  Although organizations are continuously making concerted efforts to harden
their systems against network attacks by air-gapping critical systems,
attackers continuously adapt and uncover covert channels to exfiltrate data
from air-gapped systems. For instance, attackers have demonstrated the
feasibility of exfiltrating data from a computer sitting in a Faraday cage by
exfiltrating data using magnetic fields. Although a large body of work has
recently emerged highlighting various physical covert channels, these attacks
have mostly targeted open-loop cyber-physical systems where the covert channels
exist on physical channels that are not being monitored by the victim. Network
architectures such as fog computing push sensitive data to cyber-physical edge
devices--whose physical side channels are typically monitored via state
estimation. In this paper, we formalize covert data exfiltration that uses
existing cyber-physical models and infrastructure of individual devices to
exfiltrate data in a stealthy manner, i.e., we propose a method to circumvent
cyber-physical state estimation intrusion detection techniques while
exfiltrating sensitive data from the network. We propose a generalized model
for encoding and decoding sensitive data within cyber-physical control loops.
We evaluate our approach on a distributed IoT network that includes computation
nodes residing on physical drones as well as on an industrial control system
for the control of a robotic arm. Unlike prior works, we formalize the
constraints of covert cyber-physical channel exfiltration in the presence of a
defender performing state estimation.
