# Analyzing Cyber-Physical Threats on Robotic Platforms +
## 4 Risk Assessment of the Robotic Platform
### Cyber-Physical Consequences  
The cyber-physical impacts of the various security attacks described previously depend on the application that the robot is running and its associated sensors. To illustrate the severity of the cyber-physical consequences, we consider the semi-autonomous mapping task using the PeopleBot robot, as shown in Figure 1. We desire to map the indoor hallways of the second floor of the engineering building at our University. The robot is remotely teleoperated using MobileEyes and armIServer. MobileEyes allows the robot to be teleoperated in the indoor hallways, while being fully monitored using its PTZ camera located on top of the 2D lidar sensor. During the robot operation, the 2D lidar data and the wheel encoders of the robot are logged into the memory of the robot's onboard computer to be processed later to create the map of the environment. All indoor hallways are fully covered with the university WiFi signal. This insures that the robot will have full coverage to all indoor hallways while being teleoperated without any concern of being disconnected from the network. The generated map will be used to navigate the robot autonomously within the hallways to perform certain tasks, such as delivering mail to various departments in the engineering college. Figure 8 shows the created map of the engineering building covering the three floors of the building. It is important to mention that, in other applications, the controlled robot might be at an assembly line, engaged in a surgical procedure, or performing a time-sensitive military task. As such, again, the physical consequences of any cyber-physical attacks on these applications can result in catastrophic outcomes. While teleoperating the robot using MobileEyes, several attacks from the attack trees in Figures 6 and 7 are performed and their impacts on integrity, availability, and confidentiality are observed. In the following, we present a short list of some of the possible physical consequences or impacts that can result from such attacks:  
* Integrity attacks can result in:
* Manipulating the behavior of the robot;
* Delaying or preventing the robot from performing its assigned task, which can be very time sensitive (e.g., delivering urgent mail);
* Hijacking the robot physically;
* Navigating the robot to unintended or unauthorized place(s);
* Denying remote access service to the robot, where the robot becomes unavailable;
* Colliding with humans or equipments, which could result in injuries and damages;
* Stealing or hijacking sensitive information on the robot; and
* Limiting or reducing certain functions on the robot. * Availability attacks can result in:
* Denying remote access service to the robot;
* Having the robot stolen;
* Having the robot physically damaged; and
* Colliding with humans or equipments, which could result in injuries and damages. * Confidentiality attacks can result in:
* Having sensitive information on the robot being hijacked and/or stolen. We should mention that we also implemented the same attacks on various simulated Adept mobile robots using MobileSim and the results were similar to the ones we got from attacking the real robot (i.e., PeopleBot). There are no differences between the results obtained from MobileSim and the real robot. In fact, our approach does not really discriminate between the two sets of experiments. We used MobileSim simulator to show that the attacks we successfully performed on the PeopleBot also applies to the rest of the robotic platforms from Adept company. Additionally, it is important to mention that the main components in the underlying robotic system to be attacked and analyzed are: the client (MobileEyes), the server (armServer), and the robot. In the case the robot is physically available, the server needs to run on the robot's main computer. However, if the robot is not physically available, MobileSim is used to only act as a virtual robot. In this case, the server needs to run on the same machine on which MobileSim runs.