University of British Columbia researchers have uncovered a vulnerability that could allow hackers to target and disrupt critical infrastructure such as water treatment plants and energy grids without needing to break into a facility’s own systems or crack its encryption.
The technique targets facilities that communicate with cloud-based monitoring and control systems over encrypted connections. An attacker would first need to compromise a router carrying traffic between the facility and the cloud.
The findings suggest that encryption alone may not be enough to protect vital public facilities. By analyzing everyday traffic patterns like the timing and size of digital messages, an attacker could identify when critical commands or data are likely to be transmitted, even when their actual contents remain hidden.
Industrial control systems rely on computers to run physical machinery such as pumps, valves and generators. Unlike attacks that compromise equipment inside a plant or overwhelm a network with traffic, the new technique uses patterns in encrypted communications to predict critical moments and selectively block a small fraction of messages. This allows it to disrupt operations without entering the plant’s own systems and evade the attack detectors tested by the researchers during the attack.
“What makes this attack concerning is that an attacker doesn’t need to read the messages being exchanged,” said Dr. Aastha Mehta, a UBC computer science professor who leads the Principled Systems Security Group and is a co-investigator on the project. “Even when the contents are encrypted, patterns in the communication can reveal enough information to identify and target critical communications.”
The researchers call their attack framework “ICS-Sniper” because, like a sniper, it can selectively target critical communications with a small footprint.
In laboratory tests, the team successfully demonstrated the attack on a cloud-adapted version of a water-treatment research testbed at Singapore University of Technology and Design. They used two models of the testbed, one using software-based controllers and the other using standard industrial control hardware; both models simulated the physical processes.
In one test, the attack delayed the start of clean-water pumping by about 15 minutes. Another left a simulated valve open for more than nine minutes longer than intended — a failure that could cause treated-water loss in a real plant.
“An attacker doesn’t necessarily need to crack your encryption to cause disruption,” said Dr. Karthik Pattabiraman, a UBC professor of electrical and computer engineering and co-investigator on the project who leads the Dependable Systems Lab . “By simply watching traffic patterns, they can identify when critical messages are likely to be sent and selectively block them. That means blocking a small amount of traffic could trigger a much larger operational disruption.”
The researchers chose water treatment because public schematics were available to replicate the facility’s control systems. They also tested their traffic-analysis method across several industrial communication protocols, including a power-grid dataset, although the operational disruptions were demonstrated in the water-treatment models.
“As industrial systems increasingly connect to cloud-hosted services, their exposure to network-based attacks like ICS-Sniper could grow,” said first author Dr. Gargi Mitra, who conducted the research as a postdoctoral researcher at UBC. “Our goal is to uncover new vulnerabilities before attackers do, so the security community can address them while these services are still in the early stages of adoption.”
The team is already working on ways to safeguard critical infrastructure against this type of attack.
One approach involves making network communications less predictable — for example, by padding message sizes or adjusting their timing to make it harder for attackers to distinguish critical commands from routine system chatter. Such changes would need to preserve the timing requirements of industrial equipment. Another is to make plant controls and coordination more resilient to network disruptions, including by providing alternative routes for critical communications.
“Our goal is to build defence in depth and make these systems more resilient to attacks like this,” said Dr. Mehta.
The team has also released its research code , instructions for reproducing the laboratory testbeds, and network traffic data from those testbeds so other security researchers can reproduce the findings and develop and test defences.
As society relies more heavily on interconnected technology to run essential services, the researchers say security strategies need to protect not only the privacy of data, but also the safe operation of physical machinery during an attack.
The paper , “ICS-Sniper: A Targeted Blackhole Attack on Encrypted ICS Traffic,” has been accepted for presentation at the 2027 Network and Distributed System Security Symposium, a leading computer security research conference, in Seoul, South Korea.
Chanyuan Liu, Pritam Dash, Elaine Yao and Alain Zhiyanov also contributed to the paper.
The project is supported by the National Cybersecurity Consortium.
Interview languages: English (Mehta, Mitra, Pattabiraman)
Computational simulation/modeling