Uni rubbishes claim robot a security threat

University of Otago computer science researcher Prof Brendan McCane with Scary Maclary, the...
University of Otago computer science researcher Prof Brendan McCane with Scary Maclary, the Chinese-made robotic dog. PHOTO: GERARD O’BRIEN
Unlike most dogs, Scary Maclary does not like to chew on expensive shoes or terrorise the cat.

But that has not stopped international researchers from accusing the University of Otago’s Chinese-made robotic dog of sniffing in private places and spying for the Chinese.

It was recently discovered the Unitree Go1 model had a hidden pre-installed, undocumented remote access "back door", which could enable the Chinese to spy on the university.

However, Otago computer science researcher Prof Brendan McCane rubbished suggestions information on the university’s computer network may have been compromised.

For the past three years, it had been used by computer science researchers who were developing software to help the robotic dog deal with unpredictable and complicated environments, such as forests, steep or mountainous terrain or damaged buildings.

Eventually, it could be used for search and rescue operations in dangerous environments, he said.

But when told it may also be being used by the Chinese to spy on the university, he said it was "a bit of a storm in a tea cup".

"It might have seen some carpet and some chair legs, maybe a couple of shoes — I think that's pretty much the limit.

"This is a joke, obviously, because it's not hooked up to the mainframe of the university’s computer system.

"It’s segmented off, so it's no different in that respect than some external computer trying to connect into the university network.

"There was no possibility of exposing any critical information."

International researchers had found each robotic dog was shipped with a "preconfigured tunnel client" that initiated a connection to CloudSail — a remote access platform developed by Zhexi Technology, based in China.

When they gained access to CloudSail, they could get a list of all connected devices and their IP addresses; establish remote tunnels to those devices; access the robotic dog’s web interface with no authentication; use its cameras for live surveillance; log in via a secure shell using default credentials; and move laterally within internal networks to which the robot is connected.

University of Otago chief digital officer Steven Turnbull said the university took its cyber security seriously and responded promptly to any emerging risks related to its digital infrastructure or research technologies.

He confirmed the robotic dog was used in a controlled research environment and was not connected to critical university systems or services.

"Otago’s security operations include continuous monitoring of the university’s production network to detect and respond to threats.

"To date, the cyber security team has found no evidence of compromise."

john.lewis@odt.co.nz

 

Advertisement