# Data Exfiltration through Electromagnetic Covert Channel of Wired Industrial Control Systems
## 1 Introduction  
Large-scale industrial environments often consist of electrical, electronic, hydraulic, and various other components, which need to function under tight control. Industrial control systems (ICS) are responsible for the monitoring and controlling of these components and are being increasingly employed to control critical infrastructure the world over. The information stored and processed on ICSs can be considered critical to the smooth operation of the industrial environments where they operate [1]. As a result, ensuring the security and preventing leakage of data from ICSs can be considered vital to the successful operation of several public services and industries. ICSs are designed from the ground up to be as robust as possible, and ideally, to operate for decades without significant maintenance or downtime [2]. Broadly speaking, computing technologies are ever-evolving and advancing, and the relatively frequent (i.e., every few years) replacement and upgrading of consumer and industrial computer equipment is commonplace. However, several factors prevent ICSs from being upgraded or replaced at a similar timescale, including financial, the inability for critical infrastructure downtime, and often the sheer scale of the endeavour. Once deployed, it usually takes in the order of 15 to 20 years for an ICS to be replaced with newer components and products [1]. This upgrade-cycle lag has serious security consequences, as any known vulnerabilities are often left unaddressed for significant periods of time [3]. Vulnerabilities and attack vectors that are easily and frequently patched in modern computing systems can remain present in critical ICS infrastructure for years. Side channels allow attackers to retrieve information from a system by monitoring inert characteristics of the system, such as execution time, power consumption or memoryusage patterns. The target device does not need a direct output to the attacker's system for the side-channel analysis approach to be viable. Instead, side channel attacks are possible when an attacker has the ability to monitor non-functional characteristics of internal device activity, e.g., its running time, power consumption, memory accesses, or packets communicated over a network. Sensitive data has been successfully discovered and exfiltrated through side-channel attacks in various systems, including web applications [4], electronic and IoT systems [5], and cryptographic systems [6]. A covert channel is a communication channel that leverages a regular, legitimate device communication channel to transfer illegitimate data. System administrators may not be aware such data transmission is occurring as it is transferred through a legitimate channel. Data can even be stolen from highly-secured, air-gapped, non-networked computers through such covert channels. Several side channels exist in a typical computer that can be leveraged as covert channels, such as the sound a computer generates when operating, i.e., an acoustic side-channel [7], the power consumption of a computer, i.e., a power side-channel [8], operational indicator LEDs, i.e., an optical side-channel [9], and electromagnetic radiation (EMR) from different components of a computer, i.e., an EM side-channel [10; 11]. Ethernet cables are typically designed to keep electromagnetic (EM) interference at a minimal level to avoid inadvertently impinging with other communication (wired or wireless) devices in the vicinity. Nonetheless, the most commonly used Ethernet cables, i.e., twisted pair, often still emit a small amount of EM radiation due to manufacturing defects. Radiation is difficult to capture when the cable is appropriately shielded [12]. Several recent studies have demonstrated that this small amount of radiation can be detected and leveraged as a side channel to leak information [4; 12]. Therefore, there is potential to leverage this unintended EM radiation from wired network cables as a covert channel for sensitive information leakage.