safemode.space
← All techniques
EX-0013.02
ST0004Execution
sub-technique

Erroneous Input

Parent: EX-0013

Description

In this variant, the attacker injects non-useful energy or data, noise, malformed frames, or near-valid messages, so receivers and parsers labor to acquire, decode, and reject it. At the RF layer, wideband or protocol-shaped interference drives AGC and clock recovery to hunt, elevates BER, and forces repeated acquisitions; at the link layer, frames with correct preambles but bad CRCs keep decoders busy while yielding no payload; at the application layer, malformed packets force parse/validate/deny cycles that still consume CPU and fill error logs. On internal buses, collisions or bursts of misaddressed traffic reduce effective bandwidth and reorder legitimate messages. Even though little of the injected content passes semantic checks, the effort of dealing with it crowds out real work and may trigger retransmission storms or fallback modes that further increase load. The hallmark is volumetric invalid activity, crafted to engage front ends and parsers just long enough, that degrades integrity and availability without relying on privileged or authenticated commands.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(h)
    addresses
    high
    derived

    Availability obligation covers erroneous-input flooding; products must resist parser-saturation through hardened ingress logic and resource controls.

  • craAnnex I, Part II, (3)
    addresses
    moderate
    derived

    Security testing (fuzzing of telecommand parsers and bus decoders) is the manufacturer-side discipline that surfaces parser fragility erroneous-input flooding exploits.

  • eu-space-actArt. 83(1)
    addresses
    moderate
    direct

    83(1)'s continuous monitoring detects elevated error-log volumes and BER spikes characteristic of erroneous-input floods.

  • eu-space-actArt. 84(2)
    addresses
    moderate
    direct

    Erroneous-input flooding attacks the parser/decoder layers — 84(2)'s Annex VII point 5.1 compliance includes resilience to malformed-input handling.

  • nis2Art. 21(2)(b)
    addresses
    high
    derived

    Volumetric invalid activity engaging front-ends and parsers (BER spikes, repeated acquisitions, error-log floods, retransmission storms) is detectable; Art. 21(2)(b)'s incident-handling capability must surface those signals.

  • nis2-implAnnex 6.5.1
    addresses
    moderate
    derived

    Security-testing policies (fuzzing of telecommand parsers and bus-message decoders) surface the parser fragility erroneous-input flooding exploits, before flight.

  • nis2-implAnnex 6.5.2
    addresses
    high
    derived

    Erroneous-input-flooding test scope (telecommand-parser fuzzing, malformed-frame ingestion testing) is exactly the procedural detail Annex 6.5.2 requires the entity to define under its testing policy.

  • nis2-implAnnex 6.5.3
    addresses
    moderate
    derived

    Annex 6.5.3 review-cadence ensures erroneous-input testing scope stays aligned with parser-evolution and protocol changes.

  • nis2-implAnnex 6.7.1
    addresses
    moderate
    derived

    Network-security obligations cover ingress hardening of receivers and parsers against malformed and noise inputs; this is the protective layer that prevents erroneous-input flooding from becoming a denial event.

ENISA controls

  • ENISA-STL-2025-03-sD.23-i03
    addresses
    high

    Transmission security including jam-resistant waveforms reduces the productivity of wideband or protocol-shaped RF noise injection.

  • ENISA-STL-2025-03-sD.29-i02
    addresses
    moderate

    IDS/IPS detects malformed-traffic patterns and provides countermeasures within fault-management constraints.

  • ENISA-STL-2025-03-sD.31-i05
    addresses
    moderate

    Capacity planning for peak processing including cyber-relevant cases sizes the FSW pipeline for malformed-input load.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, EX-0013.02 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.