Rogue Master
Description
Adversaries may setup a rogue master to leverage control server functions to communicate with outstations. A rogue master can be used to send legitimate control messages to other control system devices, affecting processes in unintended ways. It may also be used to disrupt network communications by capturing and receiving the network traffic meant for the actual master. Impersonating a master may also allow an adversary to avoid detection. In the case of the 2017 Dallas Siren incident, adversaries used a rogue master to send command messages to the 156 distributed sirens across the city, either through a single rogue transmitter with a strong signal, or using many distributed repeaters. (Citation: Bastille April 2017) (Citation: Zack Whittaker April 2017)
Mapped SPARTA techniques
3 techniques
T0848 'Rogue Master' is the ATT&CK ICS initial-access technique for an adversary setting up a rogue control-server-equivalent to communicate with outstations — exact concept-match for SPARTA IA-0008 'Rogue External Entity' where the adversary stands up own GS or spacecraft to impersonate a legitimate master. Tactic and activity align directly; this is the closest concept-match in any framework.
A rogue ground station impersonating a legitimate master to issue commands to the spacecraft is the orbital instance of T0848 'Rogue Master' — exact concept-match (rogue master in ICS protocols ≈ rogue GS in TT&C protocols).
A rogue spacecraft transmitting on the target's command frequency is an orbital instance of T0848 'Rogue Master' — the rogue spacecraft acts as an unauthorised master attempting to control the target; same conceptual pattern as the ICS rogue-master attack.
Cite as SafeMode Space, mitre-attack-ics T0848.