Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics
Researchers show a single ROS 2 environment variable lets attackers inject fake telemetry and hijack robots while spoofing downstream remote attestation.
A pre-built hook loaded via one modified environment variable covertly intercepts and injects both telemetry and control signals before publication in ROS 2, breaking the physical-to-digital trust boundary in multi-robot task handovers. Attackers can also distribute compromised third-party Docker containers and auxiliary tools embedding the hooks. On a physical Franka Emika arm running Secure ROS 2, the attack injects fabricated telemetry in real time with roughly 3 ms jitter and achieved an 87% success rate even against an AI-based detector. Findings were responsibly disclosed to the ROS 2 development team.
- Attack defeats remote attestation by spoofing sensor telemetry in real time
- Supply-chain spread via compromised Docker packages with embedded hooks
- Preserves temporal synchronization and hardware integrity during spoofing
- Demonstrated physically on a Franka Emika robotic arm
- Vendors
- ROS 2Franka EmikaDocker
- Products
- ROS 2Secure ROS 2
- Organizations
- ROS 2 development team
From the original article
1 min read at arxiv.orgIn multi-robot collaboration, task handovers rely on downstream verifiers performing remote attestation, which inspects sensor telemetry to ensure a robot's physical behavior strictly matches its assigned task. But can this telemetry be trusted? We show that it often cannot.
By Leming Shen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.