Side-Channel Attacks on OT Systems

Overview

Attackers perform a side-channel attack by monitoring physical implementation of a target system to obtain critical information. Attackers use two techniques, namely timing analysis, and power analysis to perform side-channel attacks on the target OT systems. The timing-analysis attack is based on the amount of time taken by the device to execute different computations. The power analysis attack is based on the change in power consumption during a cryptographic operation. ICS systems are often vulnerable to these two side-channel attacks.

Attack Techniques

Timing Analysis

Passwords are often transmitted through a serial channel. Attackers employ a loop strategy to recover these passwords. They use one character at a time to check whether the first character entered is correct; if so, the loop continues for consecutive characters. If not, the loop terminates. Attackers check how much time the device is taking to finish one complete password authentication process, through which they can determine how many characters entered are correct. The timing-based attacks can be easily detected and blocked.

Power Analysis

Power-analysis attacks are difficult to detect; the attacked device can operate even after being infected. Therefore, attackers often prefer to perform a power-analysis attack rather than a timing-based one to recover the sensitive information.

This attack is performed observing the change in power consumption of semiconductors during clock cycles. The oscilloscope observes the time slot between two pulses via the probe. The power profile formed by the signals can leave a clue as to in what way the data is being processed.

For instance, by observing the power profile, one character of the password can be retrieved when the correct character entered is compared with the wrong character. The cryptographic key can also be obtained using the same method. Attackers can gain physical access over the unprotected or unsupervised device. Then, they use an oscilloscope and a special hardware device that run on the analysis software to recover the cryptographic keys.

Attackers can use the retrieved keys to make changes in the configuration of analyzed devices. As these systems are mostly utilized in protecting the power grids, the configuration changes can have devastating impacts. Through these changes, attackers can hinder the system process or use it to transfer incorrect data to the operator. These devices are often distributed and handled by a centralized system. Incorrect data from one device can impact major parts of the OT network.

Figures

Figure 18.83: Illustration of side-channel attack

Side-Channel Attacks or Cross-guest VM Breaches

Attackers can compromise the Cloud by placing a malicious virtual machine near a target cloud server and then launch a side-channel attack. The below figure show how an attacker can compromise the cloud by placing a malicious VM near a target cloud server. The attacker runs the VM on the same physical host as the target VM and takes advantage of the shared physical resources (processor cache). Then, he launches side-channel attacks (timing attack, data remanence, acoustic cryptanalysis, power monitoring attack, and differential fault analysis) to extract cryptographic keys/plain text secrets to steal the victim's credentials. Side-channel attacks can be implemented by any co-resident user and are mainly related to vulnerabilities in shared technology resources. Finally, the attacker uses the stolen credentials to impersonate the victim.

Side-Channel Attack Countermeasures

• Implement a virtual firewall in the cloud server back-end of the cloud computing; this prevents the attacker from placing malicious VMs
• Implement random encryption and decryption (encrypts data using RSA, 3DES, AES algorithms)
• Lockdown OS images and application instances to prevent compromising vectors that might provide access
• Check for repeated access attempts to local memory and to any hypervisor processes or shared hardware cache by tuning and collecting local process monitoring data and logs for cloud systems
• Code the applications and OS components so that they access shared resources, such as memory cache, in a consistent and predictable way. This coding style prevents attackers from collecting sensitive information, such as timing statistics and other behavioral attributes

It is based on repeatedly measuring the exact execution times of modular exponentiation operations. The attacker tries to break the ciphertext by analyzing the time taken to execute the encryption and decryption algorithm for various inputs. In a computer, the time taken to execute a logical operation may vary based on the input given. An attacker tries to extract the plaintext by giving varying inputs.

function getMeasurement(url, callback) {
  var a = new Image();
  a.addEventListener('error', function() {
    var conclude = performance.now();
    callback(conclude - begin);
  });
  var begin = performance.now();
  a.src = url;
}

getMeasurement('http://xyz.com/the-prompt/', function(timeTF) {
  getMeasurement('http://xyz.com/the-anonymous-place', function(timeTDS) {
    if (timeTF > timeTDS) {
      alert('The prompt is alright!');
    } else {
      alert('Privacy breach!');
    }
  });
});

Timing attacks are a category of sophisticated side-channel attacks that exploit differences in the time a system takes to complete computational tasks to deduce secret information, such as passwords, cryptographic keys, or user data.

This attack relies on observing the implementation of a computer system rather than weaknesses in the algorithm itself.

I. Timing Attacks in Cryptography and Systems

In a general sense, a timing attack measures the exact execution times of operations to infer secret information.

• Mechanism: Timing attacks are based on the principle that the time required to execute a logical operation often varies based on the input data given. By analyzing the time taken for cryptographic devices to process a message, attackers can infer secret information.
• Cryptographic Exploitation: Attackers repeatedly measure the execution times of modular exponentiation operations, attempting to break the ciphertext by analyzing the time taken to execute the encryption and decryption algorithms for various inputs.
• Side-Channel Context: Timing attacks fall under the umbrella of side-channel attacks, which exploit unintended information leakage from a physical system (like power consumption or sound). Timing information is one of the channels monitored.

II. Types of Timing Attacks

Timing attacks are utilized across various technological layers, including web applications, operating technologies (OT), and wireless networks.

A. Web-based Timing Attacks

Web-based timing attacks retrieve sensitive information (like passwords) from web applications by measuring the response time taken by the server to process a request. Types include:

1. Direct Timing Attack: Attackers measure the approximate time taken by the server to process a POST request to deduce the existence of a username. Attackers also use similar timing information to determine where the password comparison failed and subsequently determine the target user's password.
2. Cross-site Timing Attack: Attackers use JavaScript to send crafted request packets to the website. The attacker measures the time consumed by the user to download the requested file.
3. Browser-based Timing Attack: These are sophisticated side-channel attacks where attackers estimate the time taken by the browser to process requested resources. Attackers exploit browser functionalities to launch further attacks, such as video parsing attacks and cache storage timing attacks.

B. Timing Attacks in SQL Injection

Timing attacks are a key component of Blind/Inferential SQL Injection when error messages are unavailable to the attacker.

• Time-based SQL Injection: This method evaluates the time delay that occurs in response to true or false queries sent to the database.
  • Mechanism: Attackers use statements like WAITFOR DELAY (in Microsoft SQL Server) or BENCHMARK() and sleep() (in MySQL) to intentionally pause the database execution for a specified amount of time (e.g., 10 seconds) if a condition (the query) is true.
  • Deduction: If the attacker observes the specified delay in the HTTP response, they confirm that the query was TRUE, allowing them to extract information like the database name character by character.
• Heavy Queries: When time delay functions are disabled, attackers use heavy queries (e.g., executing multiple joins on system tables) to retrieve a massive amount of data, causing a long execution time that substitutes the delay function in a time-based attack.
• Double-Blind SQL Injection: This exploitation technique heavily depends on time-delay analysis to infer successful injection where no error messages or direct output are available.

C. Timing Attacks in Wireless and OT Systems

Timing attacks are used to exploit time-sensitive cryptographic processes in network protocols and operational technology (OT) systems.

• WPA3: Certain implementations of Simultaneous Authentication of Equals (SAE), also known as the Dragonfly handshake, used in WPA3 wireless security, are vulnerable to timing attacks.
  • Mechanism: The attacker analyzes the time taken by the Dragonfly handshake to encode a password authentication process. By observing the iterations of the encoding process, the attacker can short-list possible passwords to launch further attacks.
• OT Systems: In OT systems (such as SCADA), Timing Analysis is used to monitor the amount of time a device takes to finish a complete password authentication process. The attacker uses a loop strategy to recover the password one character at a time: if the correct character is entered, the loop continues for consecutive characters, but if the wrong character is entered, the loop terminates. This determines how many characters are correctly entered.
• Honeypot Detection: Attackers analyze the response time of network services to detect honeypots, as these deceptive systems often exhibit slower or inconsistent response times due to additional logging and monitoring layers. This process is measured using tools like Ping, Traceroute, and Nmap.

IV. Mitigation and Countermeasures

To mitigate timing attacks, cryptographic algorithms and system implementations must be designed to eliminate predictable timing variations.

• Code Consistency: Code applications and OS components should be designed to access shared resources, such as memory cache, in a consistent and predictable way.
• Timing Variations: Implement cryptographic algorithms and protocols in constant-time to eliminate timing variations that can be exploited by timing attacks.
• Data-Independent Delays: Use fixed-time algorithms and fixed-time properties to reduce side-channel leakage, especially regarding key updates.
• Key Stretching: Implement key stretching algorithms (a function that expends considerable effort to generate an enhanced key) to slow down brute-force attackers by ensuring each guess takes a similar amount of time to process.