A timing-based covert channel for SCADA networks

Industrial Control Systems (ICS) networks are an increasingly attractive for attackers. The case of 2015 Ukraine cyber attack where hackers abused the ICS system to create a blackout is a good illustration of this interest. However, to achieve physical effects, it is necessary for attackers to embed themselves deep within the target network. So, attackers must protect this investment by using covert techniques to avoid detection by defenders. This paper explores the problem of highly covert long-lived command and control channels to gain insight into probable evolution paths for attackers in response to increasing defensive capabilities. In particular, it presents a timing-based covert channel for the Modbus using interference. An implementation of the channel using network man-in-the-middle to modulate timing is built as a proof-of-concept of the approach. A performance analysis of the implementation shows that the implementation performs as low bandwidth, but highly covert command and control channel. Furthermore, an analysis of packet captures from a real production network show that the approach would be likely to work in a production environment.