Assessment of Hidden Channel Attacks: Targetting Modbus/TCP

Kevin Lamshöft,Jana Dittmann

DOI: https://doi.org/10.1016/j.ifacol.2020.12.258

2020-01-01

Abstract:Recent findings in research on malware threats indicate an increasing use of information hiding techniques as a novel approach for compromising IT-Systems by using covert functions and hidden channels. Especially in the context of covert intrusion and data exfiltration, networks of Industrial Control Systems (ICS) are a valuable target for information hiding based attacks. In this paper we discuss how 18 known patterns of information hiding in networks can be applied to protocols found in ICS networks and demonstrate how information can be covertly embedded and retrieved at the example of Modbus/TCP to achieve an overall protocol-compliance by also studying the embedding capacity. Additionally we provide a first tendency of warden- compliance, if the warden has a suspicion that there is a hidden message (conspicuousness). For a practical analysis we introduce an evaluation framework based on open-source software enabling assessment and quick implementation of hidden channels in common protocols found in ICS networks. In combination with a pattern-based approach for the identification of hidden channels, we show how this framework can be utilized as a systematic approach to identify and evaluate plausible hidden channels in industrial communication protocols. From the 14 identified patterns, in this paper we use the introduced framework to implement and evaluate two exemplary timing and storage channels in Modbus/TCP. Our results show 14 protocol-compliant patterns of information hiding based attacks in the context of Industrial Control Systems as well as the necessity of more research in this particular field, especially in terms of further plausible combination of pattern, warden-compliance, detection and mitigation strategies.