Skynet Starter Kit: From Embodied AI Jailbreak to Remote Takeover of Humanoid Robots

Skynet Starter Kit: From Embodied AI Jailbreak to Remote Takeover of Humanoid Robots

Speakers: Shipei Qu, Zikai Xu, Xuangan Xiao (Dark Navy team)

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=qjA__5-Bybs

Overview

This talk, "Skynet Starter Kit: From Embodied AI Jailbreak to Remote Takeover of Humanoid Robots," delivered by the Dark Navy team at 39C3, presents a comprehensive security analysis of modern humanoid robots, specifically focusing on the Unitree G1. The speakers, Shipei Qu, Zikai Xu, and Xuangan Xiao, highlight a critical gap in the security posture of these rapidly evolving machines. As major tech companies like Tesla push forward with mass production of humanoid robots, the talk underscores a concerning lack of attention to security by both vendors and end-users, despite historical public fears about autonomous machines.

The presentation details a series of escalating attacks, moving from remote control hijacking and cloud-side authentication bypasses to sophisticated on-device command injection and ultimately, full firmware jailbreaking. The research exposes severe vulnerabilities across various layers of the robot's architecture, including its proprietary radio communications, network services (WebRTC, MQTT), and even its embedded AI assistant. By demonstrating how an attacker can gain root access and physical control, the Dark Navy team illustrates the tangible risks associated with deploying complex, internet-connected robots without robust security considerations. This research serves as a stark warning and a call to action for the robotics industry to prioritize security by design before these embodied AI systems become ubiquitous in our daily lives.

Background

▶ Watch: Introduction to humanoid robots and security concerns (0:00)

The landscape of robotics has undergone a dramatic transformation in the past decade. Once confined to industrial settings or rudimentary academic projects, humanoid robots are now approaching commercial viability, with companies like Unitree and Tesla investing heavily in their development. The Unitree G1, identified by the researchers as a representative target with over 50,000 units sold, exemplifies this trend. Despite their increasing sophistication and potential for real-world interaction, the security of these devices remains largely overlooked. Vendors often omit security from their marketing, and end-users, surprisingly, do not prioritize it, creating a dangerous disconnect between perceived threat and actual implementation.

Previous security research on Unitree products has primarily focused on their quadruped robots, such as the Unitree Go1 (hacked at GeekPwn 2022) and the Go2 (vulnerabilities patched by the Rubars community). However, at the outset of this research, no public vulnerabilities were known for the humanoid G1. This necessitated a ground-up, black-box approach to uncover its security weaknesses. The core problem stems from the rapid advancement in hardware and algorithms outpacing the maturity of security practices in the robotics domain. Many robots, especially those designed for research or entertainment, are developed with functionality and performance as primary concerns, leaving security as an afterthought or an unaddressed challenge. This creates a fertile ground for attackers to exploit fundamental design flaws, ranging from insecure communication protocols to unprotected on-device software.

Key Findings

▶ Watch: Analyzing the insecure remote control pairing (4:30)

The Dark Navy team uncovered a series of critical vulnerabilities across the Unitree G1's ecosystem, demonstrating escalating levels of control:

1. Remote Control Hijacking (Black-Box LoRa Protocol Crack): By reverse-engineering the robot's proprietary LoRa radio protocol, the researchers discovered that the remote control's pairing mechanism relied on a fixed, short (six-character) PIN code and unencrypted communications. This allowed an attacker to sniff unauthenticated control packets and subsequently send arbitrary commands to any G1 robot within range, effectively hijacking it without prior authentication.
2. Cloud-Side User Authentication Bypass (MQTT Token Capture): Through reverse-engineering the robot's MQTT communication logic, the team found that the robot's serial number was used as the MQTT username, and the password was deterministically derived from it. Crucially, the cloud service transmitted a JWT (JSON Web Token) user access token to the robot via MQTT for WebRTC session setup. An attacker with the robot's serial number could log in as the robot, capture this token, and then impersonate a legitimate user to the cloud API, enabling actions like unbinding, sharing, or controlling the robot remotely.
3. Embodied AI Agent Command Injection (LLM Prompt Injection & DNS Hijacking): The robot's voice-controlled Large Language Model (LLM) assistant was found to be vulnerable to command injection. Specifically, the chat_go service used Python's eval() function on LLM output to calculate rotation angles. This allowed for:

• Prompt Injection: Crafting malicious prompts to trick the LLM into returning Python code that would be executed by eval().
• DNS Hijacking: Redirecting the LLM API endpoint to an attacker-controlled server to directly inject malicious Python payloads.
• WebRTC Interface Redirection: Using a vulnerable WebRTC interface to reconfigure the LLM API endpoint to an attacker's server, providing a stable and effective command injection vector.

This led to remote code execution (RCE) and root shell access on the robot's RK3 motion control unit.

1. Firmware Jailbreak and Secondary Development (Obfuscation Bypass & VM Analysis): Despite gaining root, the "Air" (basic) version of the G1 had software checks preventing low-level motor control and secondary development. The researchers successfully bypassed heavily obfuscated binaries by:

• Unpacking runtime-decrypted code using LD_PRELOAD and tracing.
• Analyzing sophisticated obfuscation techniques including junk instructions, indirect branches, control flow flattening, and a custom stack-based virtual machine (VM).
• Developing a VM disassembler to understand the VM's instruction set architecture (ISA).
• Patching the decrypted code in memory at runtime to enable full motor control and G1 SDK compatibility, effectively transforming the basic model into a developer-enabled version.

These findings collectively demonstrate that the Unitree G1, in its pre-patched state, was susceptible to a wide array of attacks, culminating in complete remote physical control and arbitrary code execution.

Technical Deep Dive

▶ Watch: Strategy: Blackbox reverse engineering the remote (6:15)

The technical depth of the Dark Navy team's research spans multiple layers of the Unitree G1's architecture, starting from its low-level radio communications and extending to its sophisticated AI capabilities and underlying firmware.

The initial target was the robot's radio frequency (RF) remote control. With no available firmware or documentation, the team employed black-box reverse engineering. After tearing down the remote, they identified a likely LoRa communication module, a proprietary long-range radio technology. Using an SDR device (HackRF One), they captured RF signals. The challenge was to decode the signals, which required determining unknown parameters like spreading factor, bandwidth, and operating frequencies. Initial attempts with open-source GNU Radio implementations yielded "garbage output" due to frequency hopping.

The breakthrough came from identifying the likely Semtech SX1280 LoRa chip, known for its user-friendly development board. Further investigation revealed that these LoRa chips might not support hardware frequency hopping, suggesting that monitoring a single center frequency could still capture data, albeit with packet loss. A crucial discovery was the sync word, a two-byte parameter required for both transmitter and receiver configuration. By brute-forcing this parameter along with other guesses, the team successfully decoded the LoRa packets. The packets were found to be unencrypted, with only two leading bytes differentiating controllers. This allowed for a replay attack by sniffing these unauthenticated packets and then crafting custom control signals.

Moving to the application layer, the team first obtained an old, decrypted Unitree Go2 firmware from the robot community. This allowed them to establish an initial understanding of the robot's internal services. A "textbook command injection vulnerability" was quickly found in the Bluetooth server, providing a root shell without authentication on the Go2, and subsequently on the G1. This vulnerability, later dubbed "uni_exploit" by another team, provided the initial foothold for deeper analysis.

From a network perspective, the G1 primarily communicates via WebRTC and MQTT.

WebRTC operates in two modes:

1. LAN mode: The mobile app connects directly to a signal server and then sets up a WebRTC session with the robot using only its IP address, with "no credentials required." This allows any attacker on the same subnet to establish a connection.
2. Public internet mode: This is more complex, involving a cloud service and a relay server. Authentication is performed at every stage, making it more secure.

MQTT uses a publish-subscribe model. Reverse engineering revealed that the MQTT username is the robot's serial number, and the password is "derived from the same serial number," rendering it effectively useless if the serial number is known. Although topic subscriptions were strict, preventing direct command injection via MQTT, the team discovered a critical information leak: the cloud service sends relay server information to the robot via MQTT, which includes a JWT user access token. By capturing this token, an attacker could bypass cloud-side authentication and interact with the cloud API as a legitimate user, enabling actions like unbinding the robot, sharing it, or initiating WebRTC connections.

The Large Language Model (LLM) assistant presented another attack surface. The chat_go service, written in Python, receives voice input, sends it to a cloud LLM API, and receives structured responses. These responses include "function calls" that instruct the robot to invoke built-in APIs for actions like rotate or dance. Auditing these handlers, the team found that the rotate action's code used eval() on a value directly derived from the LLM output to compute the final angle. This is a classic command injection vulnerability.

Attack vectors for this included:

1. Prompt Injection: Crafting prompts (e.g., the "my dad grandma is dead" meme analogy) to make the LLM return malicious Python code that eval() would execute.
2. DNS Hijacking: Redirecting the LLM API's WebSocket server domain to an attacker-controlled server to inject arbitrary Python payloads.
3. WebRTC Interface Redirection: The most stable approach involved using a WebRTC interface exposed by chat_go to configure the LLM API endpoint. An attacker could connect to the robot via WebRTC (using the previously discovered LAN mode vulnerability), call the update_llm_api interface to redirect the LLM WebSocket server to their own server. This allowed for a man-in-the-middle (MITM) attack where the attacker's server would inspect requests, inject malicious payloads for specific trigger keywords, and otherwise forward requests to the legitimate LLM API, maintaining normal operation while achieving code execution.

Even after obtaining a root shell on the RK3 motion control unit, the "Air" version of the G1 resisted full control. Unitree had implemented software checks to ignore low-level commands and block external DDS (Data Distribution Service) requests if the robot was identified as a basic model. The binaries were "heavily obfuscated," making direct patching difficult. The obfuscation included:

• Junk instructions: Redundant add/sub operations and stack adjustments.
• Indirect branches: BR instructions with register calculations obfuscated by junk code.
• Basic block scattering: Function blocks spread throughout the binary.
• Invalid code: Designed to break disassemblers.

The team used LD_PRELOAD to inject a custom shared library, hooking open and fopen calls to bypass anti-debug tricks and dump the runtime-decrypted BSS section. This allowed for static analysis in IDA. By emulating obfuscated functions in Unicorn and analyzing control flow graphs, they identified patterns consistent with control flow flattening and virtualization. They discovered a stack-based virtual machine (VM) with approximately 80 variable-length virtual instructions (opcodes 2, 6, or 10 bytes long) that translated ARM64 instructions into VM instructions. The team developed a Python script for VM disassembly to understand the VM code logic.

Finally, to patch the self-decrypting code at runtime, they injected their custom library to hook libc.so's __libc_start_main function. This allowed them to patch the relevant code in memory after the master service finished decrypting itself but before it entered its main function. This enabled full motor control and allowed the basic G1 model to run the official Unitree SDK, effectively "jailbreaking" the robot. A critical moment occurred when a patching attempt bricked the robot, requiring a physical connection via a debug Ethernet port (not standard RJ45, but a pin connector) to recover it. They also found the basic version encrypted DDS traffic and generated new certificates on every reboot, requiring further patches.

Demo / Proof of Concept

▶ Watch: Discovering LoRa protocol using SDR analysis (7:30)

The Dark Navy team presented several compelling demonstrations to illustrate the impact of their findings.

The first demonstration showcased the remote control hijacking. Using their own computer, the researchers were able to send commands to the Unitree G1 robot, making it turn left, turn right, and perform movements like "come here" and "go away." Crucially, the original Unitree remote control was shown to be completely off, proving that the attack allowed for unauthorized control without any physical interaction with the legitimate controller. This highlighted the ease with which an attacker could take over a robot within LoRa range by simply sniffing and replaying unauthenticated packets.

A more dramatic demonstration, presented initially at GCON 2023, depicted the consequences of the AI agent command injection. By exploiting the eval() vulnerability in the LLM assistant, the team achieved remote code execution on the robot. They showed a video where they replaced the large language model API, spoke a trigger keyword, and initiated the command injection. This allowed them to remotely control the robot's physical movements, culminating in the robot running towards a person and performing a "punching motion." The speakers noted that the robot was "quite strong," emphasizing the real-world physical danger posed by such compromises.

Finally, the jailbreaking efforts were demonstrated by showing the basic G1 model, which normally has limited functionality, performing advanced movements. The researchers successfully ran the G1 SDK project on the basic module, which typically only supports preset movements and no secondary development. They also showed the robot being teleoperated using XR devices, with the robot mimicking the operator's movements. This proved that they had bypassed Unitree's software checks, enabled full motor control, and unlocked the robot's full potential for customized programming, effectively transforming a cheaper, restricted model into a fully developer-enabled platform.

Defensive Implications

▶ Watch: Detecting frequency hopping in the radio signals (8:50)

The findings from this research present critical implications for manufacturers, developers, and users of humanoid robots. The primary takeaway is the urgent need for security by design in cyber-physical systems like humanoid robots.

1. Secure Communication Protocols: Proprietary protocols, especially for critical functions like remote control, must incorporate robust authentication and encryption. The use of unauthenticated, unencrypted LoRa packets with a fixed, short PIN code is a fundamental flaw. Vendors should implement strong cryptographic pairing mechanisms and ensure all control data is encrypted.
2. Robust Authentication Mechanisms: The sequential vulnerabilities found in MQTT (serial number as username, derived password) and the subsequent JWT token capture highlight weaknesses in cloud-robot authentication. Strong, multi-factor authentication should be a standard, and sensitive tokens should not be transmitted in a manner easily intercepted or replayed.
3. Secure Software Development Practices: The command injection via eval() in the LLM assistant is a classic vulnerability. Developers must avoid using functions like eval() with user-supplied or AI-generated input. Input validation and sanitization are paramount, especially when integrating with external services like LLMs.
4. Network Segmentation and Least Privilege: The ease of establishing a WebRTC connection in LAN mode without credentials is a significant risk. Robots should operate on segmented networks where possible, and network services should enforce strict access controls. Internal services should run with the principle of least privilege.
5. Firmware Integrity and Protection: While Unitree implemented obfuscation, it was ultimately bypassed. Vendors should focus on stronger firmware protection, including:

• Secure Boot: Ensuring that only cryptographically signed and trusted firmware can be loaded, as Unitree has started to implement in newer versions (though often only signature verification, not encryption).
• Firmware Encryption: Protecting the intellectual property and critical logic of the robot's operating system.
• Anti-Tampering Measures: Implementing robust hardware and software defenses against physical and logical attacks aimed at firmware modification.

1. Regular Security Audits and Vulnerability Disclosure: Vendors must proactively engage in security audits and establish clear vulnerability disclosure programs. The initial lack of a firmware upgrade function for the remote control and the delayed response to other critical bugs underscore a reactive rather than proactive security stance.
2. User Awareness and Update Mechanisms: While some users updated their robots, many might not. Clear communication about security updates and easy-to-use, secure over-the-air (OTA) update mechanisms are crucial.
3. Physical Security Considerations: As robots gain more physical capabilities, the implications of a compromised motion control unit become severe. While the "three laws of robotics" are a theoretical framework, practical limits on robot behavior (e.g., speed, force, range of motion) must be enforced at a fundamental, unbypassable level once an attacker gains control.

The overarching message is that as embodied AI systems become more prevalent, the security posture must evolve beyond mere intellectual property protection to safeguard users and the environment from potentially harmful actions orchestrated by compromised machines.

Key Takeaways

• Humanoid robots currently lack adequate security: Despite rapid technological advancements and increasing deployment, security is often an afterthought for vendors and users.
• Proprietary protocols are not inherently secure: The Unitree G1's LoRa remote control protocol was easily reverse-engineered and exploited due to unencrypted, unauthenticated communication.
• Cloud-robot interactions present significant attack surfaces: Vulnerabilities in MQTT led to a cloud-side authentication bypass, allowing an attacker to impersonate legitimate users and control robots.
• AI agents introduce new command injection risks: The eval() function in the LLM assistant, processing LLM output, enabled remote code execution and physical control of the robot.
• Firmware obfuscation can be bypassed: Sophisticated techniques like runtime decryption, custom virtual machines, and control flow flattening can be overcome with determined reverse engineering, leading to full jailbreaks.
• Physical security implications are severe: Compromising a robot's motion control unit allows for real-world harmful actions, necessitating fundamental safety limits and secure design.

About the Speaker(s)

The talk was presented by members of the Dark Navy team: Shipei Qu, Zikai Xu, and Xuangan Xiao. While specific titles for each speaker were not provided in the transcript, they are clearly experienced security researchers and hackers. Their work at Dark Navy involves performing security assessments for various companies and exploring diverse areas of cybersecurity, including hardware wallets, WhatsApp security, and, as demonstrated in this talk, the security of advanced robotics. Their presentation style indicates deep technical expertise in reverse engineering, network protocol analysis, and embedded systems security. They highlighted their approach as driven by both curiosity and professional interest in uncovering vulnerabilities in cutting-edge technologies.