Robots

what’s lurking inside these creepy robot dogs?



Yep, you read that right. A Chinese robot dog that builds a tunnel into your network for the world to see! Check it out here.

Remote Access Backdoor Discovered in Chinese Robot Dog Unitree Go1

๐Ÿ”ด LIVE @ https://twitch.tv/LowLevelTV
๐Ÿซ COURSES ๐Ÿซ Learn to code in C at https://lowlevel.academy
๐Ÿ”ฅ SOCIALS ๐Ÿ”ฅ Come hang out at https://lowlevel.tv

source

Related Articles

34 Comments

  1. Wow these robots looked cool but I couldn't think of a reason to get one but glad I didn't. It does seem common for IoT stuff to be like "hey this device is extendable and you can do you're own thing with it" just means "we made it really insecure and that makes it easy for you (or anyone) to do whatever you want with it"

  2. Three โ€œBrains,โ€ One Body
    Raspberry Piย 4 (the โ€œmasterโ€)

    Handles highโ€‘level logic, network, and coordination.

    Feeds off your external power supply and the smart battery via a powerโ€‘management board.

    Nanoโ€‘1 & Nanoโ€‘2 (the โ€œbody controllersโ€)

    Each Nanoโ€‘4GB talks to two depth cameras and crunches vision data for walking and obstacle avoidance.

    Nanoโ€‘3 (the โ€œhead controllerโ€)

    Drives the headโ€™s two depth cameras and any extra sensors up top.

    All three modules link into an internal Ethernet switchโ€”thatโ€™s your backplane for data and commands.

    The Sensor & Actuator Bus
    Sensors:

    IMU and โ€œmaster controllerโ€ feed inertial data into the switch.

    Depth cameras plug directly into their assigned Nano board.

    Motors:

    A shared RSโ€‘485 bus snakes out from the master switch to all 12 brushless motor controllers in the legs.

    Why This Matters for Hacking
    Ethernet switch = one chokepoint for networkโ€‘level MITM or firewall rules.

    UART headers likely live on each compute boardโ€”your golden ticket for console access.

    RSโ€‘485 bus is where motion commands flow; spoofing packets here could let you โ€œpuppetโ€ the legs.

    Flash storage on each Nano (eMMC or SPIโ€‘NOR) holds the firmware youโ€™ll dump, patch, and reflash.

    Attackโ€‘Surface Roadmap
    Piย 4 first: Itโ€™s higherโ€‘level, already running Linuxโ€”UART โ†’ dump /dev/mmcblk0 โ†’ patch Uโ€‘Boot or systemd.

    Nanos next: Repeat the UARTโ€‘dumpโ€‘patch dance on each; they host the computerโ€‘vision and gaitโ€‘control code.

    Lock down RSโ€‘485: Once your firmwareโ€™s clean, either block or inject commands on the motor bus.

  3. I had a Go2. It was fun but also didn't do anything with it and sold it. I never had the balls to 1: connect it to my network, or 2: use their app.. I REALLY try not using any chinese apps and if I do, I do it on a specific device.

  4. <sarcasam>My guess it is working as expected, what is the issue or bug?</sarcasam>
    Remote access to customer facilities is why the device is sold for, and btw the customer gets to keep the device too. yeah

  5. I tend to believe that it wasn't malicious but developers/release managers being lazy. Why? Because they open-sourced the software and provided the Cloudsail key to the researchers.

  6. The surveillance spy phones are not enough, so they are making surveillance pets and women. This is an attack on humanity; I repeat, this is an attack on Humanity.

  7. "specifically targeting research institutes" when the phrasing in your marketing tells on you. oh great two way cloud connection between all the dogs, that's got potential for horrible pack behaviors..

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button