# Data Exfiltration through Electromagnetic Covert Channel of Wired Industrial Control Systems
## 7 Discussion  
Various countermeasures can be taken to avoid the deployment of these kinds of attacks. One of them is to use shielded Ethernet cables, which can eliminate radiation emissions to a significant extent. Metal shielding around the cable is widely used to reduce  
Figure 5: Bit error rate with respect to the distance and data rate.  
EM interference from other sources, as well as to limit the emission of EM radiation from within the cable to the outside. However, employing fully shielded cables costs over twice the price of using standard UTP cables. This is due to the special material included inside an Ethernet cable, in addition to the twisted pairs of wires. Due to cost constraints, the latter option may be preferred in many networks including industrial environments where ICSs are deployed, even though it reduces the overall security.  
Another option would be to use network monitoring tools to monitor the network and detect abnormal activities. These tools can be configured to detect the packet bursts that create EM covert signals. In such a case, it can block access to the network interface or disable the network interface altogether as a countermeasure. It requires further research to explore the potential of such use of network monitoring tools.  
When an ICS is operating with a potentially vulnerable wired network, radio signal jammers can be employed as a viable countermeasure. Modern signal jammers can jam the entire bandwidth of a signal's emitting spectrum. When the specific frequency range of a device's EM radiation is blocked by a jamming signal, the noise may increase the error rate of the covert channel's transmission, rendering it unusable. However, it is still possible for higher harmonics of an EM radiation of an Ethernet cable to fall outside the frequency range being jammed. In such circumstances, an attacker may potentially use such a higher harmonic of the information-leaking signal for the covert channel, bypassing the blocked frequency limitations.  
When initially designing the experimentation conducted as part of this paper, it was believed that EMR from Ethernet cables would not travel any considerable distance, and therefore, this work used a near-field antenna to capture the EMR. However, it was found that this signal remains capturable without using a near-field antenna from distances as far as 2 m. Therefore, it is possible to employ this covert channel from much further distances with the help of a suitably focused antenna.  
ICS networks, as with any other wired network, are under threat from various sources. However, unlike other general purpose wired networks, ICS networks consist of special-purpose devices, which operate autonomously to execute an industrial functionality, such as controlling a production line. Due to the use of specialised hardware in the network, an attacker can fine-tune an attack to specifically match known weaknesses and vulnerabilities on the special-purpose hardware used in an ICS network. This possibility puts ICS networks under a broader threat than general wired networks. Similarly, the demonstrated EM-based covert channel can be fine-tuned to the specific nature of hardware and network cables used on a specific ICS network, such as the specific EM radiation emitting frequencies. Therefore, it is necessary for operators of ICS networks to keep potential EM-based attacks and covert channels under close watch.