Slashdot Mirror
Researchers Find Crippling Flaws In Global GPS
mask.of.sanity writes "Researchers have developed attacks capable of crippling Global Positioning System infrastructure critical to the navigation of a host of military and civilian technologies including planes, ships and unamed drones. The novel remote attacks can be made against consumer and professional-grade receivers using $2500 worth of custom-built equipment. Researchers from Carnegie Mellon University and Coherent Navigation detailed the attacks in a paper. (pdf)"
The paper isn't really about attacking GPS infrastructure. It's about attacking GPS receivers. Some of these receivers may be part of other sorts of infrastructure. I was at CCS when the paper was presented. It's all about sending fake GPS satellite signals to receivers to exploit bugs in the software in the receivers. The work is interesting and includes attacks which can desynchronize the clocks on some devices and there was one device you could essentially brick by telling it at the satellite was at radius 0 (center of the earth) resulting in a divide by 0 overflow. I liked the paper and thought it was neat, and it could do serious damage to particular systems which rely on GPS if they have the right type of flaws in their software to be exploited by this attack, but it was not an attack against the GPS satellites or anything like that.
This isn't news. The GPS signal is very, very weak. It's actually right at the noise floor and using some rather ingenious encoding to resolve the signal. The signal itself is fully-documented for consumer equipment. Given the weak signal strength and the protocol having no encryption or validation to speak of, of course jamming is possible; Receiver selectivity dictates it'll lock on to the strongest signal, the root square law dictates that just about any terrestrial source with line of sight will be stronger than the one in space. The only problem to work out then is processing; You have to figure out where the receiver is now, and then figure out where you want it to be, and adjust all the signals it could receive from the GPS satellites simultaniously to cause it to (falsely) lock on to the new position. And considering that the timing needs to be in fractions of a millisecond to have any value at all, you need to be very exact.
Most of the equipment is dedicated to computing what the signal needs to be.... the actual transmitter is dirt cheap.
#fuckbeta #iamslashdot #dicemustdie
Planes and Ships don't rely on GPS.
If you have a license to pilot any of them, you have learned how to navigate without.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
What the fuck is with the science press in Britain / Australia about the word "boffins"? Why does every single science article, without fail, have to have some supposedly clever pun or alliteration around the word? (Extra points for using the word astro-boffins.)
I've gotten to the point that if I see the word "boffins" in a science article, I immediately click away. Please make it stop!
heh, "unnamed" drones.
GPS is a nice alternative, but the Navy (US and Royal at least) still spends a lot of time teaching navigation by the stars, dead reckoning, etc. The nautical charts and star location books are still published and issued to ships. Tomahawk cruise missiles and nuclear ballistic missiles are capable of not using GPS. A pain, not having GPS, but their are ways around not having it.
Also known as a HARM target.
Have gnu, will travel.
Some poor bugger drives to the wrong destination.
GPS isn't trusted. It's already known to be hackable.
It would be news if they hacked the anti-spoofing system the military has been using for the last 6 years
Planes especially very much rely on GPS, it's at the heart of all navigation systems in airliners. Even most private GA pilots use handheld ones if it's not part of the panel, unless they are intentionally flying by railroad tracks and highways. I believe LORAN was shut down a few years ago. The US Navy considers sextant use so useless that it was dropped from required study at the Academy some years ago, although it may still be taught as an elective.
GPS is also at the heart of many military precision guided missiles and shells.
You are a really misinformed troll.
Infuriate left and right
Spoofing the signals to make receivers mistake their position isn't the point of this report. It's the potential to brick the receivers which is new.
Infuriate left and right
Does it work for Glonass too? The paper didn't mention anything about alternative positioning systems. Lots of modern chips come with support for at lest GPS+Glonass nowadays. If you're serious about terrorism you probably going to take down both systems.
Up until about 3 years ago we in North America had another electronic navigation system in-place and operational: LORAN C.
The loran system -though not as precise as GPS- was in many respects much more difficult to jam. Upgrades were planned that would have improved the loran system; instead, in a spectacular case of "penny wise-pound foolish" the sysetm was turned off, and its infrastructure (think 'some of the tallest antenna masts ever built' ) quickly dismantled/destroyed.
http://en.wikipedia.org/wiki/LORAN
From Wikipedia:
"In November 2009, the U.S. Coast Guard announced that the LORAN-C stations under its control would be closed down for budgetary reasons after January 4, 2010 provided the Secretary of the Department of Homeland Security certified that LORAN is not needed as a backup for GPS.[19]
On 7 January 2010, Homeland Security published a notice of the permanent discontinuation of LORAN-C operation. Effective 2000 UTC 8 February 2010, the United States Coast Guard terminated all operation and broadcast of LORAN-C signals in the USA...
[In the quoted Wikipedia article, the following paragraph was placed BEFORE the above]
Originally completed 20 March 2007 and presented to the co-sponsoring Department of Transportation and Department of Homeland Security (DHS) Executive Committees, the report carefully considered existing navigation systems, including GPS. The unanimous recommendation for keeping the LORAN system and upgrading to eLORAN was based on the team's conclusion that LORAN is operational, deployed and sufficiently accurate to supplement GPS. The team also concluded that the cost to decommission the LORAN system would exceed the cost of deploying eLORAN, thus negating any stated savings as offered by the Obama administration and revealing the vulnerability of the U.S. to GPS disruption.[18]"
end of quoted Wikipedia material
Loran and its technological successor E-loran are still available in some more enlightened parts of the world (see linked article)
Note that I am a USian. The above is NOT one of my country's
more shining (dare I say 'brighter') decisions.
In brief, the paper basically says engineers who build GPS receivers often write crappy firmware that doesn't do good bounds or sanity checking on the data contained within the GPS signal. (This should hardly be a surprise given how crappy firmware and device drivers are in general.) Fake a GPS signal with bad data that fits within the parameters of normal GPS signal and you can get these badly designed GPS receivers to freak out. And, of course, since crappy engineering is more or less a universal constant, the same would apply to other GNSS systems.
Novel attack... demoed at TEDxAustin back in February and posted online for everyone to see ;-) http://www.ted.com/talks/todd_humphreys_how_to_fool_a_gps.html
Researchers have developed attacks capable of crippling Global Positioning System infrastructure critical to the navigation of a host of military and civilian technologies including planes, ships and unamed drones.
What happens if they run "uname -a" then?
Seriously, you had to go that far, when they had "Global GPS" (yep, Global Global Positioning System) right in the headline?
Seriously though Slashdot management must have zero concern about low quality, sloppy, careless editing. I would fire in a heartbeat any so-called "editor" who can't even bother to run a spell-checker at least once in a while.
Yeah? YMBNH...
What an insult to everyone else who is expected to actually perform and do a good job to earn their paycheck. In this economy there are PLENTY of people who would do a better job and possibly for less money than what Slashdot staff are currently making. Perhaps they should start contacting Slashdot management and making offers? The current crop of "editors" would be no competition at all.
It is widely suspected that the current crew of /. do not receive a "paycheck" at all, but are paid in bananas, peanuts, or some such simian treat. But if you want them put away, feel free to contact the local zoo with a tip about their missing baboons....
send in 007
Isn't this exactly why the P-Code is encrypted in the military signal? Spoofing the C/A data has been a known vulnerability in the system since day 1. The rest of the problems are simply bad programmers. That's not a limitation or vulnerability in the GPS system - it's a problem with the receiver manufacturers and the BS test & validation done by the civilian side of the government when they put those receivers in the CORS stations. I saw the code in some of the old reference receivers (in the 90s) - it was complete shit. No software design, no real architecture, no configuration management, it was a bunch of crap hacked together by the engineers. Full of debug code, obsolete comments and large sections of code that were bypassed with a "aaa =0; if (aaa == 1) {....a bunch of test code....} As long as it passed the acceptance testing, and it fit on the flash card, no one cared what it looked like inside the flash.
For me "middle of the earth" attack was a new and interesting idea... otherwise this paper would have read a heck of a lot better had the hyperbole been left at home.
The contorted attempt to say changing time is not "spoofing" or including offtopic segways such as hacking web servers and perl CGI scripts was a little too much to stomach.
No mention at all of RAIM and similiar technologies.
Geez, these guys were unable to find $50 GPS jammers on Alibaba?
Excuse me, but please get off my Pennisetum Clandestinum, eh!
They wrote a "uname" daemon that's hosted on aerial drones. But of course there's a flame war over whether to use Kdrone or Gdrone... .
XML is like violence. If it doesn't solve your problem, you're not using enough of it. --AC
is what the Navy and the rest of the Military/Covert Ops use they are sorely misled. In fact, general researchers would be required to have top secret classified clearance and most certainly would not be publishing their findings. NASA has several levels of GPS solutions. We lowly consumers use very old tech for GPS/GIS.
And I rode through the dessert on a drone with no name...
Yup, rather dumb move, saving peanuts compared to most budgets, but the US Coastguard ran it, and they're really strapped for cash.
Shame, since as well as the benefits you note, the infrastructure was successfully used to broadcast data to augment GPS accuracy. This would perhaps been a more convincing arguement for keeping it in place, since it's true that in recent years usage was reported to have dropped considerably.
Are receivers for other global positioning systems like Galileo and GLONASS also vulnerable to these attacks? If so, is it too late (or even possible in theory) to fix the problem in those systems, given that they aren't fully online or in widespread use yet?
They know the cost of everything but the value of nothing. Unless its related to re-election campaigns.
Just so long as you have to enter your PIN number...
I can't fucking believe it. Do you mean to tell me that if you have a receiver tuned to a certain frequency, and you have a transmitter on that same frequency, then you can transmit information from the transmitter to the receiver?
Top it off though! If you have not one but two - TWO transmitters, and one is vastly more powerful than the other, then you can get the receiver to receive the stronger one over the weaker one?
Completely fucking amazing, if you ask me. I had no idea you could do something like that. It's almost like, when I'm at a party, I can hear the people who are talking louder better than I can hear the people who are being quiet, and stand a better chance of recovering the information they are conveying.
Wow. Whowouldathunkit?
Planes and Ships don't rely on GPS.
They don't HAVE to use it but in actual practice they most certainly do rely heavily on GPS. It's the best system available so of course they rely on it.
If you have a license to pilot any of them, you have learned how to navigate without.
Just because people are trained to do without GPS in case of problems doesn't mean they don't rely on it in actual daily practice.
At least it will allow the government to clean up the maritime charts by removing the LORAN-C TD lines that clutter them up.
http://www.loran-history.info/Atafu/LoranChart-Atafu.jpg
http://img641.imageshack.us/img641/7070/clipimage002it.jpg
Tiller's Rule: Never use a word in written form that you've only heard and never read. You will end up looking foolish.
Bump keys can be used to unlock just about any door, and yet crime statistics remain in line and have even been dropping in many parts of the world since the Internet has raised their profile in recent years.
This would be more interesting if someone were droning my neighborhood, but some of the hacks took days, not minutes to perform (and as others pointed out, affects individual receivers, not the entire system). Hardly a James Bond villain level of manipulation.
"Well, good luck finding a judge that doesn't run a bestiality site."
I can still receive a legit signal, delay it and broadcast the delayed signal to the victim. And no, it is not easily to detect this "discontinuity" as loss of signal is rather common. Just drive through NY or a very mountainous area and you will find out why.
Yes, that is a man in the middle attack, which is an understood problem, and one of the ways to counter that is authentication which uses a timestamp. Given that GPS is entirely based around having extreme precision timestamps, it's probably not going to be very difficult discard 'delayed' messages.
Running an internal clock with precision (within seconds per year) is trivial. At best you could only delay messages a second or two before the receiver decided something was fishy. And that assumes a very simplistic method of authentication.
Out of modpoints but really liked a post? 1BDkF6TtmmeZ3yqXbz9yhdYVqRYnwFoXDj
At least he didn't say "Global GPS System".
True - but they are being shut down 1 by 1 as they fail. My old route I had memorized to get around DCA used a radial from a VOR that is now dead :(
The loran system -though not as precise as GPS- was in many respects much more difficult to jam.
If you'd read the article, you'd have realized that it wasn't about jamming the GPS signal. It's about sending false data to GPS units in order to attack them directly and cause crashes, brick the receivers, etc. Loran being more difficult to jam does not mean that Loran systems would be any less vulnerable to the types of attacks discussed in the article.
Don't forget DSC - that will go tits-up too. Can you imagine AIS with a bunch of spoofed GPS positions? OMFG that would be bad in a crowded area :( Likewise spoofed ADS-B.
BTW - I heard a Mayday call go out because the *backlight* on a GPS died and the skipper could not find his way home after dark. It was a clear night and he was anchored NEXT TO A LIGHTHOUSE and he was LOST ANYWAY!
Okay, there's two things going on here. You're assuming confidentiality only when encryption is perfectly capable of providing both confidentiality and integrity. Basically with encryption (if you do it right) you can assure both that the enemy cannot use your signal *and* that the signal you got as legitimately sent from your outer space transmitter.
Of course you could potentially jam the military signal, though Frequency-Hopping Spread Spectrum tends to make this...challenging. So you have an encrypted channel being transmitted at hundreds of different frequency bands that even if you had the encryption keys (good luck) you would still have to have a broad spectrum transmitter in perfect sync with the receivers (even harder) in order to spoof military equipment. This is not your standard civilian swill that you're dealing with.
Protip: the military built the system with the idea in mind that the people they are shooting at would try to fuck it up.
And now we can say it wasn't our fault...
You are on a LOT of drugs if you think there are "dozens" of sat-nav systems.
Indeed, still good here in the UK. You can build a Loran receiver that'll feed the PC soundcard at the cost of a few pennies, and get highly accurate time info from it to boot.
Absolute madness to kill off such a simple, reliable system.
But since GPS is so expensive by comparison, there's plenty of money to pay lobbyists with...
All your ghosts are just false positives.
I heard about this on the Risky Business Podcast a month ago. Patrick interviewed Tyler Nighswander and they talked about the Divide by 0 issue, as well as how many receivers are out in the middle of nowhere, and have other issues (easily guessable passwords)...
http://risky.biz/RB261
It's all damned lies and statistics!! I mean 47% of all people use statistics to back up their arguments.
Well, there are three problems that show just how ignorant you are.
First off. GPS guided bombs and missles make it so we attack a building with a single bomb, rather than our old method which was to carpet bomb the entire city and 20 miles around it with thousands of bombs.
Second off. The bomb will now hit some non-target rather than the target. Hope your kid doesn't happen to be in the school it just hit rather the command bunker it was supposed to hit.
Third off. They don't even use GPS for the last bit of guidance. GPS gets you 'close' so that other things such as terrain following radar can do the final guidance or bring the missle to bear on the laser designator.
Maybe we'll get lucky and you'll be the next one blown to bits by a misdirected rocket.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
LORAN was a great system, but I'm not sure the decision to shut it down is as shortsighted as you imply. LORAN wouldn't be used much now that GPS receivers are so widespread and cheap. It would still be useful as a backup on ships but if someone wanted to run a ship aground using GPS jamming they could also jam LORAN. There's no reason to think LORAN receivers wouldn't have similar software bugs as GPS receivers. Either way, the appropriate backup for GPS, LORAN or both is a navigator who knows what he's doing and can figure out where the water ends without using electronics of any kind.