Investigating Data Injection and Localization Spoofing in ROS2 Mobile Robotics

Abstract

Mobile Robotic applications using the ROS2 framework use a variety of components that range from sensor data to navigation components. Some of these components, such as localization, rely heavily on sensor data. It is a common method to deploy these modules in docker containers, that communicate over the network on the IP stack. Therefore, maliciously injected data may pose a considerable issue for the robots involved. ROS2 supports an additional security layer, SROS2, but to show basic vulnerabilities, no form of security implementation has been used in this work. This paper not only investigates scenarios concerning manipulating the robot localization as well as tampering sensor data in the ROS2 framework, but also suggests methods how it can be prevented. To exploit this issue, nodes are developed and deployed in combination with ARP Spoofing to create attack vectors on a system. The presented attack vectors are tampering with transformation (tf attack) and injecting non-existing objects (virtual object attack) in the sensor system. The results are presented using a simulated environment with multiple docker containers. These issues could be prevented by implementing mitigation tactics which are presented in the results. The tools and software developed are made publicly available.