by Barry Manz, Editor
Supervisory control and data acquisition (SCADA) systems have been in the news lately, and not in a good way. Programmable logic controllers (PLCs) across U.S. water, energy, and government facilities are being targeted by alleged Iran-affiliated threat actors. But while the PLCs are the objective, to reach them, the attackers had to come in somewhere, typically a network using cable and increasingly fiber. However, wireless is the other way in, and where SCADA has been modernized with radio links at various points in the network, those links remain a weak point, one an adversary can reach without ever touching the wired core.
A large share of supervisory control and data acquisition traffic moves over licensed and unlicensed radio, across distances that make cable impractical, on equipment that in many installations has been in the field for 15 to 30 years. Control rooms still run on discontinued hardware and serial protocols that predate Ethernet, and the radios carrying telemetry from remote sites are of the same vintage: rarely patched, and frequently unencrypted because resisting an adversary was never a design requirement when they were installed. A wireless link an adversary can receive, terminated in equipment too old to have been built against one, is an RF and microwave problem. The band, the modulation, the link margin, the transceiver, and whether authentication is switched on the radio are the terms in which this exposure is described and eventually closed.
Why So Much Telemetry Goes Over the Air
SCADA architecture is distributed by nature. A water utility polls remote pump stations and reservoirs, and a pipeline operator gathers pressure and flow data from valve sites strung across hundreds of miles. A utility’s distribution automation reaches reclosers and capacitor banks on poles far from any fiber run. Trenching a cable to each of these points is rarely economic, so the remote terminal units at the edge report back over radio.
The physical layer varies with vintage and distance. Legacy licensed telemetry commonly sits in the VHF and UHF land-mobile bands and in the 900 MHz Multiple Address System allocation, carrying low-rate serial data over narrowband FSK. Unlicensed spread-spectrum radios in the 900 MHz, 2.4 GHz, and 5 GHz ISM bands handle shorter hops and higher rates. Point-to-point microwave in the licensed 6, 11, 18, and 23 GHz bands backhauls aggregated traffic from a concentrator to a control center. Increasingly, cellular and satellite fill in where private infrastructure is impractical, which introduces a dependency on a carrier’s network that the operator does not control.
What ties these together is the protocol payload. Modbus and DNP3 dominate the application layer, and both were specified for reliability and simplicity on trusted serial links, not for operation across a channel an adversary can receive. Neither carries meaningful authentication in its common deployments. A frame that reaches the RTU with the right structure is acted upon. Whether that frame arrived over a wire or through the air is not something the protocol inspects.
Obscurity Was the Security, and SDR Ended It
A software-defined radio moves the functions once fixed in analog hardware — mixing, filtering, modulation, and demodulation — into software running behind a wideband analog-to-digital converter, so one device can be retuned and reprogrammed to almost any waveform instead of being built for one.
The result is that a receive-only unit covering 25 MHz to 1.7 GHz costs a few tens of dollars; a transmit-capable platform spanning 1 MHz to 6 GHz, enough to reach every band in licensed and unlicensed telemetry short of the microwave backhaul hops, runs a few hundred bucks. That range takes in the VHF and UHF land-mobile channels, the 900 MHz Multiple Address System allocation, and the 2.4 and 5 GHz ISM bands where most wireless SCADA operates.
Security researchers who have reverse-engineered wireless SCADA installations have shown that plaintext Modbus and DNP3 can be recovered off the air with commodity receivers and open-source tooling, exposing the state of a monitored process to anyone within range. There is also the FM capture effect, in which the stronger of two co-channel FM signals dominates the receiver and opens a path to command injection. That is, a transmitter closer to, or with higher signal strength than, the legitimate remote can potentially override it.
What makes the device more than a scanner is the open-source signal-processing stack around it. Frameworks such as GNU Radio let a user assemble a demodulator, or a transmitter, from standard blocks, and once the work of decoding a particular protocol is done, it lives in a flowgraph that anyone can reuse. A single reconfigurable radio folds several formerly separate capabilities into one: survey a band, identify and decode the traffic, replay a captured frame, or synthesize a new one and transmit it. The capability that makes SDR indispensable is what also erases the obscurity these telemetry links were counting on.
Installed, Then Forgotten
Compounding all of this is a maintenance model built around reliability rather than scrutiny. A remote SCADA site is usually unmanned, sometimes hours from the nearest technician, and the equipment in it — the RTU, the radio, the antenna, the power supply — sits in an enclosure exposed to temperature swings, moisture, dust, UV, and vibration that would retire most bench instruments in a season. The working assumption is that once a site is commissioned and reported, it is left alone until something stops working. Inspection is triggered by failure, not scheduled against it.
That approach keeps plants running, but it carries a security cost unrelated to uptime. Firmware that is never touched is firmware that is never patched. And a site no one visits is a site where a change in the RF environment — an added antenna, a nearby transmitter, a quietly swapped or reprogrammed radio — can persist for months with no one positioned to notice. The same neglect that lets a decades-old link keep working unattended is what would let tampering with it go unseen.
The Attack Surface in RF Terms
The simplest is denial of the channel. Jamming an unprotected narrowband telemetry link degrades or blocks the flow of data by raising the noise floor, an attack on availability. A control center that stops receiving from a remote site may fail in a safe position. Narrowband links with modest fade margins are the easiest to deny, and the transmitter required is neither large nor sophisticated.
Above jamming sits spoofing and injection, which attack integrity rather than availability. If the waveform, framing, and protocol are known, and none of it is authenticated, an adversary can generate a signal the receiver accepts as legitimate. The consequence ranges from feeding an operator false readings to issuing a command the field device executes. Replay is the low-effort version of the same idea: capture a valid transmission and retransmit it later, which succeeds against any link that does not include freshness in its message authentication, because there is nothing in the frame to mark it as stale.
Eavesdropping is the passive case and the enabler for the rest. Recovering the traffic reveals the process being controlled, the polling structure, and the bytes that constitute valid commands, which is the reconnaissance an active attack is built on.
Two system-level dependencies sit squarely in RF and microwave territory. The first is timing. Synchrophasor measurement units that give operators a wide-area view of a grid state depend on GNSS for microsecond time alignment. GNSS spoofing, one of the most thoroughly demonstrated SDR attacks in the literature, can corrupt the time reference that phasor data is built on, degrading state estimation without touching a single control message.
The second is the backhaul link itself. The February 2022 attack on the KA-SAT satellite network is the cleanest illustration. It was a network attack, malware that bricked modems, not RF interference, but its collateral effect was the loss of remote monitoring for 5,800 wind turbines in Germany. The turbines kept turning; the operator went blind. It demonstrated, at scale, that the communications path can be the single point of failure regardless of how robust the controller and the plant beneath it are.
Demonstrated Is Different from Exploited
With the partial exception of the satellite incident above, the RF layer has not been the vector in the most devastating industrial attacks. Stuxnet, the Ukrainian grid attacks, the Colonial Pipeline shutdown, the Oldsmar and Aliquippa water-system intrusions, and the current critical-infrastructure campaign all arrived through IT and OT network paths.
The reasons wireless links have not been exploited are straightforward. RF attacks require proximity; they require knowledge of a specific system, and they scale poorly compared with an intrusion that can be launched from another continent over the internet. Those are real deterrents, but they’re eroding. SDR has lowered the knowledge and equipment cost. The number of wireless endpoints is climbing as industrial IoT pushes radios onto more field assets. The reading is not that a wireless-SCADA catastrophe is imminent, but that the factors holding the risk down are weakening, and the design decisions being made now will be in the field for decades.
What the Engineer Controls
The mitigations that matter most are, encouragingly, physical- and link-layer choices that RF and microwave engineers are positioned to make. The first is encryption and message authentication on the radio. Many current industrial transceivers support AES with authenticated framing that defeats eavesdropping, injection, and replay. The failure is rarely the absence of the capability and usually the presence of a large installed base that predates it, or a deployment where the feature was left disabled to preserve legacy interoperability or spare a few milliseconds of latency. Specifying authenticated encryption as a default rather than an option is the highest-leverage decision in the chain.
Spread spectrum is worth understanding precisely for what it does and does not provide. Direct-sequence and frequency-hopping techniques improve resistance to jamming and lower the probability of intercept, which raises the cost of both denial and reconnaissance. They are not, by themselves, security. A frequency-hopping link with no authentication is still injectable by an adversary who can follow or predict the hop sequence, so spread spectrum belongs in the design as jam resistance layered beneath cryptographic integrity, not as a substitute for it.
Anti-jam and link-margin discipline follow from the same reasoning. Adequate fade margin, frequency agility, and, on the higher-value backhaul hops, adaptive antenna techniques such as controlled-reception-pattern arrays that null an interferer all raise the power an attacker must bring to deny the channel. For timing-dependent nodes, GNSS anti-spoofing is now a tractable design element rather than a research topic: multi-constellation receivers, signal-authentication schemes such as Galileo’s OSNMA, receiver autonomous integrity monitoring, and inertial or oscillator holdover that carries a node through a spoofing attempt without surrendering its time reference.
Finally, the radio itself is now a software target, so authenticated firmware and secure boot on the transceiver module close a path that is easy to overlook when the focus is on the RF chain. And because none of these measures is perfect, external spectrum monitoring earns its place as an intrusion-detection layer. A quiet band that suddenly carries an unexpected signal, or a jammer raising the noise floor, is an observable event, and monitoring for it turns an invisible RF attack into an alarm an operator can act on.
The Engineer’s Stake
While controllers get the headlines, the link that carries a controller’s data across open country is a radio link, and its security is decided by the same engineering choices that set its range and reliability. Modulation, framing, encryption defaults, and timing integrity are not features a security team can bolt on after the fact. They are fixed at design time, in the transceiver and the system around it.
The RF layer of wireless SCADA has been treated as invisible for a long time, but not any longer, because the equipment needed to receive it and to transmit it now costs less than a bench instrument and demands little skill from whoever operates it.
Software-defined radio erased the obscurity that once passed for security. Wireless endpoints multiply with every industrial-IoT rollout, and the jamming and spoofing methods once reserved for electronic warfare sit within reach of a widening set of actors. The conditions that kept these links safe by accident are the ones now giving way, and what replaces them must be engineered in on purpose. That work falls to whoever chooses the band, sets the modulation, and decides whether authentication is turned on, which is to say it falls to the RF and microwave engineer.