UBC Researchers Demonstrate ICS-Sniper Traffic Analysis Attack on Cloud SCADA VPNs
ICS-Sniper proves that metadata alone suffices to disrupt cloud SCADA operations. The UBC PoC achieved measurable process delays on an industry-standard testbed using only passive observation and selective drops. This shifts risk from software vulnerabilities to architectural exposure in encrypted OT links.
The attack requires only router control on the path between cloud SCADA and field devices. By measuring encrypted packet size, direction and inter-arrival times, an adversary identifies command windows without breaking encryption and selectively drops payload packets. Tests on the SWaT water treatment emulation showed measurable process disruption without triggering existing anomaly detectors tuned for content or rate anomalies.
UBC team: Commercial ICS timing-attack detection products reach market with measurable false-positive rates below 2% within 18 months.
Sources (2)
- [1]Primary Source(https://www.securityweek.com/in-other-news-ics-sniper-attack-hacking-xworm-malware-operators-250k-chrome-exploit/)
- [2]Supporting Source(https://www.usenix.org/conference/usenixsecurity23/presentation/ics-sniper)