ICS-Sniper: Estimating Critical Time Windows in Encrypted SCADA Traffic for Targeted Packet Dropping

Title: ICS-Sniper: Estimating Critical Time Windows for Packet Dropping in Encrypted SCADA Traffic

Researchers from the University of British Columbia have developed a method to disrupt Industrial Control System (ICS) traffic by selectively dropping packets during critical time windows. This attack requires compromising an Internet Service Provider (ISP) router located on the communication path between the factory-side gateway and the cloud SCADA system.

The attacker observes VPN packet lengths, directions, and arrival times to estimate the base period and time windows likely to contain critical control communications. By selectively dropping data packets during these intervals, the attacker disrupts the delivery of control commands and status reports, potentially causing delayed process responses and supply delays.

Victims may experience control process response latency, intermittent supply delays, or degraded control quality. Administrators may notice packet loss, increased retransmissions, SCADA communication timeouts, and process delays on the historian. The VPN tunnel connection remains maintained throughout the attack.

To mitigate the risk of this attack, organizations should combine path redundancy with monitoring for communication loss at both VPN ends. Switching to local on-site control during anomalies and securing management interfaces on VPN gateways and routers are also recommended. While securing traffic encryption and gateway defense are important, they are not sufficient to prevent external packet dropping.