Direct Attack to Space Communication Links: Record and replay TC/TM or mission specific packets

ID Name
T2008.004 Exploitation of clear mode (also known as safe mode)
T2008.006 Record and replay TC/TM or mission specific packets

An attacker can record and replay TC/TM packets to deceive the spacecraft or the ground station, causing an unexpected behavior or an erroneous evaluation of the spacecraft status. An attacker can gain access to the data exchanged in a payload channel or even spoof TC. Usually the TM replay doesn't cause an impact, unless timing information are transmitted. [1]

Standard/references: [2] [3] [4] [5]

ID: T2008.006
Sub-technique of:  T2008
Tactic: Initial Access
Platforms: Space-link communication
Version: 2.0
Created: 25 August 2022
Last Modified: 21 April 2023

Mitigations

ID Mitigation Description
M2004 CCSDS SDLS Sequence numbers

References