# Data Exfiltration through Electromagnetic Covert Channel of Wired Industrial Control Systems
## 3 Covert Channel Attack Model  
The IEEE 802.3 standard defines the physical and data-link layer behaviour of wired local area networks, which is commonly referred to as _Ethernet_. There exists several variants of the IEEE 802.3 standard with varying hardware configurations and data rates. A standard Ethernet cable has eight wires twisted into four pairs. In the case of Ethernet standards 10 BASE-T (IEEE 802.3i) and 100 BASE-TX (IEEE 802.3u), only two twisted pairs are used for full-duplex communication--one pair for transmission and another pair for receiving and collision detection. Fast Ethernet standard (100 BASE-TX) uses a 4-bit-to-5-bit (4B5B) encoding scheme along with multi-level 3 (MLT-3) line encoding to modulate and transmit data in a physical medium [19]. The 4B5B uses a lookup table to convert every four bits of data into five bits, while the MLT-3 uses three levels of signal to modulate every single bit [20].  
The encoding used in the 100 BASE-TX standard is designed to minimize the undesirable EM emissions (EMR) from the cable during operation. In addition, the cables are physically designed to minimize the amount of unintentional EM radiation, such as using various types of cable shielding. When an electrical signal is travelling through an individual wire inside a data cable, it generates EM radiation. This EM radiation can induce noise on the other wires, disrupting the data being transferred through them. Instead of using a single wire, the application of a pair of wires twisted with each other and transferring a differential signal helps to cancel out such harmful radiation. Therefore, under ideal conditions, an IEEE 802.3 twisted pair cable will not cause any detectable EM radiation. However, in real-world settings, various manufacturing and handling defects occur; twisted pair cables are not uniformly twisted, and the signal attenuation of the two wires in a twisted pair are not similar. Due to these weaknesses, EM radiation can still emerge from twisted pair cables with a detectable amplitude. The resulting EM radiation is shown to be correlating with the information being transmitted through the Ethernet cable [21].  
The proposed covert channel exploits this EM radiation generated by the Ethernet cables used in ICS networks to exfiltrate their internal data. A basic model of the attack configuration is illustrated in Figure 1. There, in order to exfiltrate data from an ICS through an EM-based covert channel, two main components should exist. On the victim ICS device, there should be a specific malicious code running that has access both to the internal data of the device and to the network interface. The role of the malicious code is to read any sensitive information from the host device and modulate it into the EM radiation of the cable. This modulation is to be achieved by the malicious program sending specific network packet patterns over the cable in such a way to cause correlating EM radiation patterns. The second component in the attack model is the attacker's hardware and software setup, which consists of a software-defined radio to capture EM radiation and a computer to process EM data. The attacker's setup will be continuously capturing and demodulating EM radiation of the cable to retrieve data sent by the malicious code running on the victim ICS. In the demonstrated attack in this work, a HackRF One software-defined radio [22] was used with a laptop computer as the attacker's setup, while another laptop computer and a router connected through an Ethernet cable were used to represent the victim network.  
In this work, the delivery of the malicious code into a victim ICS device is outside the considered scope. The proposed attack is only viable if such a malicious code is available on the victim device to modulate data. There are various well-explored approaches to inject malicious code into a target computer, such as installing malicious code through the network using weak or default passwords used on victim devices [23].