Record and replay TC/TM or mission specific packets
Parent: T2008
Description
An attacker can record and replay TC/TM packets to deceive the spacecraft or the ground station, causing an unexpected behavior or an erroneous evaluation of the spacecraft status. An attacker can gain access to the data exchanged in a payload channel or even spoof TC. Usually the TM replay doesn't cause an impact, unless timing information are transmitted. (Citation: SRC017) Standard/references: (Citation: SRC003) (Citation: SRC005) (Citation: SRC009) (Citation: SRC014)
Mapped SPARTA techniques
4 techniques
T2008.006 'Record and replay TC/TM or mission specific packets' is the direct cross-framework counterpart of EX-0001 Replay — both describe re-transmission of previously captured authentic traffic to elicit the same processing.
T2008.006 explicitly covers replaying TC packets — directly aligned with EX-0001.01 Command Packets (resending authentic-looking telecommands with valid framing, CRC/MAC, counters).
T2008.006 covers 'TC/TM or mission specific packets' replay; EX-0001.02 Bus Traffic Replay extends the same concept to internal spacecraft buses (1553, SpaceWire, custom). SPACE-SHIELD has no bus-replay-specific technique, so the closest applicable level is T2008.006's mission-specific-packets scope.
T2008.006 'Record and replay TC/TM or mission specific packets' covers replay of TC/TM packets — direct match to EXF-0001's replay of valid commands to induce downlink transmission of recorder playbacks, payload products, and housekeeping snapshots.
Cite as SafeMode Space, space-shield T2008.006.