(TLP:CLEAR) Researchers Demonstrate Attack that Disrupts Encrypted Cloud SCADA Traffic without Breaking Encryption

Summary: Researchers at the University of British Columbia have detailed ICS-Sniper, a technique that disrupts industrial processes by selectively dropping encrypted traffic between field sites and cloud-hosted SCADA systems. The attacker never decrypts traffic or enters the plant network. It operates from a compromised internet service provider (ISP) or provider-edge router and studies the size, direction, and timing of virtual private network (VPN) packets. From there, it predicts when time-critical commands are likely in transit, then drops a small share of packets during that window in a later operating cycle.

The researchers tested the attack on two emulated water treatment testbeds, one using real programmable logic controllers (PLCs). In one scenario, the attack delayed clean-water pumping by about 15 minutes. In another, it left a simulated backwash valve open more than nine minutes too long. Both attacks dropped under 5% of total traffic. None of eight industrial anomaly detectors flagged the attacks before process impact. The peer-reviewed paper will be presented at the Network and Distributed System Security Symposium in March 2027. No in-the-wild use has been reported.

Analyst Note: The research targets an architecture increasingly common among small and midsize utilities: cloud-hosted SCADA reached over VPN, with periodic Modbus or EtherNet/IP polling supporting batch processes. WaterISAC assesses that the same approach likely applies to remote sites, such as lift stations and storage tanks, whose telemetry crosses carrier networks. Persistent control of ISP infrastructure is a nation-state-level capability. Salt Typhoon’s compromises of major telecommunications providers show that this capability exists.

The key lesson is that VPN encryption protects confidentiality, not availability or timing. WaterISAC encourages members using cloud-hosted or remotely connected SCADA to consider the following:

• Keep safety-relevant interlocks between process stages local (hardwired or PLC-to-PLC on site) rather than dependent on cloud round-trips.
• Define fail-safe PLC behavior for communication timeouts, and alarm on stale data, not only on lost links.
• Use diverse carrier paths for critical sites.
• Ask cloud SCADA vendors whether their platforms support traffic padding or constant-rate polling.

Original Source: https://arxiv.org/abs/2312.06140

Additional Reading:

• UBC Researchers Uncover New Cyber Threat to Water and Energy Networks
• Enhanced Visibility and Hardening Guidance for Communications Infrastructure
• NIST SP 800-82r3, Guide to Operational Technology (OT) Security

Related WateriSAC PIRs: 6, 7, 7.1, 10, 10.2, 12