Network connected wrenches in factories can be hacked for sabotage or ransomware

Enlarge / The Rexroth Nutrunner, a line of torque wrench sold by Bosch Rexroth. Bosch Rexroth reader comments 8 Researchers have unearthed nearly two dozen vulnerabilities that could allow hackers to sabotage or disable a popular line of network connected wrenches that factories around the world use to assemble sensitive instruments and devices.

The vulnerabilities, reported Tuesday by researchers from security firm Nozomi, reside in the Bosch Rexroth Handheld Nutrunner NXA015S 36V B . The cordless device, which wirelessly connects to the local network of organizations that use it, allows engineers to tighten bolts and other mechanical fastenings to precise torque levels that are critical for safety and reliability.

When fastenings are too loose, they risk causing the device to overheat and start fires. When too tight, threads can fail and result in torques that are too loose. The Nutrunner provides a torque level indicator display that’s backed by a certification from the Association of German Engineers and adopted by the automotive industry in 1999.

The NEXO OS, the firmware running on devices, can be controlled using a browser based management interface. Enlarge / NEXO OS's management web application. Nozomi Nozomi researchers said the device is riddled with 23 vulnerabilities that, in certain cases, can be exploited to install malware. The malware could then be used to disable entire fleets of the devices or to cause them to tighten fastenings too loosely or tightly while the display continues to indicate the critical settings are still properly in place.

B Advertisement Bosch officials emailed a statement that included the usual platitudes about security being a top priority. It went on to say that Nozomi reached out a few weeks ago to reveal the vulnerabilities. "Bosch Rexroth immediately took up this advice and is working on a patch to solve the problem," the statement said.

"This patch will be released at the end of January 2024." In a post, Nozomi researchers wrote: The vulnerabilities found on the Bosch Rexroth NXA015S 36V B allow an unauthenticated attacker who is able to send network packets to the target device to obtain remote execution of arbitrary code (RCE) with root privileges, completely compromising it.

Once this unauthorized access is gained, numerous attack scenarios become possible. Within our lab environment, we successfully reconstructed the following two scenarios: Ransomware : we were able to make the device completely inoperable by preventing a local operator from controlling the drill through the onboard display and disabling the trigger button.

Furthermore, we could alter the graphical user interface (GUI) to display an arbitrary message on the screen, requesting the payment of a ransom. Given the ease with which this attack can be automated across numerous devices, an attacker could swiftly render all tools on a production line inaccessible, potentially causing significant disruptions to the final asset owner.

Enlarge / A PoC ransomware running on the test nutrunner. Nozomi Manipulation of Control and View : we managed to stealthily alter the configuration of tightening programs, such as by increasing or decreasing the target torque value. At the same time, by patching in memory the GUI on the onboard display, we could show a normal value to the operator, who would remain completely unaware of the change.

A manipulation of view attack. The actual torque applied in this tightening was 0.15 Nm..