Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Monday March 30 2020, @03:45PM   Printer-friendly
from the hidden-in-the-noise dept.

From the IEEE, an algorithm that creates "background noise" during data transmission that alerts officials to hacking:

Some of the most important industrial control systems (ICSs), such as those that support power generation and traffic control, must accurately transmit data at the milli- or even mirco-second range. This means that hackers need interfere with the transmission of real-time data only for the briefest of moments to succeed in disrupting these systems. The seriousness of this type of threat is illustrated by the Stuxnet incursion in 2010, when attackers succeeded in hacking the system supporting Iran's uranium enrichment factory, damaging more than 1000 centrifuges.

Now a trio of researchers has disclosed a novel technique that could more easily identify when these types of attacks occur, triggering an automatic shutdown that would prevent further damage.

The problem was first brought up in a conversation over coffee two years ago. "While describing the security measures in current industrial control systems, we realized we did not know any protection method on the real-time channels," explains Zhen Song, a researcher at Siemens Corporation. The group began to dig deeper into the research, but couldn't find any existing security measures.

[...] The approach involves the transmission of real-time data over an unencrypted channel, as conventionally done. In the experiment, a specialized algorithm in the form of a recursive watermark (RWM) signal is transmitted at the same time. The algorithm encodes a signal that is similar to "background noise," but with a distinct pattern. On the receiving end of the data transmission, the RWM signal is monitored for any disruptions, which, if present, indicate an attack is taking place. "If attackers change or delay the real-time channel signal a little bit, the algorithm can detect the suspicious event and raise alarms immediately," Song says.

Critically, a special "key" for deciphering the RWM algorithm is transmitted through an encrypted channel from the sender to the receiver before the data transmission takes place.

Tests show that this approach works fast to detect attacks. "We found the watermark-based approach, such as the RWM algorithm we proposed, can be 32 to 1375 times faster than traditional encryption algorithms in mainstream industrial controllers. Therefore, it is feasible to protect critical real-time control systems with new algorithms," says Song.

Originally spotted on The Eponymous Pickle.

Previously:
Cyber Threats from the US and Russia are Now Focusing on Civilian Infrastructure
Hackers Behind Dangerous Oil and Gas Intrusions are Probing US Power Grids
Stuxnet-Style Code Signing is More Widespread Than Anyone Thought


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Interesting) by fliptop on Monday March 30 2020, @05:26PM (1 child)

    by fliptop (1666) on Monday March 30 2020, @05:26PM (#977283) Journal

    Unencrypted, open channel, connected to the internet at large

    One of my clients is a water treatment facility. They have several storage tanks and pump stations that are located far from the main facility. They use radios to communicate control signals between the remote locations and the plant. Even if it can be updated to a more secure encrypted radio system, I doubt the small town (and all the other ones, for that matter) would want to spring for the costs involved. Bolting on a good solution to an existing system seems like the more logical and cost effective approach.

    --
    Our Constitution was made only for a moral and religious people. It is wholly inadequate to the government of any other.
    Starting Score:    1  point
    Moderation   +1  
       Interesting=1, Total=1
    Extra 'Interesting' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   3  
  • (Score: 0) by Anonymous Coward on Monday March 30 2020, @05:38PM

    by Anonymous Coward on Monday March 30 2020, @05:38PM (#977287)

    "Even if it can be updated to a more secure encrypted radio system, I doubt the small town (and all the other ones, for that matter) would want to spring for the costs involved."

    I'm not sure if the intent is to inject another on-frequency transmitter on the outgoing RF, and detect it at the receiver RF input on the other end for rapid man in the middle attacks.
    Anything else would assume you could get to the baseband signal, which probably isn't possible without modifying the link hardware.

    Then, what do you do if there is an RF override detected?