How Feasible are Steganographic and Stealth Attacks on TIA Project Metadata of ICS: A Case Study with Real-world Data

The protection of industrial control systems (ICS) is crucial for a robust provision of essential services for the modern society. Stealthy and steganographic attacks are a considerable threat against the reliability and security of such ICS. Several ICS components are maintained via the popular Totally Integrated Automation (TIA) project software. In this paper, we investigate TIA project metadata of a German car manufacturer, in particular an axis and a soldering tip project. We analyze the devices’ metadata and their changes over time to determine whether modifications would potentially appear as anomalies when being monitored. Our results show that most TIA project attributes do not change or change very rarely, rendering such attributes mostly unsuitable for hiding information as well as for conducting stealthy attacks.