UBC Researchers Detail 'ICS-Sniper' Attack on Encrypted Cloud-Connected Infrastructure

Security researchers at the University of British Columbia have developed a technique that can disrupt physical infrastructure systems communicating with cloud monitoring platforms, even when all network traffic remains encrypted.

As reported by TechXplore (https://techxplore.com/news/2026-10-cyber-threat-exposes-limits-encryption.html), the attack method—termed "ICS-Sniper"—does not require breaching plant premises or breaking encryption ciphers. Instead, an attacker who compromises an intermediate router between an industrial site and cloud servers can observe packet timing and message sizes to infer when critical operational commands are in transit. By selectively dropping a small fraction of those specific messages, the attacker can cause physical disruptions while evading standard detection tools.

In laboratory demonstrations using a cloud-adapted water treatment testbed originally developed at the Singapore University of Technology and Design, the researchers evaluated the attack across both software-based and physical industrial hardware controllers. In one test, the attack delayed clean-water pumping operations by approximately 15 minutes. In another, a simulated valve remained open for more than nine minutes beyond its scheduled closing time.

"What makes this attack concerning is that an attacker doesn't need to read the messages being exchanged," said Dr. Aastha Mehta, a UBC computer science professor and co-investigator on the study. Dr. Karthik Pattabiraman, a UBC electrical and computer engineering professor who also co-led the research, noted that targeting a tiny volume of traffic based on timing patterns can trigger outsized physical failures.

The research paper, titled "ICS-Sniper: A Targeted Blackhole Attack on Encrypted ICS Traffic," was authored by Dr. Gargi Mitra, Chanyuan Liu, Pritam Dash, Elaine Yao, Alain Zhiyanov, Mehta, and Pattabiraman. It has been accepted for presentation at the 2027 Network and Distributed System Security Symposium in Seoul.

To defend against metadata-based blackhole attacks, the researchers suggest obfuscating network traffic through packet size padding and timing jitter, alongside engineering control fail-safes that provide alternate routing paths for critical operational commands. The UBC team has published its research code, testbed datasets, and reproduction instructions to facilitate further defensive testing.