ICS-Sniper Delays Simulated Water Plant Pumping by 15 Minutes Without Breaking Encryption in Cloud-Connected Control Systems

InnoDexis has published its latest Innovation Intelligence Report covering industrial control system security for water and energy networks, analyzing a single research innovation from researchers at UBC and SUTD. The report reveals that ICS-Sniper, a technique that can selectively block critical commands in cloud-connected control systems without a decryption key, delayed clean-water pumping by 15 minutes and left a simulated valve open more than 9 minutes longer than intended on a testbed built from public schematics, while evading existing attack detectors. The researchers surfaced the exposure while adoption of such systems is still early.

Key Findings

Clean-water pumping was delayed by 15 minutes in the simulated water plant demonstration. The demonstration ran on a testbed with public schematics, indicating that the result relied on openly available design information rather than a breach of the facility. The delay was produced without decrypting any traffic.

A simulated valve was left open more than 9 minutes longer than intended. Together with the pumping delay, this shows that selective command blocking can alter the timing of physical process actions, not only the flow of network messages. The valve result complements the pumping result by showing a second, distinct physical effect from the same technique.

ICS-Sniper requires no decryption key. Encryption was never cracked; timing and size patterns alone reveal which messages matter, which allows critical commands to be singled out and blocked while the protected content stays unread. This is why the study is framed around traffic observation rather than a break of the cryptography.

The technique evades existing attack detectors with a small blocking footprint. This indicates that detection tools currently in place offer limited protection against an attack that interferes with only a few messages at a time. The small footprint is what allows it to avoid detection.

The facility was not breached; its traffic was observed. Code and traffic datasets were released for defenders, and multi-route fallback pathways are among the defences being designed, so the research arrives with practical starting points for protection. Defence starts with what the traffic pattern gives away.

Strategic Insight and Trend Analysis

The dominant trend in this dataset is the shift in the security question from whether encryption holds to what encrypted traffic still gives away. Encryption protects commands on water and energy networks, and in this study it was never cracked. The disruption came from timing and size patterns alone, which reveal which messages matter and allow those messages to be selectively blocked.

This distinction carries structural significance for critical infrastructure. A control system can meet its encryption requirements and still expose the information an attacker needs to delay a pump or hold a valve open. The 15-minute pumping delay and the valve left open more than 9 minutes longer than intended show that the consequence is measured in process timing, which is exactly where real-time control systems are most sensitive.

The defensive direction follows from the same logic. The shift runs from encryption alone to encryption with padding and obfuscation, adding layers without replacing encryption. The constraint is that hiding timing and size patterns must still meet strict real-time requirements, so protection cannot come at the cost of control performance.

The timing also matters. As systems connect to cloud services, exposure like this could grow, and the team surfaced it while adoption is still early. Public schematics, a small blocking footprint, and evasion of existing attack detectors together describe a weakness that is accessible in design and difficult to detect, which raises the value of early defensive work.

Global and Industry Implications

For corporates and R&D teams, the findings indicate that control traffic needs to be assessed for what its timing and size patterns reveal, not only for whether it is encrypted. Operators and vendors of cloud-connected control systems face a design task: adding padding and obfuscation while still meeting strict real-time requirements. The traffic patterns that enable the attack are the same ones defenders must now hide.

For investors and capital allocators, the research points to a developing need for defensive capability in industrial control security, including traffic obfuscation and multi-route fallback pathways. The question that closes the source material, which water and energy operators have audited their control traffic, frames the gap that such capability would address.

For policymakers and national innovation bodies, the demonstration on a simulated water plant shows that critical infrastructure risk can arise without any breach of encryption. The release of code and traffic datasets for defenders offers a shared resource, and early identification, while cloud adoption is still at an early stage, creates room for guidance before exposure grows. Multi-route fallback pathways, among the defences being designed, indicate where national resilience planning for water and energy networks may focus.

InnoDexis Statement

“ICS-Sniper shows that encryption protects commands but not the timing and size patterns that reveal which commands matter, moving defence toward encryption with padding and obfuscation,” noted InnoDexis in its latest intelligence report.

Conclusion

The next phase to watch is whether padding and obfuscation can be deployed within the strict real-time requirements of water and energy control systems, and how far multi-route fallback pathways and the released code and traffic datasets strengthen defences. As systems connect to cloud services, exposure of this kind could grow, which makes early audits of control traffic a practical priority. InnoDexis will continue to track industrial control system security and critical infrastructure defence. The complete Industrial Control System Security Innovation Intelligence Report is available to InnoDexis subscribers and enterprise clients.

About InnoDexis

InnoDexis is a real-time innovation intelligence platform connecting scientific discovery to commercial opportunity. Powered by InnoGraph, its proprietary innovation knowledge graph, the platform maps technologies across the entire lifecycle, from early-stage research (TRL 1) to market deployment (TRL 9), connecting researchers, institutions, startups, companies, products and emerging opportunities.

Covering 40+ specialised industry segments and 360 technology areas, InnoDexis delivers innovation tracking, research discovery, product and startup intelligence, investment insights, and AI-powered reports. Its mission is to bridge the gap between scientific discovery and real-world impact.

InnoDexis — From Lab to Market: Real-Time Innovation Intelligence.