Instead of breaking into well-protected networks, attackers can destabilize them by disrupting the time of internal clocks. A simple radio jamming or spoofing attack on satellite GPS signals, still the main source of synchronization for all IT and OT systems in industry, is enough to cause chaos.
Time and synchronization have become elements of security and targets of modern hybrid warfare, warns Tomasz Widomski, member of the supervisory board at Elproma. The growing automation of Industry 4.0 relies on distributed networks where only coordinated time ensures proper operation. A five-minute desynchronization of Microsoft Active Directory blocks user authentication via Kerberos, cutting access to networks, server rooms, and even buildings. A five-second drift can destabilize VPN-protected networks.
Banks and stock exchanges require 100-microsecond accuracy under the MiFID II directive – without it, automated high-frequency trading may suffer financial losses. Smart grids need one-microsecond precision, and upcoming 5G and 6G networks demand nanosecond accuracy. Deliberate desynchronization offers attackers a cheap, hard-to-detect tool that can trigger cascading failures across critical infrastructure.
How GPS jamming and spoofing become weapons
The most common attack vector is radio jamming or spoofing of GNSS signals, particularly GPS. Widomski notes that many previously recorded security incidents are now linked to such interference. In regions like the Persian Gulf and Ukraine, intentional desynchronization of IT/OT systems has been confirmed. In Poland, a joint investigation with NASK revealed a bug in state administration systems: a time drift of just five seconds would block access to the National Court Register (KRS), paralyzing administrative and financial sectors.
A real-world example occurred on March 17, 2022, when 19 out of 33 train control nodes in eastern Poland lost synchronization, halting rail traffic for hours. Since then, GPS jamming over Poland has been reported almost daily in the media. The problem is serious and growing.
Poland fights back with a ground-based time system
To counter the threat, Poland launched eCzasPL in late 2023 – a ground-based system distributing official UTC(PL) time, completely independent of GNSS. Built by Elproma in cooperation with the Central Office of Measures (GUM), it uses atomic clocks connected via fiber optics. eCzasPL provides authenticated time to any registered Polish company or individual with a PESEL number, ensuring a reliable alternative when satellite signals are jammed or poisoned.
Widomski also warns about the risk of “poisoning” the public NTP POOL servers. Attackers can physically install hundreds of controlled NTP servers in a target country and manipulate the time sent to selected institutions. In the last quarter of 2024, Russia increased its public NTP server count by 200%. Poland has a government recommendation to raise its own count to at least 400, but implementation still awaits executive regulations.
Another line of defense is the Argos system, awarded at CyberMarket. It uses a miniaturized sensor to detect GNSS jamming and spoofing in real time, alerting critical infrastructure and allowing a switch to holdover mode or eCzasPL. Elproma’s NTP/PTP servers are already used by NATO member armies, including Poland, and by top financial institutions worldwide.
Widomski recommends that every medium and large enterprise in Poland install its own time server, synchronized simultaneously with Galileo, GPS, and eCzasPL. The Military University of Technology has published guidelines on designing resilient synchronization systems, and the GUM Time and Frequency Laboratory offers expert advice.
Źródło: WNP.PL, Fot. Shutterstock / panuwat phimpha
