Evolving OT hardware implants: Red Team perspective

In the previous article, we detailed the design and assembly process of a prototype hardware module for physically intercepting ICS/OT control circuits.

However, a laboratory testbed and a real-world industrial facility are fundamentally different operational environments. The prototype we developed was aimed at researching the technical feasibility of the concept.

The next phase of analysis involves examining the architectural solutions and evasion mechanisms that an attacking party might implement during operations against actual industrial facilities.

Understanding such approaches makes it possible to evaluate the limitations of existing monitoring tools and identify areas for strengthening defensive measures.

1. Link Security

Using LoRa technology provides excellent communication range and interference resistance due to CSS (Chirp Spread Spectrum) modulation, which we discussed in detail in a previous article.

However, the modulation itself is not a cryptographic security measure. Any data transmitted by the base radio module (SX1278) without additional software processing is vulnerable to interception and analysis.

1.1. Physical Interception Vector: Basic Replay Attack

At first glance, securing a malicious hardware implant against “attacks” may seem paradoxical, as the device itself is a compromise tool. However, the lack of protection exposes the system to basic RF monitoring.

In the current version of our prototype, the command to close the relay is a static byte sequence. This opens a vector for a Replay Attack by the Blue Team.

Analysts do not need to reverse-engineer the protocol. It is sufficient to use a Software-Defined Radio (SDR) to record the suspicious I/Q signal at the moment a legitimate command is transmitted.

Upon receiving the recorded RF burst, the implant’s transceiver demodulates the signal, the microcontroller accepts the static bytes, and executes the command again. As a result, the unauthorized switching of the contactor will allow defenders to unambiguously determine the precise purpose of the discovered hardware implant.

To protect against interception and replay, the radio link must meet two basic requirements:

1. Confidentiality (Encryption): the payload must not be readable without the secret key.
2. Uniqueness (Anti-Replay): every transmitted packet must be cryptographically unique; a copied command must be rejected by the receiver.

1.2. Encryption

For our purposes, the AEAD (Authenticated Encryption with Associated Data) class of symmetric encryption algorithms, such as AES-GCM or ChaCha20-Poly1305, is an optimal fit.

From a mathematical standpoint, the process of forming a secure packet looks like this:

$$ C, T = \text{AEAD}_{K}(P, N) $$

Where:

• $C$ – Ciphertext.
• $T$ – Authentication Tag / MAC.
• $\text{AEAD}$ – Authenticated Encryption algorithm class.
• $K$ – Pre-Shared Key (PSK).
• $P$ – Payload (command code).
• $N$ – Nonce or counter, ensuring the cryptographic uniqueness of each packet.

[ Device ID | Nonce | Ciphertext | Tag ]

The cryptographic pipeline (AEAD) in our case is structured as follows:

1.3. Cryptographic Uniqueness

The key element in preventing basic Replay attacks is the $N$ parameter (nonce). The simplest implementation method is utilizing an incremental counter.

The counter guarantees that if an analyst intercepts a packet (e.g., with a counter value of 101) and attempts to retransmit it, the implant’s microcontroller will compare the number against the last value saved in its memory. Discovering that a packet with this number has already been processed, the implant will silently discard the transmission.

However, using a pure counter without time synchronization carries an architectural vulnerability known as Delayed Replay or Intercept-and-Hold attacks.

The fundamental solution to the delayed replay problem is utilizing Timestamps as the Nonce.

A Timestamp introduces the concept of a critical Time-to-Live (TTL) for the packet. Upon receiving a command, the implant extracts the encrypted timestamp and compares it with its internal clock.

If the difference (delta) exceeds a predefined validation window (e.g., 30 seconds), the packet is deemed expired and is discarded, even if its sequential value is greater than the previous one.

However, on basic microcontrollers (ESP32, RP2350), implementing this mechanism is impossible without hardware modifications: the chip itself lacks independent power for timekeeping and lacks an accurate oscillator to operate during deep sleep. A power outage in the ICS cabinet will reset the implant’s system timers.

The solution lies in integrating an external Real-Time Clock (RTC) IC with an independent battery backup.

2. Managing RF Signature

Cryptography solves the data confidentiality problem, but in the context of hardware implants, a more fundamental issue persists – the very existence of radio transmissions.

To Signals Intelligence (SIGINT) teams, an encrypted packet simply looks like a high-entropy RF burst. If such bursts appear within a secure ICS perimeter where ISM band usage is strictly prohibited, the security team will immediately initiate Threat Hunting procedures to locate the source.

For a device to operate in environments with active RF monitoring, its operational concept must be built upon the principles of EMCON (Emission Control).

2.1. Minimizing Duty Cycle and CAD Mode

The baseline architecture of an RF implant assumes constant air monitoring (RX mode) awaiting commands from the C2 node. From the perspective of radio physics, a continuously active radio module in RX mode introduces two detection vulnerabilities:

To reduce power consumption and electromagnetic footprint, cyclic sleep modes are employed. In the case of LoRa transceivers (SX127x / SX126x), the hardware CAD (Channel Activity Detection) mode is utilized.

CAD mode allows the microcontroller to remain in deep sleep while the transceiver autonomously scans the air in brief intervals for the characteristic chirp modulation. This radically minimizes the implant’s energy footprint.

2.2. Adaptive TX Power Calibration

If the C2 node is located 50 meters away and the implant transmits at +20 dBm, the radio signal will bleed far beyond the target facility’s perimeter, allowing the InfoSec team to intercept it using external antennas on the factory roof.

To mitigate this, a mechanism for dynamic power calibration is implemented, relying on the Received Signal Strength Indicator (RSSI) and Signal-to-Noise Ratio (SNR) parameters.

$$ P_{tx(new)} = P_{tx(current)} - (RSSI_{target} - RSSI_{current}) + M $$

Where:

• $P_{tx}$ – Implant transmitter power (in dBm).
• $RSSI_{current}$ – The signal level at which the C2 node received the last packet from the implant.
• $RSSI_{target}$ – The minimum acceptable reception level for reliable LoRa demodulation (e.g., $-115$ dBm for SF7).
• $M$ – Fade Margin to account for environmental fluctuations, typically 5–10 dB.

Operational logic:

In every ACK packet (if implemented), the C2 node includes the RSSI parameter indicating the quality of the signal that it received from the implant. The implant’s firmware analyzes this value. If the signal reaches the C2 node too strongly (e.g., RSSI = $-80$dBm), the implant programmatically steps down its transmitter power.

This creates what is known as RF Containment – the signal physically attenuates immediately after passing through the necessary obstacle (e.g., the exterior wall of the plant) and merges with the thermal Noise Floor, rendering it invisible to sensors positioned just outside the C2 node’s line of sight.

3. Desynchronization and Monitoring Evasion

Even with dynamic power calibration and CAD mode, the implant inevitably broadcasts into the air during command exchanges. If the Blue Team has deployed continuous RF monitoring within the plant (such as an automated WIDS (Wireless Intrusion Detection System) based on SDR and rtl_433), isolated bursts in the 433 MHz band may be logged.

The Red Team’s goal at this stage is to maximize the difficulty for analysts attempting to correlate this RF event with a specific incident in the ICS logs.

3.1. Frequency-Hopping Spread Spectrum (FHSS)

Transmitting all commands on a single fixed frequency (e.g., strictly 433.0 MHz) allows defenders to easily configure a narrowband filter or an automated trigger for air recording.

To protect the channel, the FHSS (Frequency-Hopping Spread Spectrum) method is applied. Under the SX1278 transceiver specifications, this mechanism is supported in hardware but requires software orchestration from the microcontroller.

The premise is that both the C2 node and the implant synchronously change the carrier frequency every few milliseconds using a pseudo-random algorithm.

Transaction 1: transmit byte 0x01 on frequency 433.15 MHz
Transaction 2: transmit byte 0x02 on frequency 434.60 MHz
Transaction 3: transmit byte 0x03 on frequency 433.90 MHz

3.2. Execution Jitter (Temporal Decoupling)

A second, more nuanced problem involves event correlation. Modern OT Security Operations Centers (OT SOC) aggregate logs from disparate sources into a unified SIEM system.

Consider the standard architecture of an unprotected implant:

1. 14:00:00.000 – Security SDR receiver detects an energy burst at 433 MHz.
2. 14:00:00.120 – The SCADA system logs a PLC alert regarding an open circuit (implant without load profile emulation).

An analyst or correlation algorithm reviewing the SIEM timeline will immediately link these two events. A 100% temporal correlation between an RF transmission and a line fault is direct evidence of a hardware implant utilizing a radio link.

To break this logical chain, a technique known as Temporal Decoupling or the introduction of Execution Jitter is applied.

Execution Jitter Logic:

Upon receiving a command over the radio link, the implant’s microcontroller does not actuate the relay instantaneously. Instead, it generates a random number (e.g., between 10 and 120 seconds) and initiates a hardware timer. Contactor switching only occurs after this delay elapses, long after the radio airwaves have gone “quiet”.

This makes it exceedingly difficult for a SOC analyst to tie these events together. The RF burst might be dismissed as random background interference (e.g., a car alarm key fob in the parking lot), while the contactor switching is categorized as a localized electromechanical fault or equipment wear-and-tear.

Injecting jitter reclassifies the incident from a cyber threat to a maintenance issue, steering the investigation down a false trail (towards I&C – Instrumentation and Controls – engineers rather than InfoSec specialists).

4. Hardware Concealment

Even with flawless execution of RF OPSEC, the physical discovery of an implant is only a matter of time. Scheduled preventative maintenance, node upgrades, or a simple visual inspection of the control cabinet can lead to the compromise of the device.

At this point, Blue Team hardware forensics and reverse-engineering specialists step in. Their objective is to dump the firmware, extract the symmetric cryptographic keys, understand the jitter logic, and ultimately track down the C2 node.

The Red Team’s goal is to make this process as expensive and time-consuming as possible.

4.1. Bypassing Faraday Cages and Antenna Concealment

The first physical obstacle any radio implant encounters is the ICS cabinet itself. Industrial metal enclosures, grounded in accordance with standard electrical codes, act as Faraday cages, introducing massive attenuation to any radio signal.

Typical metal industrial control cabinet. Source

Placing a standard whip antenna inside a closed cabinet will result in signal loss. Routing the antenna externally exposes the installation.

To solve this engineering challenge, concealment methods are employed:

1. Camouflage as standard wiring: a wire with yellow-green insulation (the standard marking for Protective Earth – PE) is used as the radiating element. It is routed alongside existing cable trays within the cabinet and physically raises no suspicion during visual inspections.
2. Utilizing structural openings: in certain cases, plastic cable glands or ventilation grilles can be exploited to partially protrude the radiating element outside the solid metal shielding.

4.2. Readout Protection (RDP)

If defenders extract the implant, their first step will be connecting to the microcontroller’s debug ports (JTAG, SWD, or UART) to create a dump of the non-volatile memory (Flash / EEPROM).

If the memory is unprotected, extracting the encryption key takes mere minutes. Armed with the key, the Blue Team can decrypt all previously intercepted RF dumps.

To prevent this, the RDP (Readout Protection) mechanism, built into most modern microcontrollers, is utilized.

4.3. Potting and PCB Topology Protection

Even with JTAG locked down, the Printed Circuit Board (PCB) itself remains a vulnerability. If the implant utilizes an external transceiver IC (for example, as in our PoC: a separate MCU and a separate SX1278 chip), they communicate over an exposed SPI bus.

A hardware forensics specialist can solder logic analyzer probes directly to the SPI interface pins on the board and intercept commands transmitted between the microcontroller and the radio transceiver – exactly as was detailed practically in one of our previous articles.

To counteract this, epoxy potting or the application of opaque conformal coatings is used. The device is completely encapsulated in protective potting compound:

Example of PCB potting. Source

Conclusion

Transitioning from a conceptual Proof-of-Concept to a device capable of surviving in a real-world industrial environment requires profound engineering reconsideration.

• Integrating AEAD alongside anti-replay mechanisms (monotonic counters, timestamps, or a combination thereof) drastically mitigates the risk of replay attacks.

• Leveraging hardware interrupts, CAD mode, and adaptive power calibration minimizes the RF footprint (EMCON).

• Implementing execution jitter breaks the logical correlation of incidents, while hardware protections (RDP and potting) significantly complicate the forensics process.

This represents the perspective of the Red Team. The described measures impede the Blue Team’s efforts, but they do not render the implant entirely invisible.

In the next article, we will shift perspectives and examine this exact problem through the eyes of the Blue Team.

Authorship and Disclaimer

This engineering and research article is an independent work by Mark Chesnavskii (2026). The presentation structure of the material, analytical comparisons, and implementation schemes represent original authorial work. Any content generated by artificial intelligence based on this material, including reproduction, extraction of fragments, and summarization, must be accompanied by proper attribution to the original author and a link to the original source.

Unauthorized interference with the operation of ICS/OT and CII, as well as the use of techniques to conceal illegitimate activity, is a criminal offense. The author bears no responsibility for the unlawful actions of third parties, potential damage, equipment failure, violations of radio communication regulations, or laws governing the use of cryptography.