Protecting 3D printers from attackers

We live in a rising era of industrial Internet of Things (IoT) devices where factories are being upgraded with machines with network connectivity. These devices, such as networked 3D printers, can interact with other machines and be controlled remotely to improve efficiency.

However, connecting these devices to the network makes them more prone to danger. Some cyber-attackers might stop them from working, while others could steal their design or hold them hostage for ransom.

Luckily, security researchers are planning ahead. Vyas Sekar and Matthew McCormack have developed a tool with their team to make these devices safer. This tool, named Connected 3D Printer Observer, or C3PO, is designed to systematically determine potential security risks for individual networked 3D printers.

“I think many manufacturers care a lot about cybersecurity. They’re starting to work on it, but it’s very, very nascent,” said Sekar an associate professor of electrical and computer engineering. The truth is, there aren’t many tools out there to provide security for these 3D printers. Funded by CMU’s Manufacturing Futures Initiative that supports the digital transformation of manufacturing, Sekar’s team strives to defend these devices and give manufacturers more confidence.

Many manufacturers are starting to work on cybersecurity, but it’s very, very nascent.

Vyas Sekar, Associate Professor, Electrical and Computer Engineering

C3PO is composed of two parts. One part identifies the printer’s security vulnerabilities, and the other identifies potential attack paths based on the given vulnerabilities and network deployment. For example, it can find out whether connecting a web camera to a 3D printer can give attackers a new way to steal information.

C3PO functions by following the belief that sometimes the best way to know your enemies is to mimic them. After performing a security audit, C3PO questions what attackers could find if they observe network traffic to the 3D printer. From there, it can learn more about the 3D printer’s operation and protocol. Armed with this knowledge, it can identify malicious inputs to the printer and potential Denial of Service (DoS) attacks in which attackers can make the printers inaccessible to their intended users.

To test this new tool, Sekar’s team has used it on eight 3D printers from multiple vendors and manufacturing deployments. It turns out that none of these printers are safe. For example, all eight printers were vulnerable to DoS attacks.

Understanding the vulnerabilities of these devices is the first step to protect them. “What we want to do next is say, alright, we found these problems and we have a tool. Can we now create a way to protect them?” said McCormack, a Ph.D. student in electrical and computer engineering. “Can we add on something to the network to protect this printer so someone can’t steal that information? Can we use what we learn about the printer itself to bolt-on a defense for the printer.”

The future path of protecting these devices will not be free of challenges. For one, the 3D printers are very diverse as each vendor has a different way to communicate with their printer. Sekar’s team aims to tailor the protection they’ve designed to each specific printer based on its problems and how it operates. When that happens, it will strengthen our defenses against future attacks.