T09 · Insecure Skill Coding Practices
Error
- Location
scripts/call_radar_service.js:22- Finding
Unauthenticated Plaintext Transport for Safety-Critical Radar Telemetry
- Content
View full analysis
$ROS_WS/rosbridge.log 2>&1 & # ... echo " rosbridge: ws://$(hostname -I | awk '{print $1}'):8080" ``` ### Technical Analysis The client connects through `ws://` rather than authenticated TLS-protected `wss://`. The implementation contains no server certificate verification, message authentication, client authentication, or application-level response signature. Consequently, the client cannot establish that a received service response originated from the intended Raspberry Pi. An attacker capable of intercepting local network traffic, controlling routing or DNS-like configuration, compromising the configured host, or operating a spoofed endpoint can observe or alter radar telemetry. The startup script also launches rosbridge without any visible access-control or authentication configuration and advertises it using a network-interface address. Depending on the rosbridge deployment defaults and network firewall, the endpoint may make ROS operations available to other network participants, potentially beyond the single service used by this client. ### Attack Path 1. The operator starts rosbridge on TCP port 8080. 2. The radar client connects to the configured host using plaintext `ws://`. 3. An attacker obtains a suitable network position or causes the ...[truncated 1199 chars]- Remediation
View remediation