Source-linked AI summary
dr0wned - Cyber-Physical Attack with Additive Manufacturing
Sofia Belikovetsky, Mark Yampolskiy, Jinghui Toh, Yuval Elovici
TL;DR
As additive manufacturing becomes more important for functional and safety-critical parts, its computerization raises the possibility of sabotage, while prior work had not demonstrated a complete attack chain. The paper develops a systematic method for identifying AM attack opportunities and assessing their difficulty, then experimentally demonstrates the chain by sabotaging a quadcopter propeller and destroying the cyber-physical system.
Problem
Prior AM security research covered selected issues, but no one had demonstrated a complete multistage cyber-physical attack from AM compromise through part sabotage to physical system destruction.
Method
The paper systematically identifies AM attack options and assesses attack difficulty by analyzing goals, manipulations, workflow elements, and compromise vectors.
Results
The experiment remotely sabotaged a 3D-printed quadcopter propeller, causing the quadcopter to fall and suffer severe physical damage.
Takeaways & Limitations
The demonstrated chain provides empirical evidence that sabotaging 3D-printed components can physically destroy a cyber-physical system.
Takeaways & Limitations
Experimental verification used a private person’s desktop 3D printer, while applicability to industrial metal-part systems is argued rather than experimentally verified.
Abstract
from arXiv · showhide
Additive manufacturing (AM), or 3D printing, is an emerging manufacturing technology that is expected to have far-reaching socioeconomic, environmental, and geopolitical implications. As use of this technology increases, it will become more common to produce functional parts, including components for safety-critical systems. AM's dependence on computerization raises the concern that the manufactured part's quality can be compromised by sabotage. This paper demonstrates the validity of this concern, as we present the very first full chain of attack involving AM, beginning with a cyber attack aimed at compromising a benign AM component, continuing with malicious modification of a manufactured object's blueprint, leading to the sabotage of the manufactured functional part, and resulting in the physical destruction of a cyber-physical system that employs this part. The contributions of this paper are as follows. We propose a systematic approach to identify opportunities for an attack involving AM that enables an adversary to achieve his/her goals. Then we propose a methodology to assess the level of difficulty of an attack, thus enabling differentiation between possible attack chains. Finally, to demonstrate the experimental proof for the entire attack chain, we sabotage the 3D printed propeller of a quadcopter UAV, causing the quadcopter to literally fall from the sky.
1. Introduction
Additive manufacturing is increasingly used for functional parts, while its computerization creates security concerns about sabotage. The paper addresses a gap in prior work by demonstrating a complete AM attack chain and evaluating its difficulty.
- Additive manufacturing builds three-dimensional objects layer by layer and offers shorter production times, reduced waste, and complex functional-part capabilities.In 2015, the AM industry generated $5.165 billion in revenue, and 32.5% of AM-generated objects were functional parts.
- Computerization introduces security risks including intellectual-property violations and sabotage of manufactured-object quality.The paper focuses on sabotage threatening functional parts in safety-critical systems or critical infrastructure.
- Prior work addressed selected aspects of AM security but had not demonstrated a holistic, multistage cyber-physical attack.The paper presents such a proof, beginning with compromise of an AM component and extending through blueprint modification and part sabotage.
- A remote sabotage attack broke a quadcopter propeller during flight, causing the quadcopter to fall from the sky.The experiment targeted a benign desktop 3D printer owner producing a replacement propeller.
- The paper proposes a systematic approach for identifying AM attack opportunities and a methodology for assessing attack difficulty.The methodology supports distinguishing among possible attack chains and their attack vectors.
2. Related Work
Prior AM security research examined attacks on printers, designs, manufacturing parameters, networks, and intellectual property, but largely covered separate aspects. The literature also introduced broader frameworks for understanding sabotage and weaponization of 3D printing.
- Prior research showed that desktop 3D printers could be compromised to modify printing results such as model size, component position, and integrability.
- AM manufacturing chains expose attack vectors through insecure design transfer, weak physical security, common network attacks, and difficult-to-rely-on quality controls.
- Other work examined AM intellectual-property risks, including legal gaps, side-channel reconstruction, digital watermarking, and provenance preservation.Acoustic emanations enabled reconstruction of object topology, with 78.35% average axis-prediction accuracy reported in one study.
- A proposed weaponization framework categorized AM attacks by potential effects and targets, including manufactured objects, AM equipment, and the environment.
- Research on AM sabotage demonstrated that altered geometry, defects, and manufacturing parameters can reduce printed-part quality.Examples include inserting voids into STL files and modifying parameters such as build direction, scanning strategy, and heat-source energy.
3. Additive Manufacturing Workflow
The AM workflow connects digital object designs, controller software, printers, materials, post-processing, and delivery across multiple actors. Designs may move directly to printers or through controller PCs that translate them into manufacturing commands.
- AM is increasingly offered as a service involving multiple enterprise actors that provide or consume different services.A cited directory listed 851 companies offering 3D-printing services as of May 2016.
- AM equipment depends on firmware and software supplied by equipment manufacturers, commercial developers, or open-source communities.Maintenance and repair also involve mechanical, electrical, and electronic components supplied by OEMs or third parties.
- 3D-object blueprints are commonly supplied as STL or AMF CAD files by designers or customers.These files represent the CAD model of the object to be manufactured.
- At the service provider, blueprint files can reach a printer through a network or USB connection, or be interpreted by a controller PC.The controller PC can send individual control commands, including G-code, to the printer.
- Manufacturing may require electricity, source materials, auxiliary materials, and post-processing before delivery to the customer.Post-processing can include support removal, hot isostatic pressing, finish machining, surface finishing, and nondestructive testing.
4. Attack Chain
The paper models AM attacks by tracing how compromised workflow elements enable manipulations that produce attack targets. It organizes the analysis from adversarial goals through required manipulations, controllable workflow elements, and compromise-enabling vectors.
- Attacks can compromise one or more AM workflow elements, whose roles and controllable operations shape possible manipulations.
- In powder-bed-fusion processes, a heat source repeatedly fuses distributed powder layers to build successive object slices.Unused powder exposed to high temperatures can change properties or agglomerate, negatively affecting final-product quality.
- The effects of manipulations depend on the compromised elements, AM equipment, source materials, and the manufactured part’s application area.
- Attack targets or threats are the subset of possible effects that intersects with the adversary’s goals.
- The attack-identification framework starts with adversarial goals, then identifies required manipulations, responsible workflow elements, and vectors for compromising them.The framework is inspired by attack trees and its analysis is summarized in Figure 3.
4.1. Adversarial Goals
The paper focuses on intentional sabotage of 3D-printed functional parts. It distinguishes sabotage cases based on how altered part strength relates to its normal operational range.
- The study considers intentional sabotage of a 3D-printed functional part.
- Functional parts are designed to maintain specified operational conditions over an extended period.
- One sabotage case alters the part so its normal operational range exceeds its altered strength.
4.2. Manipulations
The paper models cyber-domain manipulations that alter an AM object’s specification or manufacturing process during the operational manufacturing phase. These manipulations can target geometry, material, toolpaths, configurations, software, traffic, timing, and power-related factors.
- The analysis restricts manipulations to cyber-domain changes during the operational phase of the manufacturing life cycle.
- AM sabotage manipulations fall into object-specification modification and manufacturing-process manipulation.
- Object Specification Modification: Object specifications encode geometry, orientation, and, for multimaterial equipment, material through formats such as STL, AMF, toolpaths, or G-code.
- Object Specification Modification: Internal voids, contaminant materials, altered build direction, and changed manufacturing parameters can modify a printed part’s mechanical properties.
- Manufacturing Process Manipulation: STL/AMF files, toolpaths, configurations, software, network traffic, command timing, status information, and printer power can affect the manufactured object or its quality.
- Manipulations may be indiscriminate or selective, static or dynamic, depending on what is changed and where the attacker exercises control.
4.3. Compromised Elements
The AM workflow contains multiple compromise points, including external designers, networks, unrelated connected devices, and the 3D printer. The compromised element determines which manipulations are available, with printer control enabling the broadest logical range.
- AM workflow elements can support different manipulations depending on which element is compromised.
- External Designer: External STL/AMF files can be altered before manufacturing because they arrive through external connections and may originate outside the trusted environment.
- Network: External and internal network communications can be compromised to change files or data transmitted between the designer, Controller PC, and printer.
- Network: Network services and unrelated network-connected devices can provide additional routes for controlling access or interfering with AM components.
- 3D Printer: Compromising the 3D printer’s firmware or hardware enables the full spectrum of physically possible manipulations without logical restrictions.
4.4. Attack Vectors
The paper categorizes attack vectors by how adversaries can compromise AM software, hardware, firmware, and networks. It evaluates technological feasibility using required skills, tool availability, and access to the AM environment.
- An attack vector is a path or means for compromising and gaining control over one or more AM-workflow elements.
- Software Attacks: Software attacks exploit vulnerabilities, updates, open-source backdoors, or compromised software to alter AM files or communications.
- Software Attacks: Software vulnerabilities can enable arbitrary code execution and lateral movement from one compromised AM-network device to other components.
- Software Attacks: Design files are especially vulnerable because they originate outside controlled environments and are often generated by third-party tools.
- Hardware/Firmware Attacks: Hardware and firmware attacks include vulnerabilities, hardware Trojans, and malicious firmware updates that can compromise printers or network elements.
- Network Attacks: Network attacks can relay or alter communications, halt production through denial of service, or exploit protocol and implementation mistakes.
5. Attack Difficulty Assessment
The paper assesses attack difficulty by combining technological exploitation difficulty with the AM proficiency needed to induce a damaging manipulation. It ranks attack vectors and manipulations across defined factors, then correlates them in a heat map.
- Attack paths differ in hacking skills, AM proficiency, and required access, so the methodology helps an attacker select a less challenging path.
- The methodology combines attack-vector exploitation difficulty with AM proficiency and engineering knowledge to form a holistic assessment.
- Attack Vector Exploitation: Technological difficulty is assessed using hacking skills, tool availability, and access to the AM environment.
- Attack Vector Exploitation: Hacking skill and network access are each ranked on three levels, from low or external access to advanced skills or a foothold at a specific network element.
- AM Mastery Categorization: AM proficiency is assessed through knowledge of the AM process and tools plus mechanical engineering or material science knowledge.
- Attack Heat Map: The heat map correlates technological attack difficulty with AM proficiency for each attack vector and manipulation, combining the preceding assessments into one visual display.
6. Case Study, Part I: Attack Preparation
The case study prepares an end-to-end attack against a desktop 3D-printing workflow by selecting a realistic drone-propeller scenario and an internally weakened design modification. The experiments identify a defect that remains visually subtle yet causes delayed propeller failure.
- 6.1. Victim and Adversary: The study models a home user printing replacement quadcopter propellers from a designer-supplied blueprint on a USB-connected desktop printer.
- 6.1. Victim and Adversary: The adversary seeks a subtle defect that preserves installation compatibility but causes failure during rapid ascent or after short operation.
- 6.1.2. Experimental Environment: ABS was selected because its strength, flexibility, shock absorption, and heat resistance suit propellers exposed to motor heat.
- 6.3. Attack Preparation: The attack analysis selects object-specification manipulation because it is feasible with the adversary’s skills and tools and is selective and direct.
- 6.3.2. Iteration through Manipulations: 0.1mm gaps were found optimal: smaller gaps lacked meaningful effect, while larger gaps caused breakage within seconds of normal activity.
- 6.3.2. Iteration through Manipulations: The final internal modification weakened the blade-to-cap joint while added support structures delayed failure, and visual inspection did not reveal the sabotage.
- 6.3.3. Evaluation of Effects: 10457 RPM after ⇠10 seconds marked sabotaged-propeller breakage, whereas the original design exceeded 15000 RPM for over 5 minutes.
- 6.3.3. Evaluation of Effects: The targeted propeller damage sometimes also damaged another fully functioning propeller during laboratory tests.
7. Case Study, Part II: Attack Execution
The attack compromises the victim’s controller computer, replaces the original design with a tested malicious STL file, and prints one sabotaged propeller. During field testing, that propeller breaks during rapid ascent and the drone falls and is severely damaged.
- 7.1. Attack Execution: The attack proceeds in three steps: compromise the Controller PC, develop a sabotaged design, and replace the victim’s original design file.
- 7.1. Attack Execution: A spoofed WinRAR archive disguised a malicious executable as a PDF, and opening it gave the attacker a reverse shell and system control.
- 7.1. Attack Execution: The attacker searched for STL files, modified one in SolidWorks, experimentally tested the effect, and replaced the original file.
- 7.2. Field Trials: Four propellers printed from the regular design supported more than 5 minutes of normal flight before the sabotaged-propeller trial.
- 7.2. Field Trials: The sabotaged propeller survived 1 minute and 43 seconds, then broke during the fourth rapid-ascension iteration.
- 7.2. Field Trials: The drone fell from considerable height and shattered, destroying a motor and camera and cracking its external casing.
8. Conclusion
The paper addresses the limited prior coverage of AM sabotage by presenting a full cyber-to-physical attack chain and experimentally validating it on a quadcopter. The authors conclude that comparable attacks may also affect industrial systems, motivating stronger AM robustness and resilience.
- 8. Conclusion: Prior work covered selected aspects of AM sabotage, whereas this paper presents the first reported full chain from cyber compromise through part sabotage to CPS destruction.
- 8. Conclusion: The paper proposes a systematic approach for identifying AM attack options and a methodology for assessing attack difficulty across possible attack chains.
- 8. Conclusion: The approach is experimentally validated in a desktop-printer scenario by sabotaging a quadcopter propeller and demonstrating the complete attack chain.
- 8. Conclusion: Although the experiment targets a private desktop printer, the authors argue that similar attacks are possible against industrial systems producing metal parts for safety-critical applications.
- 8. Conclusion: The authors call for solutions that increase AM robustness and resilience to sabotage attacks.