ZeroHour
Product

ROS 2

0 mentions in 7 days · 2 in 30 days · 2 total · first seen · last

Timeline

Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics

Researchers show a single ROS 2 environment variable lets attackers inject fake telemetry and hijack robots while spoofing downstream remote attestation.

A pre-built hook loaded via one modified environment variable covertly intercepts and injects both telemetry and control signals before publication in ROS 2, breaking the physical-to-digital trust boundary in multi-robot task handovers. Attackers can also distribute compromised third-party Docker containers and auxiliary tools embedding the hooks. On a physical Franka Emika arm running Secure ROS 2, the attack injects fabricated telemetry in real time with roughly 3 ms jitter and achieved an 87% success rate even against an AI-based detector. Findings were responsibly disclosed to the ROS 2 development team.

arXiv cs.CR · 7d agoVulnerability1

Adaptive Bridge: A Proxy-Based Decoupling Layer for Mitigating DDS Backpressure in ROS 2

Adaptive Bridge proxy isolates degraded ROS 2 DDS subscribers, cutting critical p95 tail latency from up to 15 seconds to 1.55 milliseconds.

In ROS 2 systems using DDS, a single impaired RELIABLE-topic subscriber can create backpressure that degrades throughput and latency for all subscribers sharing a publisher, including safety-critical ones. Adaptive Bridge acts as a proxy that splits topics and republishes to independent RELIABLE and BEST EFFORT DDS writers, isolating degraded nodes while a probe-based classifier monitors subscriber health and dynamically adjusts rate limits with hysteresis. Under a Gilbert-Elliott bursty wireless loss model in a reproducible Docker harness, the critical subscriber tail p95 latency falls from up to 15 s to 1.55 ms across all impairment severities. This robotics systems work is tangential to the cyber/AI dashboard scope.

Hugging Face daily papers · 10d agoOther

Appears with

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.