ICS-Sniper: Estimating Critical Time Windows in Encrypted SCADA Traffic for Targeted Packet Dropping

1. Basic Information

• Article Name: ICS-Sniper: A Targeted Blackhole Attack on Encrypted ICS Traffic
• Source: University of British Columbia researchers
• Published Date: 2023-12-11
• Updated Date: 2026-10-06
• Original: University of British Columbia researchers
• Related Sources: UBC Dependable Systems Lab: ICS-Sniper, SecurityWeek: ICS-Sniper attack roundup
• Related Malware: None
• Related Threat Groups: None
• Related CVEs: None
• Related Products: OpenVPN, S-SWaT, H-SWaT, SCADA/ICS networks
• Severity: High

This is academic research evaluating the impact on control system availability within a research testbed environment. Active exploitation in real-world environments has not been confirmed. Across the five evaluated scenarios, process performance degraded before alerts were raised by both network-based and process-based detector types. However, this does not mean that individual detectors failed to issue alarms at any point throughout the entire operation cycle.

2. At a Glance

This research investigates an attack method where an attacker assumes control of a router located on the communication path outside a facility. By analyzing VPN packet sizes, directions, and arrival times, the attacker estimates time windows likely to contain critical control communications and selectively drops data packets during those intervals. The attack does not require breaking encryption or intruding into the internal industrial control system (ICS) network. The study did not demonstrate the initial compromise of the router itself.

3. Attack Flow

Path 1: Selective Dropping of Encrypted Traffic Assuming On-Path Control

1. The study assumes that the attacker has already compromised an Internet Service Provider (ISP) router located on the path between the factory-side gateway and the cloud SCADA. The path required for initial compromise of this router is outside the scope of evaluation.
2. The attacker passively observes packet lengths, directions, and arrival times of encrypted VPN traffic, estimating the base period (super-period) and time windows likely to contain critical communications based on prior operational cycle patterns.
3. In subsequent operational cycles, data packets passing through the estimated time windows are selectively dropped. The attacker does not decrypt or inspect the contents or importance of individual encrypted packets.
4. Without flooding large amounts of traffic, the attacker disrupts the delivery of control commands and status report messages, breaking synchronization between processes.
5. Experiments in a research testbed confirmed physical process impacts such as delayed water supply startup and delayed valve closures.

4. Attacker Position and Execution Location

• Assumes an on-path attacker who has seized an ISP router outside the factory and is capable of observing, recording, dropping, and delaying packets passing between VPN endpoints. Decryption, payload inspection, tampering, injection, and direct compromise of internal ICS devices are not prerequisites.

5. Victim and Administrator Perspective

• Victims and Users: May manifest on-site as control process response latency, intermittent supply delays, or degraded control quality.
• Administrators: Observed as packet loss skewed toward specific communication directions or cycles, increased retransmissions, SCADA communication timeouts, and process delays on the historian, while the VPN tunnel connection itself remains maintained.

6. Success and Failure Conditions

Success Conditions

• The attacker is positioned to observe and drop packets on the ICS communication path.
• Prior operational cycles are observable, and the periodic structure of control communications remains sufficiently stable in subsequent cycles to accurately estimate critical time windows.
• Communication disruption effects are not absorbed by redundant alternate paths or local autonomous safety controls (local failsafes) on the site side.

Failure Conditions and Mitigations

• Inference: Combine path redundancy using separate providers and routes that do not share suspicious external routers, communication loss monitoring at both VPN ends, and switching to local on-site control during anomalies. Securing traffic encryption or gateway defense alone is not considered sufficient to prevent external packet dropping.
• Protect management interfaces of self-managed VPN gateways and routers, and audit configuration changes and packet filters.

7. Outcomes upon Success

• Potential delays in SCADA control commands and status reports, as well as physical process stoppages or supply delays.
• Because availability is degraded while the encrypted VPN session remains active, distinguishing the attack from normal line failures or network congestion becomes difficult.

8. Observable Logs

These are investigation candidates within your organization. Availability depends on products, permissions, log settings, and retention periods; the absence of records does not prove an uncompromised state.

• Email: There are no email vectors specific to this incident.
• Proxy / SWG / DNS: Communication telemetry from VPN gateways and routers serves as the primary investigative target rather than web proxy or DNS logs.
• Endpoint / EDR: Inference: For self-managed gateway devices, check management login history and changes to filter and queue settings. However, because internal logs of the external ISP router assumed in this threat model may not be accessible via internal EDR, packet records at both VPN endpoints must be correlated for investigation.
• Identity / IdP: Inference: Check network management accounts for access from unknown sources or privilege modifications. Unauthorized access to external ISP routers may not be recorded in internal IdPs.
• SaaS / Cloud: Review audit logs for cloud SCADA and cloud-side VPN gateways, routing configurations, security policies, and health check metrics.
• Network: Check packet loss rates by communication direction, retransmission counts, missing sequence numbers, jitter, periodic packet drops, SCADA timeouts, and historian process delays.

9. Attack Success Determination

Confirmed in Public Information

• Subsequent Compromise Confirmed: Public Information: Experiments in research-use S-SWaT and H-SWaT testbed environments confirmed that selective packet dropping, assuming path router control, delayed water supply startup and valve closure. This does not confirm initial router intrusion, real-world operational environment compromise, or active exploitation. Scope: University of British Columbia (UBC) cloud SCADA testbed environment

Contact, execution, persistence, data acquisition, and exfiltration are evaluated separately; unverified success must not be concluded from a single alert.

10. Investigation Playbook

• Investigation Starting Point: Initiate investigations based on periodic packet losses, SCADA communication timeouts, or control process delays occurring while VPN tunnels remain active.
• Initial Verification: Distinguish physical equipment faults, line outages, temporary network congestion, misconfigurations, and intentional packet dropping. Check the affected traffic directions and periodicity.
• Endpoint and Server Investigation: Inference: Preserve configuration files, management sessions, ACL and queue configurations, firmware, and packet captures from both VPN endpoints on self-managed routers and gateways. Request investigation support from telecommunications providers regarding internal records of external ISP equipment.
• Authentication and Cloud Investigation: Review history for network management accounts, cloud gateways, routing changes, and policy updates.
• Subsequent Actions: Track potential unauthorized access paths to equipment, similar packet drops across other VPN tunnels, and the impact scope on physical processes.
• Containment: Inference: If self-managed routers show signs of compromise, isolate, replace, and restore them to normal configurations. If external ISP equipment is suspected, request investigation from the telecommunications provider while switching to alternative routes that bypass the suspicious path, and verify the safe state of on-site equipment.
• Determination Categories: Classify natural failures, network congestion, misconfigurations, indiscriminate DoS attacks, and selective packet drops synchronized with control cycles into distinct evaluation stages.

11. Defense and Detection Ideas

• Single Events: Generate alerts for changes to ACL and queue configurations on VPN gateways and abnormal increases in packet drop counters.
• Time-Series Correlation: Perform time-series correlation analysis on packet losses categorized by size, direction, and period against SCADA timeouts and historian process delays.
• Threat Hunting: Search multiple ICS communication flows traversing the same path routers for packet drops synchronized with operational cycles or suspicious usage of management accounts.
• Log Limitations: When payloads are encrypted and path routers do not log dropped packets, identifying intentional selective dropping becomes difficult without combining flow metadata from both VPN endpoints and process historians.
• Priority Mitigations: Prioritize protecting router management planes, implementing line redundancy through distinct paths, monitoring periodic packet loss, and verifying site-side local failsafe mechanisms.

12. Facts / Inference / Hypothesis

Facts

• ICS-Sniper is a targeted blackhole attack that analyzes packet length, direction, and arrival time of encrypted ICS traffic to block communication during specific time windows, assuming the attacker has compromised path routers outside the factory. This article is based on the original research paper arXiv v4 (updated 2026-10-06).
• Table V of paper v4 reports that across seven evaluation configurations in S-SWaT and H-SWaT, estimated base period (super-period) values matched measured values, yielding an estimated accuracy of 100% calculated from relative period errors. This does not mean classification precision for individual critical packets was 100%.
• In S-SWaT experiments, approximately 14 minutes of selective packet dropping delayed water supply startup by about 15 minutes. Another test confirmed that valves remained open 9 minutes and 11 seconds longer than usual after backwash pumps stopped (the latter does not imply an equivalent duration of water supply stoppage).
• In H-SWaT experiments, 1 minute of selective packet dropping delayed water supply startup by 2 minutes, requiring an additional 3 minutes of operation time to meet required supply volumes.
• Across all five scenarios used to evaluate the anomaly detectors, at least one detector raised an alert at some point during the operational cycle. No scenario produced alerts from both network-based and process-based detector types during the active attack stage, and in two scenarios none of the detectors raised an alert during that stage.
• This attack targets data packets flowing within pre-estimated critical time windows and does not decrypt or inspect the contents of encrypted payloads or the importance of individual packets.
• Additional evaluations that mitigated packet length variations via padding and estimated periods solely from arrival times failed period estimation in two H-SWaT configurations when a 1% background packet loss was introduced. Thus, success is not 100% guaranteed across all configurations and conditions.

Inference

• While VPN encryption protects confidentiality, it does not automatically guarantee communication availability or resistance to traffic analysis. Furthermore, simple traffic volume threshold monitoring risks missing low-rate selective packet drops synchronized with operational cycles.

Hypothesis

No additional hypotheses. Unverified items are listed under "Unresolved Questions and Further Investigation."

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1691	Block Operational Technology Message	high	Research demonstration selectively dropping communications carrying control commands and status reports on communication paths. Because traffic is encrypted and individual message types cannot be distinguished, it maps to the parent technique T1691. Source

T1498 (exhausting bandwidth with high traffic volumes) is not assigned. Legacy T0804 has been integrated into current T1691.002, but since this method is not limited to specific message types, parent technique T1691 is adopted.

14. Unresolved Questions and Further Investigation

• Attack feasibility in real-world operational environments exceeding protocols, communication cycles, and background loss conditions evaluated in the paper, realistic difficulty of initial intrusion into path routers, presence of real-world exploitation cases, and operational costs associated with deploying mitigations remain unconfirmed.

15. Impact on SOCs and Organizations

Even for manufacturing, water treatment, and infrastructure facilities operating remote SCADA systems or site-to-site VPNs, encryption alone cannot prevent availability loss caused by packet dropping along network paths. Effective mechanisms involve correlating packet loss rates by communication direction and time window at both VPN endpoints with SCADA timeouts and process delays. Additionally, verify whether backup redundant lines share the same path routers as primary lines, and ensure that safety-critical local control can be engaged on-site during communication anomalies.

16. Summary by Target Audience

• For SOCs: Correlate packet loss by communication direction and time window at both VPN endpoints with control process delays to distinguish normal network outages from intentional selective dropping. Avoid concluding path-based attacks based solely on alerts from a single detector.
• For Administrators: Verify redundant paths that do not share common routers, monitor QoS and packet losses, ensure site-side local failsafe mechanisms, and validate safety configurations during control timeouts.
• For Users: If equipment response delays or operational instabilities are observed, contact operational management in accordance with prescribed safety procedures.