Abstract:Recent findings in research on malware threats indicate an increasing use of information hiding techniques as a novel approach for compromising IT-Systems by using covert functions and hidden channels. Especially in the context of covert intrusion and data exfiltration, networks of Industrial Control Systems (ICS) are a valuable target for information hiding based attacks. In this paper we discuss how 18 known patterns of information hiding in networks can be applied to protocols found in ICS networks and demonstrate how information can be covertly embedded and retrieved at the example of Modbus/TCP to achieve an overall protocol-compliance by also studying the embedding capacity. Additionally we provide a first tendency of warden- compliance, if the warden has a suspicion that there is a hidden message (conspicuousness). For a practical analysis we introduce an evaluation framework based on open-source software enabling assessment and quick implementation of hidden channels in common protocols found in ICS networks. In combination with a pattern-based approach for the identification of hidden channels, we show how this framework can be utilized as a systematic approach to identify and evaluate plausible hidden channels in industrial communication protocols. From the 14 identified patterns, in this paper we use the introduced framework to implement and evaluate two exemplary timing and storage channels in Modbus/TCP. Our results show 14 protocol-compliant patterns of information hiding based attacks in the context of Industrial Control Systems as well as the necessity of more research in this particular field, especially in terms of further plausible combination of pattern, warden-compliance, detection and mitigation strategies.

Timing covert channel analysis of the VxWorks MILS embedded hypervisor under the common criteria security certification

MCU-Wide Timing Side Channels and Their Detection

Identification and Evaluation of Sharing Memory Covert Timing Channel in Xen Virtual Machines

Investigating Timing Channel in IaaS

DDM: A Demand-based Dynamic Mitigation for SMT Transient Channels

A Covert Timing Channel via Algorithmic Complexity Attacks: Design and Analysis

CovertInspector: Identification of Shared Memory Covert Timing Channel in Multi-tenanted Cloud.

Prevention of Microarchitectural Covert Channels on an Open-Source 64-bit RISC-V Core

Assessment of Hidden Channel Attacks: Targetting Modbus/TCP

An Efficient Approach for Mitigating Covert Storage Channel Attacks in Virtual Machines by the Anti-Detection Criterion.

Timing Side-Channel Attacks and Countermeasures in CPU Microarchitectures

IChannels: Exploiting Current Management Mechanisms to Create Covert Channels in Modern Processors

Exploring Virtual Machine Covert Channel Via I/O Performance Interference

VIsolator: An intel VMX-based isolation mechanism

On Code Execution Tracking Via Power Side-Channel

Quantitative Analysis of Timing Channel Security in Cryptographic Hardware Design

Side-channel based intrusion detection for industrial control systems

Timing the Transient Execution: A New Side-Channel Attack on Intel CPUs

Security Analysis of Virtual Machine Monitor

Robust authentication for automotive control networks through covert channels

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode