New timing attack exploits clock sync to crash critical networks with 100% success

A team of researchers at the University of Kaiserslautern-Landau (authors Shreya Vithal Kulhalli, Mohammad Ibrahim Alkoudsi, Gerhard Fohler) has published a paper on arXiv presenting a new class of attack against network-agnostic guardians in time-triggered communication protocols. These guardians, which enforce predefined network schedules without needing full network awareness, are simpler and cheaper than network-aware alternatives, but depend on the controlled node for clock synchronization. The researchers proved a theoretical lower bound on achievable clock precision between a node and its guardian, and built a practical timing attack that leverages this inevitable imperfection.

The attack causes a malicious node to gradually desynchronize its guardian without detection, eventually causing the guardian to allow message collisions with targeted critical network frames. Using a FlexRay fieldbus model implemented in OMNeT++ (a popular discrete event simulation framework for communication networks), the attack achieved a 100% success rate in both remaining undetected and disrupting the transmission of critical messages. The work was presented at the 29th International Symposium on Real-Time Distributed Computing (ISORC 2026). This highlights a fundamental security limitation in a widely used automotive and industrial network protocol, especially concerning safety-critical systems like brake-by-wire or drive-by-wire.