IPL's Chinese Robot Dog: A Serious Security Threat Unveiled

Introduction

The Indian Premier League (IPL) has recently introduced a Chinese-made robot dog named "Champak," which is a Unitree Go 2 model, for entertainment during matches. While this technological addition may seem innovative, cybersecurity experts have raised serious concerns about its potential security implications, especially given the documented vulnerabilities in Unitree's previous models and the sensitive nature of high-profile sporting events.

The Robot Dog in Question

Technical Specifications

• Model: Unitree Go 2
• Manufacturer: Unitree Robotics (China)
• Cost: Approximately ₹3-5 lakhs in India
• Features:
  • LiDAR scanner (distinctive round black sensor on nose)
  • Built-in cameras and sensors
  • Remote-controlled capabilities
  • Runs on Raspberry Pi hardware

Current Usage in IPL

The robot dog, nicknamed "Champak," is manually controlled during IPL matches, performing various actions such as walking, jumping, and other programmed movements. Notably, the IPL has attempted to conceal the Unitree logo with fringe, possibly to avoid public scrutiny over the use of Chinese technology.

Security Vulnerabilities

1. Pre-installed Backdoor Access

Research on Unitree's previous model (Go 1) revealed critical security vulnerabilities that may also affect the Go 2:

• A pre-installed, undocumented remote access tunnel service called "CloudSail"
• Ability to bypass firewalls and network restrictions
• Remote access to cameras and control functions without authentication
• Default SSH credentials (username: pi, password: 123) that are rarely changed

2. Network Security Risks

The robot dog poses several network-related threats:

• Potential for lateral movement within connected networks
• Ability to compromise other devices on the same network
• Risk of unauthorized surveillance through camera access
• Possibility of remote control by malicious actors

3. Data Privacy Concerns

• Unencrypted firmware allows for easy analysis and exploitation
• No user consent for pre-installed remote access features
• Potential for unauthorized data collection during events
• Risk of sensitive information being compromised

Global Context and Previous Incidents

Similar security concerns with Chinese technology in public events have been documented:

• Over 1,900 Unitree devices were found connected to the CloudSail network globally
• Prestigious institutions like MIT and Carnegie Mellon were exposed to these vulnerabilities
• Multiple countries have banned Chinese technology in sensitive applications due to security risks

Available Indian Alternatives

Several Indian startups offer comparable robotic solutions:

1. Xterra Robotics (Vaughan M2)
   • IIT Kanpur-based startup
   • Advanced features including robotic arm support
   • Demonstrated capability to carry up to 5 kg
2. Strider Robotics
   • Developed at IIC Bangalore's Robert Bosch Lab
   • Known for robust and reliable designs
3. Reliance Industries' Tracker
   • Focus on industrial applications
   • Large-scale production capability
4. Bhairav Robotics
   • Specialized in weight-lifting capabilities
   • Robust quadruped design
5. Swaya Robotics
   • Defense-focused applications
   • Advanced military-grade features

Expert Recommendations

Immediate Actions Required

1. Network Isolation
   • Disconnect the robot dog from IPL's network
   • Conduct thorough security audits
   • Monitor for potential breaches
2. Technical Measures
   • Change default credentials
   • Implement network segmentation
   • Regular security assessments
3. Long-term Solutions
   • Consider replacing with Indian alternatives
   • Establish strict security protocols
   • Regular vulnerability assessments

Conclusion

The use of Unitree's Go 2 robot dog in IPL presents significant security risks that cannot be ignored. The combination of documented vulnerabilities, potential backdoors, and the availability of secure Indian alternatives makes this a concerning choice for such a high-profile sporting event. IPL organizers should seriously consider replacing "Champak" with an Indian-made alternative to ensure both security and support for domestic innovation.

The situation serves as a reminder of the importance of thorough security assessments when implementing technology in public events, especially those from manufacturers with known security issues. As India continues to advance in robotics and automation, choosing domestic alternatives not only ensures better security but also promotes local technological development.

Sources:

Unitree Report by Andreas Makris