Encrypted but Exposed: Traffic Analysis Lets Hackers Disrupt Water and Power Systems

Researchers at the University of British Columbia have identified a new class of cyberattack that could allow hackers to disrupt critical infrastructure such as water treatment plants and energy grids without ever breaking into a facility’s own systems or cracking its encryption. The finding challenges a long-standing assumption in industrial security: that strong encryption of communications between a plant and its cloud-based monitoring services is sufficient to keep adversaries at bay. Instead, the attack exploits the very existence of encrypted traffic, reading its outward patterns rather than its hidden contents to pinpoint and selectively destroy the messages that matter most.

The technique, which the researchers call ICS-Sniper, targets facilities that communicate with cloud-hosted monitoring and control systems over encrypted connections. To mount the attack, an adversary would first need to compromise a router carrying traffic between the facility and the cloud. From that vantage point, the attacker cannot read the messages, but can observe metadata such as the timing and size of each digital transmission. By analyzing these everyday traffic patterns, the attacker can identify when critical commands or data are likely to be transmitted, even while the actual contents remain completely hidden.

Industrial control systems rely on computers to run physical machinery such as pumps, valves and generators. Unlike attacks that compromise equipment inside a plant or overwhelm a network with indiscriminate traffic, ICS-Sniper uses patterns in encrypted communications to predict critical moments and then selectively block only a small fraction of messages. This surgical approach allows it to disrupt operations without ever entering the plant’s own systems, and it allowed the attack to evade the detectors that the researchers tested against it during their experiments.

Dr. Aastha Mehta, a UBC computer science professor who leads the Principled Systems Security Group and is a co-investigator on the project, explained the core of the problem. What makes the attack concerning, she said, is that an attacker does not need to read the messages being exchanged. Even when the contents are encrypted, patterns in the communication can reveal enough information to identify and target critical communications. In other words, the metadata that encryption protocols deliberately expose becomes a roadmap for sabotage.

The researchers chose the name ICS-Sniper because, like a sniper, the attack framework can selectively target critical communications with a small footprint. Rather than flooding a network with junk traffic or deploying malware inside a facility, the attacker waits, observes and fires at a single decisive moment, dropping precisely the packets whose loss will cause the greatest operational damage. This minimal signature is what makes the attack both difficult to detect and dangerous in practice.

In laboratory tests, the team demonstrated the attack on a cloud-adapted version of a water-treatment research testbed developed at the Singapore University of Technology and Design. They used two models of the testbed, one built on software-based controllers and the other on standard industrial control hardware, with both models simulating the physical processes of a treatment plant. In one test, the attack delayed the start of clean-water pumping by about fifteen minutes. In another, it left a simulated valve open for more than nine minutes longer than intended, a failure that in a real plant could cause a significant loss of treated water.

Dr. Karthik Pattabiraman, a UBC professor of electrical and computer engineering who leads the Dependable Systems Lab and is a co-investigator on the project, emphasized that cracking encryption is not a prerequisite for causing harm. An attacker does not necessarily need to break your encryption to cause disruption, he said. By simply watching traffic patterns, they can identify when critical messages are likely to be sent and selectively block them. That means blocking a small amount of traffic could trigger a much larger operational disruption, an asymmetry that makes the attack especially attractive to adversaries with limited resources.

The team selected water treatment as their demonstration case because public schematics were available that allowed them to faithfully replicate the facility’s control systems. They also tested their traffic-analysis method across several industrial communication protocols, including a power-grid dataset, although the operational disruptions themselves were demonstrated only in the water-treatment models. Dr. Gargi Mitra, the first author of the paper, who conducted the research as a postdoctoral researcher at UBC, noted that as industrial systems increasingly connect to cloud-hosted services, their exposure to network-based attacks like ICS-Sniper could grow. The goal of the work, she said, is to uncover new vulnerabilities before attackers do, so that the security community can address them while these cloud services are still in the early stages of adoption.

The researchers are already working on defences. One approach involves making network communications less predictable, for example by padding message sizes or adjusting their timing so that attackers find it harder to distinguish critical commands from routine system chatter. Such countermeasures carry a technical constraint: any changes to traffic shaping must preserve the strict timing requirements of industrial equipment, which often depends on deterministic communication cycles. A second strategy is to make plant controls and coordination more resilient to network disruptions, including by providing alternative routes for critical communications. Mehta described the overarching aim as building defence in depth, so that no single point of failure, including an encrypted link to the cloud, can bring operations to a halt.

In an unusual step for transparency, the team has released its research code, instructions for reproducing the laboratory testbeds, and network traffic data from those testbeds, allowing other security researchers to reproduce the findings and to develop and test defences of their own. The paper, titled ICS-Sniper: A Targeted Blackhole Attack on Encrypted ICS Traffic, has been accepted for presentation at the 2027 Network and Distributed System Security Symposium, a leading computer security research conference, to be held in Seoul, South Korea. Chanyuan Liu, Pritam Dash, Elaine Yao and Alain Zhiyanov also contributed to the paper, and the project is supported by the National Cybersecurity Consortium. As society relies ever more heavily on interconnected technology to run essential services, the researchers argue that security strategies must evolve to protect not only the privacy of data, but also the safe operation of the physical machinery that keeps water flowing and power on during an attack.

Subject of Research: A traffic-analysis attack on encrypted industrial control system communications that can disrupt water and energy infrastructure

Article Title: UBC researchers uncover new cyber threat to water and energy networks

Article References: UBC researchers uncover new cyber threat to water and energy networks. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: industrial control systems, cybersecurity, critical infrastructure, encrypted traffic analysis, water treatment, energy grids, cloud security, network attacks, UBC research, ICS-Sniper, NDSS 2027, defence in depth