Abstract:Recent findings in research on malware threats indicate an increasing use of information hiding techniques as a novel approach for compromising IT-Systems by using covert functions and hidden channels. Especially in the context of covert intrusion and data exfiltration, networks of Industrial Control Systems (ICS) are a valuable target for information hiding based attacks. In this paper we discuss how 18 known patterns of information hiding in networks can be applied to protocols found in ICS networks and demonstrate how information can be covertly embedded and retrieved at the example of Modbus/TCP to achieve an overall protocol-compliance by also studying the embedding capacity. Additionally we provide a first tendency of warden- compliance, if the warden has a suspicion that there is a hidden message (conspicuousness). For a practical analysis we introduce an evaluation framework based on open-source software enabling assessment and quick implementation of hidden channels in common protocols found in ICS networks. In combination with a pattern-based approach for the identification of hidden channels, we show how this framework can be utilized as a systematic approach to identify and evaluate plausible hidden channels in industrial communication protocols. From the 14 identified patterns, in this paper we use the introduced framework to implement and evaluate two exemplary timing and storage channels in Modbus/TCP. Our results show 14 protocol-compliant patterns of information hiding based attacks in the context of Industrial Control Systems as well as the necessity of more research in this particular field, especially in terms of further plausible combination of pattern, warden-compliance, detection and mitigation strategies.

Study and Verification of Covert Channels for Process Layer Network in Smart Substations

Research on Covert Channel Analysis in Tuling SecOS2.0/4

Abnormal Message Logic & Sequence Detection for Process Layer Network in Digital Substation

Attacks on Data-Driven Process Monitoring Systems: Subspace Transfer Networks

Digital Substation Cyber Security Analysis with Syn-Flood Attack As A Simulation Case

StegoBackoff: Creating a Covert Channel in Smart Grids Using the Backoff Procedure of IEEE 802.11 Networks

Study on the Information Security Analyze and Countermeasure in Digital Substation

Intrusion Detection Method Based on the Legality of Action Messages in Process Layer of Smart Substation

Network Protocol Covert Channels: Countermeasures Techniques

Covert channel design and detection techniques : a survey

False-Data-Injection-Enabled Network Parameter Modifications in Power Systems: Attack and Detection

A Practical Covert Channel Identification Approach in Source Code Based on Directed Information Flow Graph

Assessment of Hidden Channel Attacks: Targetting Modbus/TCP

Entropy Based Detection And Behavioral Analysis Of Hybrid Covert Channeling Secured Communication

Design of Transport Layer Based Hybrid Covert Channel Detection Engine

Covert Channel Communication as an Emerging Security Threat in 2.5D/3D Integrated Systems

Covert Channel Detection and Generation Techniques: A Survey

HSR-based Intelligent Substation Process Level Communication Network

A Secure, Intelligent, and Smart-Sensing Approach for Industrial System Automation and Transmission over Unsecured Wireless Networks

StegoDCF: A New Covert Channel for Smart Grids Utilizing the Channel Access Procedure in Wi-Fi Networks

Unified Modeling of Physical- Cyber -Logic -Attack - Protection for Digital Substation by Extension of IEC61850 Logic Space Model