# Analyzing Cyber-Physical Threats on Robotic Platforms +
###### Abstract
There may also be a situation wherein the attacker makes his/her way to sensitive information or records on the robot compromising confidentiality. In the worst case, the attacker may get the location of the robot or the operator compromising their physical safety. Additionally, the attacker may know other sensitive and classified information about the operator or the corresponding military facility, which can be used to perform a terrorist operation against the operator or the corresponding military facility. Therefore, the cyber-security threats and consequences on the robotic platforms must be extensively studied and investigated. However, it is currently well-known that cyber-security for the robotic platforms is considered a big challenge because it requires an inter-disciplinary effort [5; 6]. As such, this subject is currently a major challenge for robotic and autonomous systems. Different studies on the cyber-security of the robotic platforms generally target one or more of the following aspects: physical processes, computational resources, communication capabilities, operating systems, robotic libraries or middlewares, robotic applications and sensory information. Majority of the robotic cyber-security studies have focused on the study and analysis of the security threats that target the robotic platform operating systems and their libraries/applications. For example, the main operating systems generally installed on a robot's main computer are Microsoft Windows platforms (e.g., Windows 10 or Windows 7) and Linux open source platforms (e.g., Ubuntu). These operating systems require additional libraries and software that are robotic-specific to successfully operate different types of robots. It is well known that those operating systems have several known vulnerabilities [7; 8; 9]. Some of those vulnerabilities were recently analyzed in [10] for the PeopleBot robot. The authors implemented two denial-of-service (DoS) attacks, which rendered the robot unavailable. One of the most popular studied robotic middleware for cyber-security threats is Robot Operating System (ROS), which is an open-source set of software libraries and tools for building robotics applications. ROS has several specialized branches including ROS-M, which is tailored to the unique needs of military robots. Additionally, there is ROS-INDUSTRIAL, which extends the advanced capabilities of ROS software to manufacturing. One fact about ROS is that it was designed without taking into account security protections, because it was mainly designed for research purposes. In fact, as reported in [5; 11; 12; 13; 14; 15], several security flaws were found in ROS. Additionally, malicious malware can easily interfere with ROS communications, read ongoing messages or supersede ROS nodes. It is worth mentioning that a new version of ROS is under development (known as ROS 2.0 [16]) to solve the currently identified and reported security flaws. The main objectives of this paper are to:  
* Analyze several cyber-physical security threats, which target the communication link between Adept mobile robots research/academic platforms and their clients or users [17]. * Improve safety and security of the robotic platforms, raise awareness and increase understanding of the emerging threats on the robotic platforms. To achieve the above objectives, we executed the following steps:  
* Analyzed and utilized vulnerabilities in the communication link and other vulnerabilities that we discovered in MobileEyes/arnlServer client/server robotic applications. Those applications are necessary to establish the network connection between Adept mobile robots and their clients or users [18]. * Focused our analysis on possible security and privacy issues related to mapping and localization robotic scenario. * Targeted three major security requirements, integrity, availability, and confidentiality, using an impact-oriented approach. * Developed a novel robot attack tool (RAT) responsible for carrying out security attacks on integrity, availability, and confidentiality.