Compromising Synchrophasor Data by Attacking Time Synchronization: A Hardware-Lab Study

Time synchronization is crucial for reliable operation in IEC 61850-based substations with time-dependent devices such as Phasor Measurement Units and Merging Units. Cyber-physical attacks on synchronization can compromise integrity and reliability, potentially leading to misaligned measurements, disrupted protection functions and unsafe operating conditions. We introduce the two-clock attack, which exploits switchover behavior between redundant clocks and show the vulnerability of time synchronization to four different kinds of Global Navigation Satellite Signal attacks using a realistic testbed environment, demonstrating their impacts on the IEC 61850 Sampled Values protocol. A feasibility vs. impact matrix and recommendations to improve security are provided. Our findings indicate that devices from different vendors cannot be relied upon to interoperate correctly under Time Synchronization Attacks, as they respond inconsistently when under attack. To support further research and realistic impact analysis, we make the captured network traffic available online.