眼见未必为实：打破机器人物理到数字的信任边界

中文摘要 AI 辅助

在多机器人协作中，任务交接依赖于下游验证者执行远程证明，该过程检查传感器遥测数据以确保机器人的物理行为严格匹配其分配的任务。但这份遥测数据能信吗？我们证明，它往往不可信。在本文中，我们揭示了机器人操作系统（ROS）2中的一个严重漏洞：通过修改单个环境变量，攻击者可以执行一个预构建的钩子，在遥测和控制信号发布之前秘密拦截并注入这些信号。因此，攻击者可以劫持机器人执行危险任务，同时用合成的虚假遥测数据欺骗下游验证者。更糟糕的是，通过利用对第三方Docker容器和辅助工具的广泛依赖，攻击者可以分发嵌入这些恶意钩子的受损软件包，从而轻松发起此类攻击。在运行Secure ROS 2的实体Franka Emika机械臂上，我们的攻击以仅约3毫秒的抖动实时注入伪造的遥测数据，保持了时间同步和硬件完整性，同时即使面对基于AI的检测器也实现了87%的成功率。我们已负责任地将这些发现披露给ROS 2开发团队。我们准备了一个演示视频，可在该https URL获取。

英文摘要

In multi-robot collaboration, task handovers rely on downstream verifiers performing remote attestation, which inspects sensor telemetry to ensure a robot's physical behavior strictly matches its assigned task. But can this telemetry be trusted? We show that it often cannot. In this paper, we uncover a severe vulnerability in Robot Operating System (ROS) 2: by modifying a single environment variable, an adversary can execute a pre-built hook to covertly intercept and inject both telemetry and control signals before they are published. Consequently, adversaries can hijack a robot to perform dangerous tasks while spoofing downstream verifiers with synthesized fake telemetry. Worse still, by exploiting the widespread reliance on third-party Docker containers and auxiliary tools, attackers can distribute compromised packages embedded with these malicious hooks to launch such attacks easily. On a physical Franka Emika robotic arm running Secure ROS 2, our attack injects fabricated telemetry in real time with only around 3 ms of jitter, preserving temporal synchronization and hardware integrity while achieving an 87% success rate even against an AI-based detector. We have responsibly disclosed these findings to the ROS 2 development team. We prepared a demo video available at https://youtu.be/ExeiGqUrnhQ.

发表机构

• University College London（伦敦大学学院）
• The Hong Kong Polytechnic University（香港理工大学）

机构由 AI 辅助整理，请以论文原文为准。