Spoofing

What is spoofing?

Spoofing is a collective term for attacks in which an attacker poses as a trusted device, user or service by forging an identifier, such as a MAC address, IP address, DNS response, sender address or protocol message. The aim is deception: the victim accepts traffic, commands or measured values because they appear to come from a known source. In OT networks, spoofing can lead to data falsification, unauthorised control of equipment and the undermining of network security, often without the operator noticing anything.

🧠 How does spoofing work?

Every network relies on identifiers that say who is sending something: a MAC address at layer 2, an IP address at layer 3, a domain name in DNS or a station address in an industrial protocol. As long as such an identifier is not cryptographically protected, an attacker can simply fill it in. Spoofing is therefore not a break-in in the classic sense, but the abuse of trust that was never verified.

In office IT, that risk is largely covered by encrypted connections (TLS), certificates and strong authentication. Industrial automation is different. Many protocols date from the era of closed serial networks: Modbus (1979), DNP3 and classic S7comm accept any message with the right format and address. A PLC cannot tell whether a write command comes from the real SCADA server or from a laptop plugged into a spare switch port.

Spoofing is therefore often the first step of a larger attack. Whoever poses as the gateway sits between two parties (Man-In-The-Middle); whoever poses as the engineering workstation can send commands; whoever forges measured values can make an operator believe everything is normal.

🔧 Which types of spoofing occur in OT?

Email spoofing looks like an IT problem, but in practice it is a common route into OT: a forged email “from the supplier” with a new firmware version or a request for remote access is a classic opening move of social engineering.

🏭 Why are industrial protocols so vulnerable to spoofing?

Most fieldbus and controller protocols were designed for reliability and speed, not for authentication. Secure variants now exist for the most important protocols, but they are still rare in existing installations.

Two caveats apply. First, a secure variant only works when both ends support it and the old variant is switched off afterwards. Second, every certificate-based solution requires certificate management; an expired certificate in a substation is an availability risk.

🎯 Which OT scenarios are most realistic?

The best-known example of the last scenario is Stuxnet. According to Ralph Langner’s analysis, the malware recorded roughly 21 seconds of normal sensor values and replayed them in a loop during the sabotage, so that operators and monitoring systems saw a healthy process. That is a combination of spoofing and a replay attack.

Since version 19 (April 2026), MITRE ATT&CK for ICS describes this behaviour under Unauthorized Message (T1692), with the sub-techniques Command Message (false commands) and Reporting Message (false reports and measured values). Adversary-in-the-Middle is listed as a separate technique in the matrix.

🔄 What is the difference between spoofing, replay and man-in-the-middle?

The three overlap: spoofing is usually the means of reaching the middle position, and replay is a form of spoofing that uses genuine but outdated messages. That is why the same measures often protect against all three: authentication with sequence numbers or timestamps, and integrity checking.

🛡️ How do you protect an OT network against spoofing?

Mind the limits. MAC filtering and port security on their own do not stop an attacker who takes over the MAC address of a device that is switched off or disconnected; 802.1X with certificates does. Because 802.1X only authenticates when the port comes up, an attacker with a hub or tap behind an authenticated device can still piggyback; MACsec (IEEE 802.1AE) closes that gap by cryptographically protecting every frame on the link. For IP spoofing at the network edge, ingress filtering according to BCP 38 (RFC 2827, May 2000) applies: a router only accepts source addresses that belong to the attached network.

In IEC 62443-3-3, the anti-spoofing requirements fall mainly under SR 1.2 (software process and device identification and authentication, from security level 2) and SR 3.1 (communication integrity). Anyone designing a zone at SL 2 or higher must therefore show that devices can recognise each other and that messages cannot be altered unnoticed in transit.

🔍 How do you detect spoofing?

• ARP monitoring - flags an IP address that suddenly maps to a different MAC address, or two devices using the same address
• IDS/IPS - systems such as Suricata recognise known attack patterns; a network monitor such as Zeek records all ARP, DNS and protocol traffic for analysis
• Passive OT monitoring - learns the normal communication relationships (which HMI talks to which PLC, with which function codes) and raises an alarm on a new sender
• Network monitoring - visualises anomalies in traffic patterns, such as a new device or a rogue device on a switch port
• SIEM - collects and correlates spoofing-related logs from switches (DAI drops, port security violations) and firewalls
• Process plausibility - compare measured values with physical expectations; a sensor that keeps repeating exactly the same pattern is suspicious

An up-to-date asset inventory is the foundation: without a list of known MAC and IP addresses, a forged device cannot be distinguished from a legitimate one.

🛠️ How do you tackle spoofing step by step?

1. Inventory every device with its MAC address, IP address, switch port and communication relationships.
2. Segment the network into zones and conduits so that spoofing stays contained within one zone.
3. Enable switch features that a managed switch already offers: port security, DHCP snooping, Dynamic ARP Inspection and IP Source Guard. Use static bindings for devices with a fixed IP address, because most PLCs do not use DHCP.
4. Introduce 802.1X or NAC where devices support it, and MAB (MAC Authentication Bypass) with strict VLAN assignment where they do not.
5. Choose secure protocol variants when replacing or extending systems: OPC UA with SignAndEncrypt, Modbus/TCP Security, DNP3 SAv5.
6. Monitor with passive monitoring and send alarms to the OT SOC or SIEM.
7. Test periodically, in a test environment or during maintenance, whether the measures actually block ARP and IP spoofing.

In the Netherlands, this is no longer optional. The Dutch Cyberbeveiligingswet (Cybersecurity Act), the national implementation of NIS2, has been in force since 15 August 2026 and requires essential and important entities to take appropriate measures for network security and access control. Anti-spoofing measures at layers 2 and 3 are a concrete, demonstrable way to meet that obligation.

❓ Frequently asked questions

Is spoofing the same as hacking?

Spoofing is one specific technique within hacking: the attacker poses as a trusted source by forging an address or sender. Spoofing is often the first step, followed by a man-in-the-middle attack, data manipulation or the sending of false commands.

Can a PLC tell that a command has been spoofed?

A PLC using a classic protocol such as Modbus TCP or S7comm cannot recognise a spoofed command, because the protocol has no authentication. Only with secure variants such as OPC UA with signing, Modbus/TCP Security or DNP3 Secure Authentication can the controller verify the sender.

Does MAC filtering help against spoofing?

MAC filtering offers limited protection against spoofing, because an attacker can easily copy an allowed MAC address from a device that is switched off or disconnected. Combine MAC filtering with 802.1X, Dynamic ARP Inspection and monitoring that flags duplicate or relocated MAC addresses.

What is the difference between ARP spoofing and IP spoofing?

ARP spoofing forges the mapping between IP and MAC address within a local network, so that traffic flows through the attacker. IP spoofing forges the source IP address in the packets themselves, often to bypass firewall rules or to send one-way commands over UDP.

Is GPS spoofing a risk for industrial installations?

GPS spoofing is a real risk for installations that take their time from GNSS, such as substations and networks with PTP grandmasters. A spoofed time source shifts the clock unnoticed, making the sequence of events, logging and certificate validation unreliable.

Which standard sets requirements for protection against spoofing in OT?

IEC 62443-3-3 sets the main requirements against spoofing in OT, in particular SR 1.2 for authenticating devices and software processes and SR 3.1 for communication integrity. For power grids, IEC 62351 adds security for protocols such as IEC 61850 and DNP3.

📌 In summary

Spoofing is a fundamental threat in OT networks, because industrial systems trust addresses and messages that are rarely verified. By enforcing identity with 802.1X and switch security, choosing secure protocol variants and monitoring traffic passively, you prevent systems from being misled or hijacked.