OTRazor: Static Code Analysis for Vulnerability Discovery in Industrial Automation Scripts
Domain specific languages for robotics are hardly considered as an attack vector—however, we found that they expose sensitive primitives that enable vulnerabilities and malware. In an upcoming BlackHat talk and ASIA CCS paper, we will present the security-relevant impact of such code primitives, and we will introduce a code analyzer we built to automatically detect “insecure” uses of such code primitives. By Marcello Pogliani Research Collaborator at the NECSTLab, working on Systems Security This post is a “preview” of a research work that will be presented at Black Hat USA 2020 on August 5th, 2020. The history of this work goes back to 2017, when we published a paper showing what happens when and if sophisticated adversaries compromise an industrial robot. While working on that research, we learnt that robots…