DDS Security Test

ROS 2 DDS security research test environment, based on ROS 2 Foxy.

Project Introduction

This project demonstrates a privilege escalation vulnerability in the ROS 2 SROS2 security framework. By modifying signed permission files, an attacker can cause a node to subscribe to topics it should not be allowed to subscribe to.

Environment Requirements

• Docker

Quick Start

Build Image

docker build -t dds-test .

Run PoC

docker run -it dds-test ./poc.sh

PoC Script Description

The poc.sh script performs the following steps:

1. Create keystore - Generate keys and certificates for talker and listener using the ros2 security tool
2. Create correct permissions - Configure talker to publish on chatter topic, listener can only subscribe to something_else topic
3. Run normal communication - Verify nodes can communicate normally under correct permissions
4. Create malicious permissions - Demonstrate how an attacker modifies permission files to allow listener to subscribe to chatter topic
5. Run malicious communication - Verify that after applying malicious permissions, the node can subscribe to topics it originally had no access to

Key Files

• Dockerfile - ROS 2 Foxy environment configuration
• poc.sh - PoC demonstration script

Reproduction Demo

Build and run Docker vulnerability environment

Run PoC

PoC Running Configuration file description:

Normal Situation listener cannot receive messages published by talker

Start Attack

Effect listener can receive messages published by talker

References

• ROS 2 SROS2 Documentation