Sep 6, 2026 · 27 min
Hackers can turn trusted time into a security vulnerability
When hackers control the clock. [T-Minus: Space-Cyber Briefing]
Modern computing, satellite navigation, and critical infrastructure depend on time that attackers may be able to manipulate.
- 1Systems often validate data inputs while quietly assuming their clocks are trustworthy.
- 2Manipulated time can revive expired credentials, disrupt distributed systems, and create safety risks in critical infrastructure.
- 3Resilient defenses require time-source redundancy and integrity checks, not accuracy alone.
Don't miss
Andy Davis connects leap-second incidents—including CPU spikes, lockups, crashes, and outages—to the broader challenge of recognizing manipulated time.
The brief
Time is a hidden security dependency: computing systems, satellite navigation, and critical infrastructure often trust clocks without defending them as carefully as other inputs.
Andy Davis of NCC Group explains how GPS spoofing and clock manipulation can undermine authentication, revive expired credentials, and produce failures that resemble ordinary software problems.
The risk extends beyond servers. Desynchronized power-generation and safety-critical systems can suffer outages or dangerous physical consequences when timing assumptions break.
The episode’s central prescription is to protect time integrity, not merely accuracy: organizations need redundant sources and systems designed for drifting or manipulated clocks.
Leap-second incidents involving CPU spikes, lockups, crashes, and service outages show why timing failures are difficult to recognize—and why resilience must be designed in advance.