Modbus Covert Channels within Industrial Automation and Control Systems

This paper investigates the potential for covert channels within Industrial Automation and Control Systems utilizing the Modbus protocol, a fundamental communication standard in industrial environments. Modbus is widely used due to its simplicity and effectiveness in enabling communication between various devices. However, this ubiquity also makes it a prime target for cybersecurity threats. Covert channels, which are hidden pathways for information transfer that bypass conventional security mechanisms, present a significant risk by enabling unauthorized data transmission and potentially malicious activities. Our research focuses on identifying specific features of the Modbus protocol that can be exploited to create covert timing and storage channels. These channels can facilitate covert communication between clients and servers, posing a severe threat to the integrity and security of industrial operations. To illustrate the practical implications, we implement a client-to-server covert storage channel, showcasing its potential use in command and control scenarios by malicious actors. Additionally, we develop a server-to-client covert timing channel, demonstrating its effectiveness in data exfiltration. This work is motivated by the critical need to safeguard industrial infrastructure, which is increasingly becoming a target for sophisticated cyberattacks. The findings highlight the susceptibilities within Modbus communication and the importance of deploying holistic security measures to mitigate these covert threats.