Vulnerabilities of ROS 2 Communication in Autonomous Vehicle Systems

Abstract

Autonomous vehicles rely on network communication to exchange vehicle control and perception data among interconnected system components, introducing security risks when unauthorized users discover, manipulate, or intercept sensitive data. This study assesses selected vulnerabilities in ROS 2 communication using two Ubuntu computers configured to simulate the ROS 2/DDS communication environment of the Quanser QCar2. Four attack scenarios were conducted and evaluated: rogue node injection, packet sniffing, DDS discovery poisoning, and command flooding. These attacks were selected as a foundational starting point for evaluating security vulnerabilities across different aspects of ROS 2/DDS communication. A modified packet-sniffing experiment was also conducted to determine whether YOLOv8 object-detection data could be passively intercepted. Experimental results demonstrated unauthorized control-command injection, recovery of velocity command messages, introduction of false participants into DDS discovery, and command flooding. The modified packet-sniffing experiment also demonstrated that YOLOv8 object classes could be recovered from network traffic without direct access to the camera. These findings demonstrate security risks associated with unsecured ROS 2/DDS communication under the evaluated conditions.