[@BennJordan] Robot Dogs Are A Security Nightmare

Link: https://youtu.be/lA8WuXDXfcI

Duration: 23 min

Transcript: Download plain text

Short Summary

A security researcher demonstrates critical vulnerabilities in Unitree robot dogs deployed by police departments across the US, showing how attackers can hijack the robots via Bluetooth, disable them remotely, and access their cameras and microphones without authentication. The robots contain a sophisticated hidden backdoor sending encrypted data to Chinese servers, which the researcher believes represents intentional design rather than accidental security flaw, leading to a US military warning while police and third-party vendors like Atlanta's Undaunted must choose between patching security holes or risking foreign remote access. The researcher recommends never updating firmware and developed workarounds for affected customers, while raising concerns about how robot dogs may displace crime rather than reduce it.

Key Quotes

1. "Can I hack into the audio and video feeds and spy on people? Can I turn it into a synthesizer? Can I make a $5 kill switch for the dog? Can I take full control of the dog? Would these robots happen to be secretly sending encrypted data to Chinese servers through a hidden backdoor connection? Turns out that the answer to all of these questions is YOU BETCHA." (00:00:57)
2. "Not only are businesses, governments, and militaries spending insane amounts of money on unreliable, heavy, dangerous autonomous robot dogs, but they're doing so while ignoring laughable security standards. If you ask me, it's a disaster waiting to happen." (00:00:25)
3. "In plain English, this confirms that some if not all unitary robots are intentionally and secretly sending heavily encrypted information to Chinese servers and going to great lengths to prevent anyone from finding out about it." (00:00:18)
4. "It seems like Unitry has put far more work into offiscating the back door than they have securing the robots themselves." (00:00:50)
5. "And it's some of the most sophisticated malware that I've ever seen." (00:00:17)

Detailed Summary

Deployment and Use Cases

Unitree robot dogs are being deployed by law enforcement and security companies across multiple US cities including Atlanta, Port St. Lucie, Pullman Washington, Topeka, and Portland. Atlanta, described as the most surveilled city in America, has Undaunted (an Atlanta company) managing robot dogs in construction sites, public parks, and low-income housing complexes, where call center workers remotely instruct trespassers to leave before police are called. The US military has also shown media footage of Unitree robots in use, while Chinese forces have been observed strapping weapons to them and Ukrainian forces are using them to locate unexploded munitions.

Security Vulnerabilities Demonstrated

The researcher achieved complete control over Unitree robots including movement, audio/video recording, download, and live streaming without an authenticated app connection by exploiting poor Bluetooth authentication. Through software-defined radio, the researcher reproduced remote control signals to send robots into damping mode, disabling them entirely with just a laptop or Android phone on recent firmware. Custom chat modes (Bambambam Dog/Benben Dog) that use a customized ChatGPT API were shown to conflict with built-in safety mechanisms, allowing code execution on the device and disclosure of API information. The LiDAR sensor placement on the head rather than top center creates a blind spot causing robots to back into obstacles in safety avoidance mode.

Hidden Backdoor and Chinese Data Transmission

The most significant finding is a sophisticated backdoor mechanism running outside the normal operating system that sends encrypted data to Chinese servers including IPs in Odessa, Ukraine, affecting all firmware versions and submodels. Network analysis revealed hidden connections to Leapfrog server in San Jose, China public DNS servers, Alibaba Cloud, and 10 cents DNS for verification, with sandbox detection that blocks Chinese IPs when being analyzed. The researcher states Unitree put more work into obfuscating the backdoor than securing the robots themselves and cannot think of a non-horrifying reason for its existence.

Government Response and Mitigation

MITER recognized the Unitree backdoor vulnerability for over a year, and the US military issued a warning about using Unitree products in military operations, though no other government action was found. The researcher reached out to third-party companies including Undaunted to show them how to patch the backdoor tunnel by modifying their doghouse hub to block traffic with packets large enough to initialize an encrypted handshake. A catch-22 exists where police, military, and third-party vendors must choose between patching security holes that prevent remote control, or allowing potential foreign government remote access.

Pricing and Equipment Specifications

The Go2 Pro robot dog costs around $3,000, while the Go2 Edu model required for customizing or writing advanced code costs up to $22,000, and robot guard dog security services cost approximately $3,000 per month. The Unitree robot contains an 8-core CPU with multiple Wi-Fi and Bluetooth radios, which the researcher exploited to install voice synthesis library and other tools. The researcher placed a $10 ESP32 chip inside the robot using a hidden USB port to control additional radios, enabling potential remote hacking of nearby devices.

Researcher Recommendations

The researcher recommends never updating firmware again, as updates could re-enable rooting and lose the ability to detect/block the backdoor or write custom services to prevent exploitation. Beyond the specific vulnerabilities, the speaker argues that localized security measures like robot dogs may not reduce crime overall but rather displace it to communities that cannot afford such solutions.