Slashdot Mirror
Researchers Find Crippling Flaws In Global GPS
mask.of.sanity writes "Researchers have developed attacks capable of crippling Global Positioning System infrastructure critical to the navigation of a host of military and civilian technologies including planes, ships and unamed drones. The novel remote attacks can be made against consumer and professional-grade receivers using $2500 worth of custom-built equipment. Researchers from Carnegie Mellon University and Coherent Navigation detailed the attacks in a paper. (pdf)"
The paper isn't really about attacking GPS infrastructure. It's about attacking GPS receivers. Some of these receivers may be part of other sorts of infrastructure. I was at CCS when the paper was presented. It's all about sending fake GPS satellite signals to receivers to exploit bugs in the software in the receivers. The work is interesting and includes attacks which can desynchronize the clocks on some devices and there was one device you could essentially brick by telling it at the satellite was at radius 0 (center of the earth) resulting in a divide by 0 overflow. I liked the paper and thought it was neat, and it could do serious damage to particular systems which rely on GPS if they have the right type of flaws in their software to be exploited by this attack, but it was not an attack against the GPS satellites or anything like that.
This isn't news. The GPS signal is very, very weak. It's actually right at the noise floor and using some rather ingenious encoding to resolve the signal. The signal itself is fully-documented for consumer equipment. Given the weak signal strength and the protocol having no encryption or validation to speak of, of course jamming is possible; Receiver selectivity dictates it'll lock on to the strongest signal, the root square law dictates that just about any terrestrial source with line of sight will be stronger than the one in space. The only problem to work out then is processing; You have to figure out where the receiver is now, and then figure out where you want it to be, and adjust all the signals it could receive from the GPS satellites simultaniously to cause it to (falsely) lock on to the new position. And considering that the timing needs to be in fractions of a millisecond to have any value at all, you need to be very exact.
Most of the equipment is dedicated to computing what the signal needs to be.... the actual transmitter is dirt cheap.
#fuckbeta #iamslashdot #dicemustdie
Planes and Ships don't rely on GPS.
If you have a license to pilot any of them, you have learned how to navigate without.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
What the fuck is with the science press in Britain / Australia about the word "boffins"? Why does every single science article, without fail, have to have some supposedly clever pun or alliteration around the word? (Extra points for using the word astro-boffins.)
I've gotten to the point that if I see the word "boffins" in a science article, I immediately click away. Please make it stop!
heh, "unnamed" drones.
OMG not the unnamed drones. I hate the named ones....take them!
Drones are unmanned, not unnamed
Those dornes without names are dangerous !!
GPS is a nice alternative, but the Navy (US and Royal at least) still spends a lot of time teaching navigation by the stars, dead reckoning, etc. The nautical charts and star location books are still published and issued to ships. Tomahawk cruise missiles and nuclear ballistic missiles are capable of not using GPS. A pain, not having GPS, but their are ways around not having it.
Also known as a HARM target.
Have gnu, will travel.
Some poor bugger drives to the wrong destination.
GPS isn't trusted. It's already known to be hackable.
It would be news if they hacked the anti-spoofing system the military has been using for the last 6 years
Planes especially very much rely on GPS, it's at the heart of all navigation systems in airliners. Even most private GA pilots use handheld ones if it's not part of the panel, unless they are intentionally flying by railroad tracks and highways. I believe LORAN was shut down a few years ago. The US Navy considers sextant use so useless that it was dropped from required study at the Academy some years ago, although it may still be taught as an elective.
GPS is also at the heart of many military precision guided missiles and shells.
You are a really misinformed troll.
Infuriate left and right
Spoofing the signals to make receivers mistake their position isn't the point of this report. It's the potential to brick the receivers which is new.
Infuriate left and right
All testing was done using the latest IPhone5.
Who needs to cripple a GPS, when an iPhone can leave you stranded all by itself!
Does it work for Glonass too? The paper didn't mention anything about alternative positioning systems. Lots of modern chips come with support for at lest GPS+Glonass nowadays. If you're serious about terrorism you probably going to take down both systems.
Up until about 3 years ago we in North America had another electronic navigation system in-place and operational: LORAN C.
The loran system -though not as precise as GPS- was in many respects much more difficult to jam. Upgrades were planned that would have improved the loran system; instead, in a spectacular case of "penny wise-pound foolish" the sysetm was turned off, and its infrastructure (think 'some of the tallest antenna masts ever built' ) quickly dismantled/destroyed.
http://en.wikipedia.org/wiki/LORAN
From Wikipedia:
"In November 2009, the U.S. Coast Guard announced that the LORAN-C stations under its control would be closed down for budgetary reasons after January 4, 2010 provided the Secretary of the Department of Homeland Security certified that LORAN is not needed as a backup for GPS.[19]
On 7 January 2010, Homeland Security published a notice of the permanent discontinuation of LORAN-C operation. Effective 2000 UTC 8 February 2010, the United States Coast Guard terminated all operation and broadcast of LORAN-C signals in the USA...
[In the quoted Wikipedia article, the following paragraph was placed BEFORE the above]
Originally completed 20 March 2007 and presented to the co-sponsoring Department of Transportation and Department of Homeland Security (DHS) Executive Committees, the report carefully considered existing navigation systems, including GPS. The unanimous recommendation for keeping the LORAN system and upgrading to eLORAN was based on the team's conclusion that LORAN is operational, deployed and sufficiently accurate to supplement GPS. The team also concluded that the cost to decommission the LORAN system would exceed the cost of deploying eLORAN, thus negating any stated savings as offered by the Obama administration and revealing the vulnerability of the U.S. to GPS disruption.[18]"
end of quoted Wikipedia material
Loran and its technological successor E-loran are still available in some more enlightened parts of the world (see linked article)
Note that I am a USian. The above is NOT one of my country's
more shining (dare I say 'brighter') decisions.
In brief, the paper basically says engineers who build GPS receivers often write crappy firmware that doesn't do good bounds or sanity checking on the data contained within the GPS signal. (This should hardly be a surprise given how crappy firmware and device drivers are in general.) Fake a GPS signal with bad data that fits within the parameters of normal GPS signal and you can get these badly designed GPS receivers to freak out. And, of course, since crappy engineering is more or less a universal constant, the same would apply to other GNSS systems.
Why do they have to go and build these jammers?
When I'm traveling and need cash, I need my Global GPS to be able to find ATM Machines!
Novel attack... demoed at TEDxAustin back in February and posted online for everyone to see ;-) http://www.ted.com/talks/todd_humphreys_how_to_fool_a_gps.html
I was hoping to read that the attack vector was swapping the systems with an iPhone....
Researchers have developed attacks capable of crippling Global Positioning System infrastructure critical to the navigation of a host of military and civilian technologies including planes, ships and unamed drones.
What happens if they run "uname -a" then?
Seriously, you had to go that far, when they had "Global GPS" (yep, Global Global Positioning System) right in the headline?
Seriously though Slashdot management must have zero concern about low quality, sloppy, careless editing. I would fire in a heartbeat any so-called "editor" who can't even bother to run a spell-checker at least once in a while.
Yeah? YMBNH...
What an insult to everyone else who is expected to actually perform and do a good job to earn their paycheck. In this economy there are PLENTY of people who would do a better job and possibly for less money than what Slashdot staff are currently making. Perhaps they should start contacting Slashdot management and making offers? The current crop of "editors" would be no competition at all.
It is widely suspected that the current crew of /. do not receive a "paycheck" at all, but are paid in bananas, peanuts, or some such simian treat. But if you want them put away, feel free to contact the local zoo with a tip about their missing baboons....
send in 007
Iran could have been telling the truth about spoofing GPS coordinates?
The US government would never lie to me, would it?
Isn't this exactly why the P-Code is encrypted in the military signal? Spoofing the C/A data has been a known vulnerability in the system since day 1. The rest of the problems are simply bad programmers. That's not a limitation or vulnerability in the GPS system - it's a problem with the receiver manufacturers and the BS test & validation done by the civilian side of the government when they put those receivers in the CORS stations. I saw the code in some of the old reference receivers (in the 90s) - it was complete shit. No software design, no real architecture, no configuration management, it was a bunch of crap hacked together by the engineers. Full of debug code, obsolete comments and large sections of code that were bypassed with a "aaa =0; if (aaa == 1) {....a bunch of test code....} As long as it passed the acceptance testing, and it fit on the flash card, no one cared what it looked like inside the flash.
For me "middle of the earth" attack was a new and interesting idea... otherwise this paper would have read a heck of a lot better had the hyperbole been left at home.
The contorted attempt to say changing time is not "spoofing" or including offtopic segways such as hacking web servers and perl CGI scripts was a little too much to stomach.
No mention at all of RAIM and similiar technologies.
Geez, these guys were unable to find $50 GPS jammers on Alibaba?
Excuse me, but please get off my Pennisetum Clandestinum, eh!
We hear of Chinese hackers attacking American websites, now we have Americans hacking Iranian websites. What does this have to do with GPS? Why of course, the loss of American Drones over Iran, with the loss suspected due to hacking GPS signals making the drones think they are somewhere else (both location and altitude). This has only happened twice, but highlights what can happen to JDAM style bombs and drones.
On board GPS jamming so that any GPS tracker put in your car would show a random position. 1) you know where the receiver is 2) you want it to be far away at random place static, say white house who cares where
is what the Navy and the rest of the Military/Covert Ops use they are sorely misled. In fact, general researchers would be required to have top secret classified clearance and most certainly would not be publishing their findings. NASA has several levels of GPS solutions. We lowly consumers use very old tech for GPS/GIS.
And I rode through the dessert on a drone with no name...
Finally a way to stop the USA raining it's bombs down on innocent people all over the world.
I use it to get to my local Automated ATM.
Yup, rather dumb move, saving peanuts compared to most budgets, but the US Coastguard ran it, and they're really strapped for cash.
Shame, since as well as the benefits you note, the infrastructure was successfully used to broadcast data to augment GPS accuracy. This would perhaps been a more convincing arguement for keeping it in place, since it's true that in recent years usage was reported to have dropped considerably.
Are receivers for other global positioning systems like Galileo and GLONASS also vulnerable to these attacks? If so, is it too late (or even possible in theory) to fix the problem in those systems, given that they aren't fully online or in widespread use yet?
They know the cost of everything but the value of nothing. Unless its related to re-election campaigns.
I can't fucking believe it. Do you mean to tell me that if you have a receiver tuned to a certain frequency, and you have a transmitter on that same frequency, then you can transmit information from the transmitter to the receiver?
Top it off though! If you have not one but two - TWO transmitters, and one is vastly more powerful than the other, then you can get the receiver to receive the stronger one over the weaker one?
Completely fucking amazing, if you ask me. I had no idea you could do something like that. It's almost like, when I'm at a party, I can hear the people who are talking louder better than I can hear the people who are being quiet, and stand a better chance of recovering the information they are conveying.
Wow. Whowouldathunkit?
Combine this with Apple maps and you may end up in the right place after all...
Planes and Ships don't rely on GPS.
They don't HAVE to use it but in actual practice they most certainly do rely heavily on GPS. It's the best system available so of course they rely on it.
If you have a license to pilot any of them, you have learned how to navigate without.
Just because people are trained to do without GPS in case of problems doesn't mean they don't rely on it in actual daily practice.
I can still receive a legit signal, delay it and broadcast the delayed signal to the victim. And no, it is not easily to detect this "discontinuity" as loss of signal is rather common. Just drive through NY or a very mountainous area and you will find out why.
At least it will allow the government to clean up the maritime charts by removing the LORAN-C TD lines that clutter them up.
http://www.loran-history.info/Atafu/LoranChart-Atafu.jpg
http://img641.imageshack.us/img641/7070/clipimage002it.jpg
Tiller's Rule: Never use a word in written form that you've only heard and never read. You will end up looking foolish.
Bump keys can be used to unlock just about any door, and yet crime statistics remain in line and have even been dropping in many parts of the world since the Internet has raised their profile in recent years.
This would be more interesting if someone were droning my neighborhood, but some of the hacks took days, not minutes to perform (and as others pointed out, affects individual receivers, not the entire system). Hardly a James Bond villain level of manipulation.
"Well, good luck finding a judge that doesn't run a bestiality site."
If you had any clues you would know what a "replay attack" is.
Get that Book of Mr Schneier and get yourself a EE education. There is very little they can "secure" using crypto. They can just deny third parties access to accurate positioning/timing.
Why wouldn't they write a paper describing it? That's the traditional academic advertising approach, as opposed to, say, the Pons & Fleischmann approach of hold press conference then write paper.
I guess 200$ worth of RF components, some soldering and a crappy laptop will be sufficient to get the control tower declare a major emergency ?
Mount that package on a balloon, deploy at Heathrow, Atlanta, or New York an see how long it takes for the to get some ELINT aircraft investigate. I am sure it would take them hours and they would shut down all airports in the area because they are already 100% dependent on this to get the aircraft timely onto the runways. And if they can't make it timely, the backlog will be dramatic in less than an hour. If they don't divert quickly, some a/c will run out of fuel (especially the cheapos like RyanAir, who give a fuck about spare fuel regulations).
Scaremonger ? Well maybe. Wait until someone tries.
you are the troll. Pilots are still required to be able to use alternate means of navigation. Such as terrestrial beacons.
Crypto just denies the other guys your signal. It DOES NOT stop the other guys replaying your nice crypted signal and re-broadcasting in the direction of YOU DUMB ASS and your crypto-GPS receiver. You will think that your real position is on the hill while your Abrams-Dumbass-panzer is already sitting in the river.
..guiding an 300 passenger a/c into a nice hill in afghanistan (by means of 2000$ hardware) would be enormous fun for some people.
See my reply to the parent message of yours.
At least he didn't say "Global GPS System".
As a licensed airplane pilot and USCG licensed ship's captain, I can tell you with absolute certainty that we do in fact use GPS extensively in both fields. We have become highly reliant on GPS and it would have a profound negative impact on both air travel and shipping if the GPS system were taken down.
We are highly reliant on the extreme accuracy of GPS and AIS. We, as professionals, are not solely dependent on it, but it would suck to lose it. I'd hate to have to break out a sextant and land(ship) hundreds of meters or even kilometers from my intended destination when I am well use to coming within small fractions of a meter of my destination after thousands of kilometers of fully automated operation. English channel without GPS & AIS? I'd rather have root canal without anesthetic.
The loran system -though not as precise as GPS- was in many respects much more difficult to jam.
If you'd read the article, you'd have realized that it wasn't about jamming the GPS signal. It's about sending false data to GPS units in order to attack them directly and cause crashes, brick the receivers, etc. Loran being more difficult to jam does not mean that Loran systems would be any less vulnerable to the types of attacks discussed in the article.
And now we can say it wasn't our fault...
... has at least a half dozen clandestine GPS systems in use. The researchers haven't fathomed how to disrupt these, and I don't think it's obscurity that secures them, I think they're obscure because they're so ridiculously secure we'd rather not tempt other nations to reverse engineer them. The dozens of GPS systems we DO know about, used by USAF or Navy fx., these are independent systems using different communication protocols. You might ruin my ability to find a local restaurant but you will *never* disrupt the military's capacity to track its assets accurately and precisely across the globe.
We are shocked to find such flaws in our systems. The USAF will work tirelessly to eliminate these flaws.
And we promise there aren't any more. You can stop looking now.
Indeed, still good here in the UK. You can build a Loran receiver that'll feed the PC soundcard at the cost of a few pennies, and get highly accurate time info from it to boot.
Absolute madness to kill off such a simple, reliable system.
But since GPS is so expensive by comparison, there's plenty of money to pay lobbyists with...
All your ghosts are just false positives.
I heard about this on the Risky Business Podcast a month ago. Patrick interviewed Tyler Nighswander and they talked about the Divide by 0 issue, as well as how many receivers are out in the middle of nowhere, and have other issues (easily guessable passwords)...
http://risky.biz/RB261
It's all damned lies and statistics!! I mean 47% of all people use statistics to back up their arguments.
LORAN was a great system, but I'm not sure the decision to shut it down is as shortsighted as you imply. LORAN wouldn't be used much now that GPS receivers are so widespread and cheap. It would still be useful as a backup on ships but if someone wanted to run a ship aground using GPS jamming they could also jam LORAN. There's no reason to think LORAN receivers wouldn't have similar software bugs as GPS receivers. Either way, the appropriate backup for GPS, LORAN or both is a navigator who knows what he's doing and can figure out where the water ends without using electronics of any kind.