ICS-Sniper drops packets in encrypted SCADA traffic without breaking encryption

UBC researchers described ICS-Sniper: an attacker who controls an ISP router on the traffic path estimates time windows of critical control commands from VPN packet sizes and timing, then selectively drops them. Encryption is never broken, yet testbed runs showed delayed water supply and valve closures before detectors raised alerts.

• The attack needs neither decryption nor access to the internal ICS network
• In all five scenarios the process degraded before network- and process-based detectors alerted
• Mitigations: redundant paths, loss monitoring at both VPN ends and local on-site control