SCADA Replay Attack: Sequence & Timestamp Validation

What is a SCADA Replay Attack?

A SCADA (Supervisory Control and Data Acquisition) system is used in critical infrastructure such as power plants, water treatment facilities, and transportation networks. A replay attack involves recording legitimate traffic from the system and then playing it back to deceive the system into performing unauthorized actions. This can include opening breakers or valves, which could have catastrophic consequences.

The SCADA Replay Attack simulation demonstrates how attackers can use recorded data to launch a sophisticated attack that bypasses security measures by replaying normal-looking messages while injecting malicious commands.

How Sequence and Timestamp Validation Works

Sequence number validation ensures that each message is in the correct order, preventing attackers from inserting out-of-order commands. Timestamp validation checks if a message was sent recently enough to be considered valid. Together, these mechanisms can significantly reduce the risk of successful replay attacks.

In the simulation, you can see how a naive receiver accepts all messages, leading to an attack success, while a validated receiver rejects stale or duplicate messages, blocking the attack.

Why It Matters

SCADA systems control essential infrastructure that, if compromised, could lead to widespread outages, environmental damage, and loss of life. Sequence and timestamp validation are crucial for maintaining system integrity and preventing unauthorized actions.

By understanding how these attacks work and the effectiveness of validation techniques, cybersecurity professionals can better protect critical infrastructure from cyber threats.

Real-World Examples

In 2015, a Stuxnet worm attack on Iran’s Natanz uranium enrichment facility is believed to have used similar techniques to disrupt centrifuges. Sequence and timestamp validation could have prevented such attacks by ensuring that only current and in-order commands are executed.

The乌克兰电网攻击事件也展示了此类攻击的严重性，通过篡改SCADA系统的通信可以导致大规模停电。

Frequently asked questions

Try it live

Everything above runs in your browser — open SCADA Replay Attack: Sequence & Timestamp Validation and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.