The Future of Household Robots: Ensuring the Safety and Privacy of - PowerPoint PPT Presentation

The Future of Household Robots: Ensuring the Safety and Privacy of Users T a m a r a D e n n i n g C y n t h i a M a t u s z e k K a r l K o s c h e r J o s h u a R . S m i t h T a d a y o s h i K o h n o C o m p u t e r S c i e n c e a n d E n g i n e e r i n g U n i v e r s i t y o f W a s h i n g t o n

Focus of This Talk: Robots, Security, and Privacy 2  This talk is about two things:  The future of robots in the home  Computer security and privacy  To make sure we‟re all on the same page, first:  Brief background on robots  Brief background on security and privacy 11/24/2009

What is a Robot? 3  Cyber-physical system with:  Mobility  Sensors  Actuators  Some reasoning capabilities (potentially) CC images courtesy of: http://www.flickr.com/photos/bbum/133956572/, http://www.flickr.com/photos/deadair/220147470/, 11/24/2009 http://www.flickr.com/photos/cmpalmer/3380364862/

What is a Robot? 4  Cyber-physical system with:  Mobility  Sensors  Actuators  Some reasoning capabilities (potentially)  Applications:  Elder care  Physically-enabled smart home 11/24/2009

What is Security? 5  Security:  Systems behave as intended even in the presence of an adversary 11/24/2009

What is Security? 6  Security:  Systems behave as intended even in the presence of an adversary  NOT Safety:  Systems behave as intended even in the presence of accidental failures 11/24/2009

Security for Robots? 7  To understand the importance of security for robots, we give context: A brief history of computers and computer security. 11/24/2009

Timeline: Computers 8 2000 1970 1940 11/24/2009

Timeline: Computers 9 1951 UNIVAC 1946 ENIAC 1944 Colossus 2000 1970 1940 11/24/2009

Timeline: Computers 10 1984 Apple Macintosh 1982 Commodore 64 1981 IBM Personal Computer 1977 Apple II 1974 Altair 8800 2000 1970 1940 11/24/2009

Timeline: Computers 11 1990 World Wide Web 2000 1970 1940 11/24/2009

Timeline: Computers 12 2006 Twitter 2005 YouTube 2004 Facebook 1998 Google 1995 Ebay 1994 Amazon 2000 1970 1940 11/24/2009

Timeline: Computers 13 2000 1970 1940 11/24/2009

Timeline: Computers 14 Now looking at computer security… 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 15 1971 Phone Phreaking 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 16 1982 The 414s break into 60 computer systems 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 17 1986 “The Brain” Virus 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 18 1988 Morris Worm 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 19 2000 DDoS Attack 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 20 • Rootkits 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 21 • Rootkits • Trojan Horses 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 22 • Rootkits • Trojan Horses • Botnets 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 23 • Rootkits • Trojan Horses • Botnets • Phishing 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 24 • Rootkits • Trojan Horses • Botnets • Phishing • Keyloggers 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 25 • Rootkits • Trojan Horses • Botnets • Phishing • Keyloggers • Cross-Site Scripting 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 26 • Rootkits • Trojan Horses • Botnets • Phishing • Keyloggers • Cross-Site Scripting • etc. 2000 1970 1940 11/24/2009

Timeline: Computer Security Attacks 27 Observations: • The attack rate increases • The attacks lag behind the technology 2000 1970 1940 11/24/2009

Timeline: Robots 28 1979 Robotics Institute founded at Carnegie Mellon University 2020 2000 1960 11/24/2009

Timeline: Robots 29 1982 WABOT-2 accompanies people on a keyboard instrument 2020 2000 1960 11/24/2009

Timeline: Robots 30 1986 Honda founds Humanoid Robot Division 2020 2000 1960 11/24/2009

Timeline: Robots 31 1999 AIBO 2020 2000 1960 11/24/2009

Timeline: Robots 32 2000 ASIMO 2020 2000 1960 11/24/2009

Timeline: Robots 33 2001 Paro therapeutic seal 2020 2000 1960 11/24/2009

Timeline: Robots 34 2002 Roomba 2020 2000 1960 11/24/2009

Timeline: Robots 35 2005 Actroid Android 2005 Wakamaru Companion Robot 2020 2000 1960 11/24/2009

Timeline: Robots 36 2008 Okonomiyaki Robot 2020 2000 1960 11/24/2009

Timeline: Robots 37 2010 ? HAL exoskeleton 2020 2000 1960 11/24/2009

Timeline: Robots 38 2020 2000 1960 11/24/2009

Timeline: Robot Security 39 Observation: • No attacks on robot security yet Recall (computer security): • The attack rate increases • The attacks lag behind the technology What is the future of robot security? 2020 2000 1960 11/24/2009

Robot Security and Privacy in Context 40  Our focus: Robot security and privacy  Evil people doing bad things with robots  Most likely near term security and privacy threat 11/24/2009

Robot Security and Privacy in Context 41  Our focus: Robot security and privacy  Evil people doing bad things with robots  Most likely near term security and privacy threat  Evil robots  Popular topic of science fiction  Unlikely near term security and privacy threat  Other challenges to mixing humans with robots  Safety  Human-robot interaction 11/24/2009

Talk Outline 42 Part 1. Introduction Part 2. Assessing the Risks: Today and Tomorrow Part 3. Challenges and Next Steps 11/24/2009

Understanding Current and Future Risks: The Computer Security Approach 43 Identify representative examples of future tech  Assess the security and privacy vulnerabilities of  those examples Determine risks for today and extrapolate risks for  tomorrow 11/24/2009

There are many household robots for sale… 44  How to pick which robots to study? Roomba (vacuum) Scooba (mop) Robomow (lawn mower) Pleo (artificial Lego Mindstorm NXT FlyTech Bladestar lifeform toy) (toy and learning kit) (flying toy) 11/24/2009

Axes for Selecting Representatives Robots 45  Strategy: Pick robots that span likely properties of future robots  Different Groups of Intended Users  Mobility  Actuators  Sensors  Communication Methods 11/24/2009

Our Selection: Spanning the Axes 46 RoboSapien V2 Rovio Spykee Robots purchased for experimentation during or before October 2008. 11/24/2009

RoboSapien V2 47 • Toy for children and hobbyists • Mobile, bipedal • Basic Dexterity • Controlled by IR remote • Some autonomous behavior • Pre-programmed speech 11/24/2009

Rovio 48 • For adults • Telepresence • Home surveillance • Check up up on relatives • Follows pre-programmed IR beacons 11/24/2009

Spykee 49 • Toy for children • Assembled and configured by children • Telepresence: Parent can tuck in kids when out of town • “Spy” robot 11/24/2009

50 So, what vulnerabilities did we find? 11/24/2009

51 So, what vulnerabilities did we find? Focusing on Spykee and Rovio for now (we‟ll come back to RoboSapien V2 later) 11/24/2009

Remote Discovery 52 (Artificial data -- not real locations of robots) 11/24/2009

Eavesdropping (shown in ad hoc mode) 53 Neighbor or Hacker in a car 11/24/2009 CC images courtesy of: http://www.flickr.com/photos/wwworks/3039389897/, http://www.flickr.com/photos/jamimages/83601411/

Intercepting Credentials (Remote Mode) 54 254757324 523476784 561436546 456436345 09867028 09867028 934149871 User: 934149871 alice1 358357619 358357619 035602844 Password: 035602844 pass1 http://spykeeworld.com 11/24/2009

Physical Takeover 55  With credentials: Drive the robot anywhere  Access the AV stream at any time 11/24/2009

What the vulnerabilities mean to people… 56  We discussed some vulnerabilities…  What do these vulnerabilities mean to people and their environment? 11/24/2009

What the vulnerabilities mean to people… 57  We discussed some vulnerabilities…  What do these vulnerabilities mean to people and their environment?  (We did not implement these attacks.) Many risks today are minor. We explore attack scenarios because they illustrate potential future risks with household robots. 11/24/2009

Rovio: Spy on Home 58  Spy/eavesdrop in the home Many risks today are minor. We explore attack scenarios because they illustrate potential future risks with household robots. 11/24/2009 CC image courtesy of: http://www.flickr.com/photos/3mieszczanka/3253181023/

Rovio: Spy on Home 59  Spy/eavesdrop in the home Many risks today are minor. We explore attack scenarios because they illustrate potential future risks with household robots. 11/24/2009 CC image courtesy of: http://www.flickr.com/photos/arthurohm/1977354073/