Rapid7 disclosed ‘massive vulnerabilities’ in telepresence robot
You know the telepresence robots that roll around offices with a camera, microphone and iPad attached in order to give remote users a way to participate “face-to-face” in meetings? It would be trippy if an attacker were able to take control of such a robot, but also entirely possible. Today, Rapid7 revealed three security flaws it discovered in the mobile conferencing device Double Telepresence Robot.
Rapid7 researcher Deral Heiland discovered three vulnerabilities: unauthenticated access to data, static user session management and weak Bluetooth pairing. Two of three vulnerabilities disclosed to Double Robotics were patched in January, a really quick response considering the fixes were deployed about a week after the flaws were disclosed to the company.
Unauthenticated access to data
Regarding unauthenticated access to data, Rapid7 explained, “An unauthenticated user could gain access to Double 2 device information including: device serial numbers, current and historical driver and robot session information, device installation_keys, and GPS coordinates.”
Two examples exploiting the flaws included using the URL to obtain critical session information as well as robot and user installation keys.
Double Robotics deployed a server patch to mitigate the issue on January 16, 2017.
Static user session management
Heiland also found that “the access token (also referred to as the driver_token) which is created during account assignment to a Robot was never changed or expired. If this token was compromised, it could be used to take control of a robot without a user account or password.”
Rapid7 explained that despite the complexity of the 40-character access token, “it can still be enumerated by anyone who has access to the Double Robot iPad or is successful in creating an SSL man-in-the-middle attack against the device.” By gaining access to user access tokens, an attacker could take remote control access of the robots.
Double deployed a server patch to resolve this flaw on the same day in January as it did for the unauthenticated access vulnerability. The vulnerabilities were disclosed to Double on Jan. 9 and patched on Jan. 16.
Weak Bluetooth pairing
As for the weak Bluetooth pairing vulnerability, Rapid7 wrote, “The pairing process between the mobile application (iPad) and robot drive unit does not require the user to know the challenge PIN. Once paired with the robot drive unit, a malicious actor can download the Double Robot mobile application from the Internet and use it (along with the web services) to take control of the drive unit.”
The exposure of this flaw was described as “limited since the unit can only be paired with one control application at a time. In addition, the malicious actor must be close enough to establish a Bluetooth connection. This distance can be significant (up to 1 mile) with the addition of a high-gain antenna.”
Double Robotics doesn’t believe this to be “a significant security vulnerability” and therefore doesn’t intend to patch.
Double Robotics said, “Before the patches were implemented, no calls were compromised and no sensitive customer data was exposed. In addition, Double uses end-to-end encryption with WebRTC for low latency, secure video calls.”