CoChat
Sign Up
Cited by 320Robotics and Automated SystemsAdversarial Robustness in Machine LearningInformation and Cyber Security

The DOI matches its Crossref record; 325 of the 331 references it cites were found in a registry or an index; 58 of the 275 sources its claims cite were checked for support.

Robotics cyber security: vulnerabilities, attacks, countermeasures, and recommendations

Open access
Yaacoub, Jean-Paul A., Noura, Hassan N., Salman, Ola, Chehab, Ali·2022·International Journal of Information Security
DOI 10.1007/s10207-021-00545-8PMC PMC7978470
Open this paper in CoChat — free accountOpen PDF

Abstract

The recent digital revolution led robots to become integrated more than ever into different domains such as agricultural, medical, industrial, military, police (law enforcement), and logistics. Robots are devoted to serve, facilitate, and enhance the human life. However, many incidents have been occurring, leading to serious injuries and devastating impacts such as the unnecessary loss of human lives. Unintended accidents will always take place, but the ones caused by malicious attacks represent a very challenging issue. This includes maliciously hijacking and controlling robots and causing serious economic and financial losses. This paper reviews the main security vulnerabilities, threats, risks, and their impacts, and the main security attacks within the robotics domain. In this context, different approaches and recommendations are presented in order to enhance and improve the security level of robotic systems such as multi-factor device/user authentication schemes, in addition to multi-factor cryptographic algorithms. We also review the recently presented security solutions for robotic systems.

Overview

Integrity signals

Registry

Crossref · 10.1007/s10207-021-00545-8

Cites

325 of 325 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

58 of 275 cited sources checked · 27 supported · 0 flagged · accuracy not yet measured

Show all 58 claims

  • Probably not a substantial claim. 116
  • It may state two separate claims as one. 89
  • The quote only partly states this claim. 2
172 of 172

  • The paper relies on this without support.

    Weak authentication allows attackers to gain unauthorized access through ordinary usernames and passwords.

    “Lack of proper authentication which leads to an unauthorized access using standard usernames and passwords, which can be easily trespassed by a given attacker.”

  • The paper relies on this without support.

    Weak encryption can break confidentiality, letting attackers intercept sensitive robotic data and design plans.

    “Lack of confidentiality which is due to the use of weak encryption algorithms that can be easily broken, leading to the interception and exposure of robotic sensitive data and design plans.”

  • The paper relies on this without support.

    Poor privacy can expose business deals and partnerships, damaging an organization's reputation.

    “Lack of privacy can result in the exposure of business deals and trades that can affect the reputation of a given organization, and the exposure of the collaboration between different robotic security firms.”

  • The paper relies on this without support.

    Weak message authentication can compromise integrity, allowing alteration of robotic data at rest or in transit.

    “Lack of integrity which is due to the use of weak message authentication protocols that can be easily compromised, leading to the alteration of robotic sensitive data, stored or in transit.”

  • The paper relies on this without support.

    Without strong biometric verification, privilege abuse and unauthorized access cannot be prevented.

    “Lack of verification which does not include strong biometric features to prevent any abuse of privilege or unauthorized access.”

  • The paper relies on this without support.

    Configuration errors and poor programming can stop robotic systems from completing tasks accurately, endangering operators and degrading software.

    “Misconfiguration and bad programming which may render the robotic systems and operating systems incapable of performing the intended tasks at the required accuracy level, and thus, threatening their human operators and badly affecting the software features.”

  • The paper relies on this without support.

    Without tamper-resistant hardware, robots can be damaged or destroyed, losing operational capability.

    “Lack of tamper-resistant hardware renders robots prone to damage and/or partial/total destruction, which can lead to the loss of the robot’s functional and operational capabilities.”

  • The paper relies on this without support.

    Without self-healing, robots cannot recover quickly from cascading attacks, so performance degrades.

    “Lack of self-healing processing leaves the robotic system prone to the possibly of cascading attacks with the inability to recover or react in time to prevent further degradation in its performance.”

  • The paper relies on this without support.

    Missing safety designs have caused lethal incidents and casualties, as well as financial losses.

    “Lack of safety designs is very risky and has proven in many real-case incidents to be lethal and threatening towards humans with a remarkable number of casualties and fatalities, aside the economic/financial losses.”

  • The paper relies on this without support.

    Without AI-based design, robots perform tasks less accurately and effectively.

    “Lack of AI-based designs affects the operational and functional performance of robots when being assigned a task, with both accuracy and performance being affected.”

  • The paper relies on this without support.

    Unpatched robotic operating systems, firmware, and software invite cyber-physical attacks.

    “Lack of update for the robotic operating system, firmware, and software may result in various cyber-physical attacks.”

  • The paper relies on this without support.

    Advanced intrusion detection is lacking; reliance on anomaly, behavior, or signature detection instead of hybrid, lightweight, or AI-based IDS, and on honeypots, is problematic.

    “Lack of advanced IDS solutions is also a major issue, especially when relying on intrusion detection system that either detect anomaly, behaviour or signature pattern of a given malware, rather than relying on advanced hybrid and lightweight or AI-based IDS solutions. The same is true for the use of Honeypots.”

  • The paper relies on this without support.

    Without penetration testing, deployed applications may suffer security breaches.

    “Lack of penetration testing could lead to security breaches of the deployed applications.”

  • The paper relies on this without support.

    Missing security patches raise the risk of attacks like data theft, remote access, and rootkits.

    “Lack of security patches increases the chance of basic and advanced attacks such as stealing of sensitive data, remote access, and rootkit.”

  • The paper relies on this without support.

    Insufficient training leaves coders, operators, IT staff, and executives open to social engineering, reverse engineering, and phishing.

    “Lack of personnel training is also a serious issue since personnel working in the coding robotic domain, or as human operators, or as IT or chief executives, are targeted by social engineering, reverse engineering and phishing attacks.”

  • The paper relies on this without support.

    Poor human-machine collaboration can harm human labor, work, and performance.

    “Lack of human–machine collaboration could affect the human activity in terms of labour, work, and performance.”

  • The paper relies on this without support.

    Without employee screening, an insider or whistle-blower may leak sensitive data and classified robotic details.

    “Lack of employee screening could result in having an insider attack led by a whistle-blower that leaks sensitive data and exposes classified information and sensitive robotic details.”

  • The paper relies on this without support.

    Lack of basic security measures makes robotic systems vulnerable to wired and wireless communication attacks including replay, man-in-the-middle, eavesdropping, sniffing, and spoofing.

    “Network vulnerability with the lack or the adoption of basic security measures, robotic systems are vulnerable to various wired/wireless communication and connections attacks including replay, man-in-the-middle, eavesdropping, sniffing, spoofing, etc.”

  • The paper relies on this without support.

    Lack of constant updates of software, firmware, and security patches leads to configuration and database vulnerabilities in robotic systems.

    “Platform vulnerability includes the lack of constant updates of software and firmware patches, as well as security patches to maintain a secure up-to-date robotic system. This results into also having configuration and database vulnerabilities.”

  • The paper relies on this without support.

    Applications not tested for coding or compatibility bugs can affect robotic system performance.

    “Application vulnerability applications that are not tested and evaluated for coding or compatibility bugs, can also affect the robotic system’s performance.”

  • The paper relies on this without support.

    Adopting new security measures without thorough testing can affect the performance of robotic systems and devices.

    “Security vulnerability the adoption of new security measures without thorough testing can sometimes affect the performance of both robotic systems and devices.”

  • The paper relies on this without support.

    Bad choice of security measures and lack of coding skills can be re-modified to cause errors or perform wrong tasks.

    “Bad practice vulnerability includes the bad choice of security measures and means, as well as lack of coding skills, which can be easily re-modified to cause errors or to perform the wrong tasks.”

  • The paper relies on this without support.

    The heterogeneous nature of robotic systems makes their integration prone to security issues, and their homogeneous nature leaves them prone to similar attacks with cascading effects.

    “Heterogeneity and homogeneity vulnerability the heterogeneous nature of robotic systems makes their integration prone to many security issues. Moreover, their homogeneous nature also leaves them prone to similar attacks with possibly cascading effects.”

  • The paper relies on this without support.

    Lack of advised planning, security guidelines, procedures, and policies constitutes a management vulnerability.

    “Management vulnerability includes the lack of advised planning, security guidelines, procedures and policies.”

  • The paper relies on this without support.

    Robotics threats are growing due to industrial competition, spying, and terrorism.

    “Robotics threats are growing, not only due to the concept of industrial competition, but also due spying and terrorism.”

  • The paper relies on this without support.

    Insiders are usually rogue or unsatisfied employees who aim to steal robotic confidential information, or infiltrators helping outsiders, and can cause physical damage to robotic systems.

    “Insiders (or whistle-blowers) are usually rogue or unsatisfied employees who aim to either steal robotic confidential information, or infiltrators that help outsiders to conduct their attack remotely through abuse of privilege. Insiders can also cause physical damage and destruction to robotic systems.”

  • The paper relies on this without support.

    Incompetent developers include bad manufacturers and programmers who ignore essential safety and security requirements when developing software for robots and machines.

    “Incompetent developers include bad manufacturers and programmers who do not take into consideration the essential safety and security requirements upon the development of software for robots and machines.”

  • The paper relies on this without support.

    Incompetent operators include ignorant users who do not know how to use a robot or machine well, or malicious users who try to use it for a malicious task.

    “Incompetent operators include either ignorant users who do not know how to use well a robot or a machine, or malicious users who try to use the robot/machine for a malicious task.”

  • The paper relies on this without support.

    Cyber criminals including hackers aim to put their cyber-attack capabilities into action by scanning for security gaps or software/firmware vulnerabilities and exploiting them.

    “Cyber criminals including hackers whose aim is put their cyber-attack capabilities into action via scanning for security gaps or software/firmware vulnerability and exploiting them.”

  • The paper relies on this without support.

    Organized criminals break into companies and steal robotic components, parts, designs, or architecture plans to sell on the black market to rival companies or for personal gain.

    “Organized criminals unlike cyber criminals, they break into a given company and steal robotic components, parts, designs, or architecture plan in order to sell it into the black market to rival companies, or for their own personal gains.”

  • The paper relies on this without support.

    State-sponsored hackers are recruited as a nation's cyber-army to perform defensive and offensive tasks for political influence, including hijacking military robots, leaking sensitive documents, and declassifying robotic experiments.

    “State-sponsored hackers are usually recruited as a nation’s cyber-army to perform defensive and offensive tasks to achieve political influence and gain. This can include hijacking military robots, leaking sensitive and confidential documents about lethal robot designs, or declassifying robotic documents and experiments.”

  • The paper relies on this without support.

    Robotic communications are prone to availability attacks that can jam, disrupt, or interrupt connections via de-authentication or jamming, leading to complete or partial loss of control.

    “Wireless jamming robotic communications are prone to various availability attacks that can jam, disrupt or/and interrupt its connection via either de-authentication or jamming. This leads to the complete or partial loss of controlling the robot”

  • The paper relies on this without support.

    Robotic systems are prone to reconnaissance and scanning attacks that evaluate their protection level, software, hardware, and operating systems to search for vulnerabilities to exploit in future attacks.

    “Reconnaissance and scanning robotic systems are also prone to various reconnaissance and scanning attacks that aim to evaluate their level of protection, the employed software, hardware, and operating systems, to search for a security vulnerability or gap that may be exploited in future attacks.”

  • The paper relies on this without support.

    Information disclosure can occur via physical leaking of confidential documents or remotely via cyber-attack, targeting privacy and confidentiality of robotic manufacturers, businesses, and industries.

    “Information disclosure can take place either via physical leaking of confidential documents, or remotely via a cyber-attack. Targeting both privacy and confidentiality of robotic manufacturers, businesses and industries.”

  • The paper relies on this without support.

    Assessing risks quantitatively in robotics is a challenging and complex task.

    “Assessing risks in a quantitative manner is not an easy to achieve, as it still remains a challenging complex task.”

  • The paper relies on this without support.

    A new risk assessment is needed to quantify security risks in the robotic domain.

    “Nonetheless, a new risk assessment is needed to quantify the security risks that surround the robotic domain.”

  • The paper relies on this without support.

    CTI helps mitigate harmful cyber-events through early detection and prevention.

    “The Cyber Threat Intelligence (CTI) is based on the information gathered about robotic threats and threat actors which would help in mitigating harmful cyber-events based on the Advanced Persistent Threat (APT) concept through early detection and prevention.”

  • The paper relies on this without support.

    The ASA program can greatly reduce robotic risks that cannot be easily addressed using robotic software and hardware devices.

    “The Active Security Awareness (ASA) program requires being further extended and adopted since it can greatly reduce robotic risks that cannot be easily addressed to using robotic software and hardware devices.”

  • The paper relies on this without support.

    Message authentication and encryption mechanisms help ensure secure communications between robots and their control systems.

    “Moreover, the use of message authentication and encryption mechanisms helps ensuring secure communications between robots and their control systems.”

  • The paper relies on this without support.

    Multi-factor authentication makes attack success probability low compared to single-factor authentication.

    “This makes the attack success probability low compared to only one single factor.”

  • The paper relies on this without support.

    Symmetric cryptographic protocols are more energy efficient, especially when using the optimized AES block cipher.

    “Furthermore, symmetric protocols are more energy efficient, especially when using the optimized AES block cipher.”

  • The paper relies on this without support.

    Implementing different methods of intrusion detection systems as a hybrid solution increases protection and reaction against known and unknown threats in the robotic domain.

    “It is highly important to implement different methods of intrusion detection systems (hybrid solution). This helps increasing the level of protection and reaction against known (signature method) and unknown (specification and anomaly detection methods) threats that surround the robotic domain.”

  • The paper relies on this without support.

    Honeypots can be employed as a stand-alone system.

    “Honeypots can be employed as a stand-alone system.”

  • The paper relies on this without support.

    When honeypots are employed with IDSes, they reduce both false positive and false negative rates.

    “In fact, if honeypots are employed with IDSes, they are capable of reducing both false positive and false negative rates.”

  • The paper relies on this without support.

    Honeypots ensure a high level of dynamicity and flexibility to respond to various types of attacks.

    “Moreover, they also ensure a high level of dynamicity and flexibility to respond to various types of attacks.”

  • The paper relies on this without support.

    Robots have been prone to various types of hardware attacks since their early stage of manufacturing and maintenance.

    “Robots have been prone to various types of hardware attacks, since their early stage of manufacturing and maintenance.”

  • The paper relies on this without support.

    In a robotic system, both identification and verification are essential to prevent unauthorized access to the robots control machines.

    “In a robotic system, both identification and verification are essential to prevent unauthorized access to the robots control machines.”

  • The paper relies on this without support.

    Biometric systems and techniques play a key role in robotic identification and verification.

    “Hence, biometric systems and techniques are devoted to play a key role in this context.”

  • The paper relies on this without support.

    Robotic systems are deployed in domains based on critical infrastructures.

    “Nowadays, robotic systems are being deployed and used in different domains that are based on critical infrastructures.”

  • The paper relies on this without support.

    Compression reduces the size of transmitted or stored data.

    “compression is mandatory for any communication system since it reduces the size of transmitted or stored data.”
50 of 50

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Section count conflicts with the outline

    Minor

    The paper says it has eight sections, but its outline ends with Section 7 as the conclusion. Counting the introduction and Sections 2-7 gives seven sections.

1 of 1

Citations

Cites

Flagged first, then by citations

Show all 331 references

6 of the 331 references couldn’t be matched to a known paper.

Research works printed but not linked: 25

  1. Rüßmann, M., Lorenz, M., Gerbert, P., Waldner, M., Justus, J., Engel, P., Harnisch, M.: Industry 4.0: the future of productivity and growth in manufacturing industries. Boston Consult. Group 9(1), 54–89 (2015)
  2. Cerrudo, C., Apa, L.: Hacking robots before skynet. Cybersecurity Insight, IOActive Report, Seattle, USA (2017)
  3. Gogu, G., Ray, P., Neagoe, M., Gogu, G., Diaconescu, D., Pocola, A.G., Pop, D.O., Petra, C.: Robotics and manufacturing. In: Talaba, D., Roche, T. (eds.) Product Engineering: Eco-Design, Technologies and Green Energy, p. 348. Springer, Cham (2006)
  4. Oxford Analytica. Beirut blast could bring hunger, disease and fury. Emerald Expert Briefings (2020)
  5. Ringrose, K., Ramjee, D.: Watch where you walk: law enforcement surveillance and protester privacy. Calif. L. Rev. Online 11, 349 (2020)
  6. Karnozov, V., et al.: Russia and Turkey put their latest equipment to the test in Syria. Def. Rev. Asia 14(2), 20 (2020)
  7. Scipanov, L.V., Dolceanu, D.: The opportunity for using remotely operated underwater vehicles in support of naval actions. Bull. Carol I Natl. Def. Univ. 9(3), 62–68 (2020)
  8. Westerheijden, V.R.: Remote warfare comes home: an inquiry in the Dutch government’s development of discourse on airstrikes and drones between 1998–2020. Master’s thesis, Utrecht University (2020)
  9. Oxford Analytica: Uae’s bolstering of Libya’s haftar is a risky policy. Emerald Expert Briefings (oxan-db) (2020)
  10. Vogiatzis, D.: The way to the promised land or the door to Armageddon: how severe are the threats against the physical security of israeli offshore gas platforms? Naval Postgraduate School, Monterey, CA. Ph.D. thesis (2020)
  11. Michael, K., Dostri, O.: The Hamas military buildup. The crisis of the Gaza strip: a way out (Tel Aviv: INSS, 2017), pp. 49–60 (2019)
  12. White, J.: The combat performance of Hamas in the Gaza war of 2014. CTC Sentin 7(9), 9–13 (2014)
  13. Shay, S.: The Houthi Maritime Threats in the Red Sea Basin, vol. 9. Institute for Policy and Strategy (2017)
  14. Falliere, N., Murchu, L.O., Chien, E.: W32. stuxnet dossier. White paper, Symantec Corp., Security Response 5(6), 29 (2011)
  15. Goyal, R., Sharma, S., Bevinakoppa, S., Watters, P.: Obfuscation of stuxnet and flame malware. Latest Trends Appl. Inform. Comput. 150, 154 (2012)
  16. Blackwell, T., Casner, D., Nelson, B., Wiley, S.: Self-balancing robot including an ultracapacitor power source, October 18 2011. US Patent 8,041,456
  17. Tasevski, P.: Password Attacks and Generation Strategies. Tartu University, Faculty of Mathematics and Computer Sciences, Tartu (2011)
  18. Schultz, E.E., Ray, E.: Rootkits: the ultimate malware threat. Inf. Secur. Manag. Handb. 2, 175 (2008)
  19. Schneider, P., IFSH Hamburg: Recent trends in global maritime terrorism. Marit. Secur. Count. Terror. Lessons Marit. Piracy Narc. Interdiction 150, 187 (2020)
  20. Cooper, A.: How robots change the world; what automation really means for jobs and productivity. Technical report (Tech. Rep.). Oxford Economics, Oxford (2019)
  21. Barber, B., Davey, J.: The use of the CCTA risk analysis and management methodology Cramm in health information systems. Medinfo 92, 1589–1593 (1992)
  22. Provos, N.: Honeyd-a virtual honeypot daemon. In: 10th DFN-CERT Workshop, Hamburg, Germany, vol. 2, p. 4 (2003)
  23. Erbacher, R.F., Christiansen, K., Sundberg, A., et al.: Visual network forensic techniques and processes. In: 1st Annual Symposium on Information Assurance: Intrusion Detection and Prevention, p. 72 (2006)
  24. Needham, R.M., Wheeler, D.J.: Tea extensions. Report (Cambridge University, Cambridge, UK, 1997) Google Scholar (1997)
  25. Laih, C.-S., Kuo, W.-C.: New signature schemes based on factoring and discrete logarithms. IEICE Trans. Fundam. Electron. Commun. Comput. Sci. 80(1), 46–53 (1997)

Cited by

Sorted by citations

Items 201–300 of 319

Related

See all

Metadata

Authors
Yaacoub, J.-P. A., Noura, H. N., Salman, O., & Chehab, A.
Affiliations
  • American University of Beirut (LB)
  • Franche-Comté Électronique Mécanique Thermique et Optique - Sciences et Technologies (FR)
Corresponding author
Salman, Ola
ORCID
Venue
International Journal of Information Security
Publisher
Springer Science and Business Media LLC
Published
2021-03-19
Volume
21
Issue
1
Pages
115-158
ISSN
  • 1615-5262 (ISSN-L)
  • 1615-5270
DOI
10.1007/s10207-021-00545-8
PMC
PMC7978470
OpenAlex
W3138047676
Cited by
320
References
331
Citations by year
2026: 51 · 2025: 83 · 2024: 89 · 2023: 58 · 2022: 28 · 2021: 11
FWCI
20.68
Type
journal article
Language
en
Open access
Licence
Locations
  • International Journal of Information Security (publishedVersion)
  • PubMed Central (publishedVersion)
  • PubMed (publishedVersion)
Funders
  • American University of Beirut (“ANR-17-EURE-0002)
  • Agence Nationale de la Recherche (ANR-17-EURE-, ANR-17-EURE-0002, ANR-17, ANR-17-EURE-0022)
  • Maroun Semaan Faculty of Engineering and Architecture, American University of Beirut (ANR-17-EURE-0002)
Topics
  • Physical Sciences › Engineering › Control and Systems Engineering › Robotics and Automated Systems
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
Keywords
multi-factor authentication, cryptographic algorithms, security countermeasures, security threats and risks, robots

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-09-28, under version 3 of the claim definition (prompt extract-v3).

A second model labelled each claim on 2026-09-28 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Cited sources are checked with a language model’s help (gpt-6-sol).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review