indication or a method response, from the reception of the connection closure packet from the client. * The final application server response when the connection is closed, for both HTTP and XML protocol layers, which does not affect \(T_{i}\) assessment but will be further discussed in Section 6.3. The rationale behind the partial payloads used for the tests is that, in test 1, nothing is sent, to make the server process wait for HTTP headers. Differently, in test 2, the server receives a valid POST request and reassembles the remaining HTTP headers. Instead, in test 3, the server waits for an XML-RPC request to start, while in test 4, the server reassembles an XML-RPC request that contains an invalid token. Test 5 is similar to test 4, but the partial XML-RPC request sent to the server is valid. In test 6, a fully valid XML-RPC request is sent to the server, but the request is one byte shorter than what the HTTP Content-Length says. All in all, these tests stops the HTTP/XML-RPC \begin{table}
\begin{tabular}{l c c c c c} \hline \hline  & & **Response** & **Response upon Close** & \\
**\# Scenario** & **Payload** & \(T_{i}\) & **Time (ms)** & **HTTP** & **XML** \\ \hline
1 Basic & \(none\) & \(\geq T_{max}\) & — & \(none\) & N/_A_ \\
2 POST only & 1–1 & \(\geq T_{max}\) & 1.44 & HTTP/1.1 500 & N/_A_ \\
3 Full HTTP header & 1–7 & \(\geq T_{max}\) & 1.45 & HTTP/1.1 200 & \textless{}fault\textgreater{} \\
4 Invalid XML-RPC request 1–8 & \(\geq T_{max}\) & 1.16 & HTTP/1.1 200 & \textless{}fault\textgreater{} \\
5 Partial XML-RPC request 1–11 & \(\geq T_{max}\) & 1.84 & HTTP/1.1 200 & \textless{}fault\textgreater{} \\
6 Ending newline missing & 1–25 & \(\geq T_{max}\) & 3.42 & HTTP/1.1 200 & \textless{}methodResponse\textgreater{} \\
7 Full, valid request & 1–35 & \(\geq T_{max}\) & — & HTTP/1.1 200 _(immediate)_ & _none_ \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Tests for ROS Master Timeout Identification, \(T_{max}=3600\) s.  
payload reassembly and interpretation process performed by the server at different stages to determine the \(T_{i}\) of each stage. Finally, in test 7, the test program sends a full XML-RPC request whose length is consistent with the HTTP Content-Length, followed by silence. This test's goal is to clarify whether the server behaves differently for what concerns \(T_{i}\) while waiting for the very first XML-RPC request (as it does in test 1) rather than the next. As reported in Table 2, we find that in no tests did the ROS master close the connection on its own initiative, leading to the important conclusion that \(T_{i}\geq 3600\,\mathrm{s}\). Considering that a timeout of \(3600\,\mathrm{s}\) is typically considered quite high for this kind of protocol; this observation paved the way to suspecting that \(T_{i}\) might be infinite, at least in some cases. To further validate this hypothesis, test 1 was repeated with a longer timeout, that is, \(T_{max}=10^{9}\,\mathrm{s}\). Also in this case, the server did not close the connection until the test program was manually interrupted after about \(11.85\,\mathrm{days}\). Despite the manual interruption, the connection was closed with an FIN rather than a RST because the test program still terminated it with a close() system call, corresponding to an orderly connection shutdown from the transport point of view. This result confirms that, for all intents and purposes, the ROS Master connection inactivity timeout can be considered infinite, at least for completely inactive connections, that is, connections on which no data have been sent after establishment. It is worth mentioning that a direct communication between the attacker and the victim takes place as shown in Figure 5. A more accurate characterization of \(T_{i}\) was not performed because it would serve no practical purpose at this stage.