GPS Spoofing With $3000 Worth of Equipment and a Laptop

First time accepted submitter svartbjorn writes "Todd Humphreys and a team from the University of Texas proved the concept that a terrorist could take over the navigation of a ship or even a plane, making it appear to the crew that the ship was moving along a straight line course when in fact it was changing course under the control of the device. This raises some serious issues for this being used for terrorist purposes."

Comments

Now

[memnock]

the feds will require all laptops to be registered and have a remote kill switch installed. Can't let the terrorists win!!

Re:Now

[SpaceLifeForm]

Then you don't let them on the ship with a laptop and antenna.

Re:Now

[CODiNE]

Even better, we can add handprint recognition to knives so they only work for the registered owner.

OMG TERRORIST

[Spy Handler]

terrorists could do this, terrorists could do that, they can KILL YOU in so many ways! Run for your lives! Or better yet, submit to your federal overlords via TSA DHS who will keep you safe!

Actually no, fuck the terrorists, they're third world noobs living in mud huts and the best they could do in 12 years of trying realyl hard is to hijack a few planes with knives. You have more to fear from your own government than any terrorist.

Over and out

Re:OMG TERRORIST

[Jane Q. Public]

"Actually no, fuck the terrorists, they're third world noobs living in mud huts and the best they could do in 12 years of trying realyl hard is to hijack a few planes with knives. You have more to fear from your own government than any terrorist."

And that's assuming, of course, that they really did it to begin with. I'm not about to claim otherwise, but the evidence is actually pretty thin and there is a lot of counter-evidence. That's just the truth.

But anyway... I think really the bigger question is: who ever really doubted this could be done? All it takes to spoof a radio signal is a stronger signal... and GPS is a pretty damned low-power signal.

Of course, you do have to do the actual spoofing... that's where the $3000 comes in. But I mean, it has always been technically feasible. I guess they're just saying it's cheaper now.

Re:OMG TERRORIST

[Anonymous Coward]

All utensils are now banned besides chopsticks and forks.

Re:OMG TERRORIST

[__aaltlg1547]

Or pirates could run ships aground so they can steal the cargo. Also useful for defending targets against military guidance systems.

Re:OMG TERRORIST

[__aaltlg1547]

It's pretty tricky, really. You have to simulate at least 4 satellites' signals, compensating for their orbital movement at the position where you want to tell your target it's located.

Re:OMG TERRORIST

[jamesh]

Actually no, fuck the terrorists, they're third world noobs living in mud huts and the best they could do in 12 years of trying realyl hard is to hijack a few planes with knives.

In a lot of ways that's a "better" feat than crashing a plane with a rogue GPS signal. There's next to nothing feasible the government could do to the people to stop this happening.

OTOH, by taking down a few planes with knives the terrorists have manage to make the American government really work hard against the people, instead of for the people. Some might argue that it was already, but it's definitely worse now. The average American is now worse off because of 9/11, mainly because of the governments reaction, not the terrorist act itself.

If i was a terrorist, i'd be pretty pleased with myself.

Re:OMG TERRORIST

[icebike]

It's pretty tricky, really. You have to simulate at least 4 satellites' signals, compensating for their orbital movement at the position where you want to tell your target it's located.

But its just numbers and time. That's all the GPS receiver knows about. It knows nothing actual orbits or movements. Just precise time and epheremis numbers.
The signals would be trivial to generate with a computer.

GPS jammers are even easier. I was approaching a tractor trailer in Utah one moment, and the next the GPS was in a "Recalculating" frenzy and I was jumping from Montana to Iowa and points in between. After I was half a mile away from the rig everything was back to normal. Apparently some long-haul truckers don't like to be tracked. The thing was, the GPS didn't say it lost signal, it indicated I was suddenly in specific locations hundreds of miles away.

Re:OMG TERRORIST

[ebno-10db]

I was approaching a tractor trailer in Utah one moment, and the next the GPS was in a "Recalculating" frenzy and I was jumping from Montana to Iowa and points in between.

Sounds like your GPS needs better position filtering.

Re:OMG TERRORIST

[interkin3tic]

This has always been evident to anyone with half a brain, yet it hasn't stopped the insanity. So perhaps we can use the paranoia of terrorism to do good things.

I don't know really anything about GPS. I've heard the military has one or two better systems which are barred from civilian use, but aren't that hard to use. Maybe we could use "OMG TERRORISM!" as an excuse to demand it for everyone. Alternatively, if military grade GPS is vulnerable to the same attack here, then it seems like that could have actual security implications. "Oh no, a plane is off course" is less of a threat than "Oh no, a cruise missile is off course" but maybe no one gave a shit until they mentioned terrorism.

Anyway, I think we should be using the constructed threat for actual important things, for instance, getting regulation on antibiotic use. The brits are starting to use terrorism as a reason why we need to clamp down on antibiotic abuse. A tool is only as good or as evil as the person using it. "We have to protect against the terrorists" has been used mainly to justify writing big checks to the military industrial complex, and ideally the voters would, as you suggest, grow brains and relax about terrorists. In the meantime, we could use the tool for good.

Re:OMG TERRORIST

[gagol]

Next step, to have your hands cut off if you want to board a plane.

Re:OMG TERRORIST

[Anonymous Coward]

I heard Terrorists can blow up dogs with their mind.
Horrifying.
All dogs are walking bombs now. Ban them.

Finally, no stupid barking dogs, my plan will be a great success.
Oh, also, Children too. Children are walking timebombs, terrorists win, etc.

Re:OMG TERRORIST

[__aaltlg1547]

It's pretty tricky, really. You have to simulate at least 4 satellites' signals, compensating for their orbital movement at the position where you want to tell your target it's located.

But its just numbers and time. That's all the GPS receiver knows about. It knows nothing actual orbits or movements. Just precise time and epheremis numbers. The signals would be trivial to generate with a computer.

Let's see your sample code to show it's trivial and your analysis that shows a normal clock can generate 4 or more signals and add them in real time accurately enough to spoof a standard GPS, let alone do what the article talks about and generate a stable enough signal that it can mislead a ship without the crew having a clue that anything is weird.

Re:OMG TERRORIST

[Anonymous Coward]

"Actually no, fuck the terrorists, they're third world noobs living in mud huts and the best they could do in 12 years of trying realyl hard is to hijack a few planes with knives. You have more to fear from your own government than any terrorist."

And that's assuming, of course, that they really did it to begin with. I'm not about to claim otherwise, but the evidence is actually pretty thin and there is a lot of counter-evidence. That's just the truth.

If that's really "just the truth"... How is the evidence pretty thin? What's the counter-evidence?

Re:OMG TERRORIST

[dj245]

It's pretty tricky, really. You have to simulate at least 4 satellites' signals, compensating for their orbital movement at the position where you want to tell your target it's located.

But its just numbers and time. That's all the GPS receiver knows about. It knows nothing actual orbits or movements. Just precise time and epheremis numbers. The signals would be trivial to generate with a computer.

Let's see your sample code to show it's trivial and your analysis that shows a normal clock can generate 4 or more signals and add them in real time accurately enough to spoof a standard GPS, let alone do what the article talks about and generate a stable enough signal that it can mislead a ship without the crew having a clue that anything is weird.

It seems fairly easy to me. You don't need to "generate 4 or more signals and add them in real time". The "adding them in real time" is trivial, and is handled by the receiver. GPS math is just math. If you were writing it out by hand it would not be fun, but it is trivial for a computer. The equations are solvable with no ambiguity unlike fluid mechanics equations.

What you need to do determine is:
1. "Where do I want the receiver to think it is?" The input. If I wanted the receiver to think it is sitting on the ground, this is just 1 set of coordinates. If I wanted it to think it was following a path, we have a simple equation for that path to generate the proper coordinates. This input equation could be a simple algebraic line, or something more complicated.

2. I invent 4 or more imaginary satellites and place them in orbit at positions of my choosing. The distance from each fake satellite to the intended position in step 1 is calculated. I know both where my imaginary satellites are, and where I want the receiver to think it is. Both locations are known so the distance between them is trivial.

3. I calculate the signals that would be needed from each satellite in order to represent the distance calculated in step 2. This actually quite simple- You only have to create a signal which is supposedly X distance from the receiver. Solving this would require solving something similar to a Doppler equation, which is easy.

4. Broadcast the fake signals from step 3.

5. The receiver does all the other math. That is its job!

Re:OMG TERRORIST

[__aaltlg1547]

I'm relieved. It seems you won't be spoofing my GPS until you learn a lot more about the subject.

Gyros

[BetterSense]

This is why ships still have gyros. GPS is too handy not to use, but I'm pretty sure most large oceangoing vessels also have navigation gyros. The question then is, what happens when GPS gets spoofed...does the system/crew assume the GPS is broken or the gyro broken?

Re:Gyros

[the_other_chewey]

This is why ships still have gyros.

So the only vessels at risk are those with 100% vegetarian crews.
It's probably not too much of an issue then...

Re:Gyros

[Anonymous Coward]

Pleeb: "Gyro is reading funny, Captain!"

Captain: "What do you trust more, satellites in space, or this little spinning thing that I don't even?"

Pleeb: "Sir, but according to this, the sun is due North!"

Captain: "Did you not not hear me, FRIGGIN SATELLITES...in SPACE!! Go scrub the poop deck!"

Stupid archaic mechanical spinning things.

Re:Gyros

[ebno-10db]

This is why ships still have gyros.

Are you talking gyro compasses or full blown inertial nav?

Re:Gyros

[Anonymous Coward]

Ships have not only Gyros, but DVLs. DVLs can fit into something as small as an AUV. If the ship has a proper integrated solution, then their software/firmware should alert them of the invalid data(think the DVL track overlaid with GPS) with a large discrepancy between the two). It would be much more horriffic if terrorists just comandeered a cruise ship and steered it right into a populated waterfront, like they tried to do in that movie Speed 2.

DVLs and other sensors with extremely high accuracy, unlike laptops, are ITAR-controlled items and so are unlikely to fall into the hands of durka-durka terrorists. IED's are much more dangerous and cost-effective anyway.

-- Ethanol-fueled

Re:Gyros

[Rich0]

In the case of airliners, it is usually full inertial navigation. Usually three independent inertial systems which continual comparison. The navigation system uses all the inertial systems as inputs, usually 1-2 GPS systems as input, and also radio navigation beacons (not very precise, but good enough for anything but landing). The GPS mainly provides long-term stability to the inertial systems, which are the direct reference.

Any area navigation system used in an aircraft for navigation in non-visual conditions has to meet a number of standards, which include the ability to measure its own performance/inaccuracy. I'm not sure if the spoofing in this article would defeat that - it isn't enough to give a false position - you need to give a false position which looks very accurate, and which drifts from the real position slowly enough that if the aircraft has inertial navigation it will consider the change plausible.

Even then, you'll also have to jam all the local radio navigation beacons which is going to be noticed most likely. If the aircraft tunes a radio beacon and gets inconsistent values from every station it tunes (automatically) it will probably report a navigation failure to the crew who will take it into account (and you'd be surprised how well a plane can do with nothing but the magnetic compass, good wind reports, and dead reckoning).

If you did manage to confuse the plane it really would only be a problem low to the ground in fairly mountainous terrain, unless you can keep it up for hours to get it way off course (and the crew will notice when they can't tune stations that are supposed to be in range and ATC will surely notice until they go entirely to ADS-B - and in the case of international flight the air defense identification zones surrounding many countries including the US will have active radar for obvious reasons). Most actual landings use ILS, which is completely independent of GPS - the aircraft won't really descend enough to hit buildings until it is on the ILS glideslope which is guaranteed to be clear. Only an actual GPS-based runway approach would get the plane low enough to hit something unless there are mountains nearby.

So, an attack would be hard to pull off against an airliner. Small planes do not have so much redundancy, but their GPS units still try to evaluate position accuracy and generate warnings (which pilots are trained to heed) when they believe they are having problems.

All that aside, GPS signals really need to have authentication embedded. That said, they would still be vulnerable to replay attacks if the main signal could be jammed and the receiver did not have a sufficiently accurate clock to spot replays (it would have to be VERY accurate over fairly long periods of time).

Re:Gyros

[The MAZZTer]

Well if you're trying to follow the GPS going straight, and it leads you to the side, presumably more than just the gyros will indicate you're steering a little to the side, and the gyro is going to match up with that... compass too at least, I dunno too much about boats to guess at what else.

Re:Gyros

[ebno-10db]

Ok, I'll bite. What's a DVL? (my usual deacronymizing techniques fail me).

If it's ITAR controlled though, that means a lot of ships won't have it. Best to keep the compass and sextant handy. Maybe even keep your eyes open.

Re:Gyros

[RalphSleigh]

Apparently

http://en.wikipedia.org/wiki/Doppler_Velocity_Log
 
So like an optical mouse for ships?

Re:Gyros

[jamesh]

Seems easier just to shoot it out of the sky...

Re:Gyros

[Anonymous Coward]

A DVL is a gadget which uses directional echolocation and the doppler shift to determine, among other things, the velocity of the bottom relative to the vessel -- in other words, single-percent accurate "dead-reckoning" (two paces north, three paces east etc.) navigation when GPS fails(which happens to be everywhere under the water) and a INS fails or is not available.

There are different levels of ITAR control, and even within those levels there's a lot of hustling and politics behind the scenes to determine which countries can be just given the DVL's(England for example), which countries are eligible but have to apply for an export license they may or may not get(Argentina for example), and which countries(Iran, Syria, North Korea, Sudan, Cuba) are not at this time allowed to receive them at all.

I speak with authority in these matters because I am a shipyard prostitute.

-- Ethanol-fueled

Re:Gyros

[ebno-10db]

I speak with authority in these matters because I am a shipyard prostitute.

A time honored profession.

Re:Gyros

[ebno-10db]

Didn't you learn anything from Dr. Evil? Just shooting them is nowhere near as classy as sharks with frickin' laser beams attached to their heads!

Re:Gyros

[Hans Lehmann]

Based on what I've read on the Internet, students in the U.S. Naval Academy aren't even taught how to use a sextant any more, because, you know, we have GPS now.

Re:Gyros

[Anonymous Coward]

I speak with authority in these matters because I am a shipyard prostitute.

Now that's a Dirty Job.

Re:Gyros

[Anonymous Coward]

Airplanes have another last ditch fail safe system (granted it only works in the day and when it's reasonably clear). It's called looking out the windows. Or angling the radar sweep down and reading surface features. Or calling the tower and asking where the hell they are (doesn't work everyplace). Airplane design and operations religion is backup, backup, backup.

Re:Gyros

[Anonymous Coward]

and a paper map

Re:Gyros

[profplump]

They already use both and track the relative error, because that's useful even in normal operation. Inertial tracking systems are subject to drift over time (and are useless when you're not moving). GPS can correct for this drift, but requires external resources. So it's pretty common to tie the systems together and have it whine when the correction the GPS demands is outside the amount of drift expected by the inertial guidance system, because that helps detect normal, non-hacking failures in either system.

How the crew would react depends on what sort of error it shows and how relevant that is to their operations. Bear in mind that being off even by a couple of miles isn't a big problem in most oceanic navigation, so the amount of acceptable error is pretty large in many cases. And remember that in order to do inertia-based navigation you need a log of your previous positions, so it's possible to look you your past position fixes to effect a "roll back" to better data -- that won't tell you exactly where you are now, but it will give you a good starting point for figuring out what's wrong with your navigation system.

Re:Gyros

[sumdumass]

It's actually quite simple, almost all ships are tracked via satellite or radar when not in a channel or harbor. There is an authority somewhere depending on your location that knows so they just radio for confirmation to which one is accurate. Or they can pull the really old fashion tricks out and use a sexton or mark their position based on the stars.

It might require them to check more often to determine if they are deviating, but it shouldn't be too much of an issue unless they are piloting into a channel or port.

Re:Gyros

[Anonymous Coward]

That said, they would still be vulnerable to replay attacks if the main signal could be jammed and the receiver did not have a sufficiently accurate clock to spot replays (it would have to be VERY accurate over fairly long periods of time).

Wouldn't it only have to be accurate since the last valid frame?

Re:Gyros

[Anonymous Coward]

Aparently this ship had neither or the crews don't use them.

Re:Gyros

[Rich0]

That said, they would still be vulnerable to replay attacks if the main signal could be jammed and the receiver did not have a sufficiently accurate clock to spot replays (it would have to be VERY accurate over fairly long periods of time).

Wouldn't it only have to be accurate since the last valid frame?

Nope. If you update your clock against each valid frame then I can introduce drift over time until you're substantially far away from the real signal (at which point you actually reject any real signals you get). The more lag I can introduce, the more flexibility I get to mix and match replayed frames from various satellites to change your position. If you have a GPS running yesterday's clock and I have a record of every frame transmitted for the last 24 hours I can send you an authentic set of GPS signals for any point on the globe that matches your clock.

The only way to defeat replay attacks is to have a stable timesource that you trust and don't update from GPS, and that means an atomic clock basically.

Disclaimer, I'm not an engineer who works on such things, but that is how I see it. Certainly interested in expert opinion.

Re:Gyros

[Rich0]

Airplanes have another last ditch fail safe system (granted it only works in the day and when it's reasonably clear). It's called looking out the windows.

Airplanes don't only fly when it is reasonably clear. All that rigor goes into the design so that a plane can fly safely on instruments from takeoff until the wheels hit the ground again (in the case of CatIII ILS).

Or calling the tower and asking where the hell they are (doesn't work everyplace).

I included that in my post, but as I said when everybody switches to ADS-B the only indication the tower will have about your position will be what your GPS unit is telling them. There have actually been accidents in the past when pilots used radar reports of altitude to validate that their own altimeters were correct even when they had reason to believe they were not. They didn't realize that the "radar" report of altitude is just parroting the aircraft's own altimeter report via the transponder and is not independent at all. I'm not sure how current ATC handles an aircraft whose ADS-B transmissions don't match up with their radar position - that would be a telltale sign of spoofing or equipment failure while we still are operating both systems.

Civil aviation radar in general is pretty limited and dependent on the aircraft themselves. Only the military uses radar that can operate without cooperation from the planes they track (for obvious reasons).

Re:Gyros

[John.Banister]

In the case of boats, it's often an old Sperry gyrocompass. The kind that tumbles if is loses power for 10 minutes and can take half a day before it's reliable again. Ours died during the first quarter of this year, and we replaced it with a nice Furuno satellite compass that actually sends numbers over an NMEA 0183 connection instead of just the ticks that the Sperry gave. We still have a Magnetic compass, though.

But honestly, you don't need a sextant to know what part of the sky ought to have the sun in it at a given time of day.

If you want to make boats more terrorist resistant, decentralize the communication capabilities. If terrorists decide to so something with a boat, they'll board it and take control away from the crew. Boats generally move too slowly for terrorists to use them to enact sudden plans, so a hard-to-disable omnipresent wireless data network with which anyone could call for help from any part of the boat would make it a lot less practical for taking over a boat to be a part of terrorists' plans.

Re:Gyros

[Registered Coward v2]

This is why ships still have gyros. GPS is too handy not to use, but I'm pretty sure most large oceangoing vessels also have navigation gyros. The question then is, what happens when GPS gets spoofed...does the system/crew assume the GPS is broken or the gyro broken?

You've hit on the real issue - people trust GPS implicitly and become dependent on it. That's why sailors should still learn traditional navigation skills. You can't spoof the sun, moon or stars. LORAN is a good backup but its future is in doubt. There's nothing like running a drill and shutting of the GPS system and seeing what a crew does when that happens.

Re:Gyros

[ISoldat53]

Try looking at your wake. It's a pretty good indication if you're turning.

Re:Gyros

[drinkypoo]

Not just gyros, ships still have compasses and, if you are competent, even sextants. (I am not competent, but then, I'm not claiming to be a sailor or other type of boatman.) Part of getting a license is knowing how to navigate.

Re:Gyros

[dj245]

This is why ships still have gyros. GPS is too handy not to use, but I'm pretty sure most large oceangoing vessels also have navigation gyros. The question then is, what happens when GPS gets spoofed...does the system/crew assume the GPS is broken or the gyro broken?

If it was only spoofed a little, GPS would probably be assumed to be correct. If there was a big difference maybe I would send someone outside with a magnetic compass- to the best location where ship interference would be minimalized.

Spoofing "just a little" would actually be more dangerous. You could make a ship run aground in narrow channel if nobody was paying attention. However, when ships come into port or through narrow channels, a Pilot from the port comes on board the ship and guides it in. The idea is that the Pilot knows all about the local conditions, and the captain knows how his ship will react to helm changes. At that point, you are relying on channel markers, other buoys, and other distance cues so the GPS and gyrocompass are not that important.

Re:Gyros

[PReDiToR]

For any Brits reading this I understand that a "gyro" is a kebab in certain parts of the States.

Re:Gyros

[RubberDogBone]

So the only vessels at risk are those with 100% vegetarian crews.

Nah, they have vegetarian gyros too. Usually some sort of falafel "burger" or sometimes tofu.

Results are mixed and variable.

TERRORISDTS ??

[Anonymous Coward]

A kid with a laser pointer is not a terrorist but seems to not understand the extreme danger man !! Put this same kid in the plane and he still won't !! The king is dead !! And no I do not expect the self-called Mythbusters to get to the bottom of this, or anything, anymore !!

Iran already did this

[Anonymous Coward]

They already did this trick to snag an american drone. Old news.

Re:Iran already did this

[ebno-10db]

Iran claimed that's what they did.

Re:Iran already did this

[__aaltlg1547]

Indeed, and the fact that college students have now done it makes their claims plausible.

Wait a second...

[Anonymous Coward]

Are you saying that those other countries that claim to have done this exact same thing might have actually done what they said they did?

Why would the United States Government lie to us about something like that?

but there's this new thing called a knife!

[raymorris]

Imagine what terrorists could do with a knife!
Hint - 9/11

Meanwhile, the government IS, admittedly, tracking of your phone calls and emails. Have you called your Congressman yet? Posted on their Facebook page?

Re:but there's this new thing called a knife!

[anagama]

And you know what? That entire problem was solved by putting locks on the door. For the 110% solution, the Feds no longer tell people to comply with hijacker's demands.

Everything else, the gutting of the Constitution -- that's just gravy for our rulers.

Re:but there's this new thing called a knife!

[icebike]

And you know what? That entire problem was solved by putting locks on the door. For the 110% solution, the Feds no longer tell people to comply with hijacker's demands.

Except now the feds are back on the Be Sheep and Run Away kick.

Re:but there's this new thing called a knife!

[Anonymous Coward]

Unlike the states that have made it legal to kill children.

Re:but there's this new thing called a knife!

[Anonymous Coward]

Can we kill the 40 year old religious zealots, yet?

Re:but there's this new thing called a knife!

[Anonymous Coward]

Actually the solution was not locks on the door.

The solution was changing the 'comply with the hijacker's demands, they want you alive' to 'they do not care if you live or die, and successful execution of their plan will result in your death.' Suddenly, the only way to take a plane is to kill pretty much everyone on board. ... or get to the controls and kill 2-3 people.

You know what? I think it may be safer without the locks on the door.

Re: but there's this new thing called a knife!

[Anonymous Coward]

How about all the 25 year old liberal zealots?

Re:but there's this new thing called a knife!

[RCL]

Imagine what terrorists could do had they infiltrated the government!

Re: but there's this new thing called a knife!

[Anonymous Coward]

The ones asking for you to just leave people the fuck alone. Good one Einstein.

Re:but there's this new thing called a knife!

[westlake]

That entire problem was solved by putting locks on the door.

If by solved you mean that the flight crew can safely be relied upon to ignore torture and death on the other side of the wall.

No matter how young the victims or whether they are strangers or friends.

Re:but there's this new thing called a knife!

[RubberDogBone]

And you know what? That entire problem was solved by putting locks on the door.

Locked doors mean nothing. It's like asking nicely "Please don't come in here, okay?"

Forget the lock. Kick the door in. The precious deadbolt can stay locked to the frame for eternity and not make any difference.

Forget the door; make a hole in the flimsy drywall. Go in via the floor or ceiling.

Any place that exists can be entered. It's merely quicker if you don't care about the damage wake you leave behind.

Re:but there's this new thing called a knife!

[Anonymous Coward]

Even if you manage to get ten hijackers onto a plane, there's still roughly a hundred other people. And even the most cursory of security measures is going to stop them from bringing in any heavy equipment that gives them a real shot of overpowering a hundred other people who, now, will assume they're going to die if they do nothing.

So I think any real serious torture and death is off the menu there.

Already happened

[Anonymous Coward]

If Iran's claim is true they took control and captured a US drone by spoofing GPS signals: https://en.wikipedia.org/wiki/Iran%E2%80%93U.S._RQ-170_incident

Which signal?

[KDN]

What they don't say is whether he is spoofing the CA signal, which is publically known and documented, the P signal, which is encrypted, and best I can recall, is not publically known, or the WAIS signal, which I have no bleeping idea.

Re:Which signal?

[ebno-10db]

The P signal is only available to the military. I doubt they're spoofing it. Last I heard the weekly(?) code distributions are such a security pain that sometimes even the military doesn't use it. The military might benefit from an unspoofed P signal, but it won't help civilian planes or ships.

Re:Which signal?

[Entropius]

Could you not still spoof the encrypted signals by time-delaying them, without bothering with the decryption?

GPS is just a bunch of clocks, no? Just record the encrypted signals and play them back with time delays (of a fraction of a second) at higher power designed to give false position readings.

Re:Which signal?

[ebno-10db]

You can't just "store and forward" them because the received signals are quite noisy (especially before despreading!). You really have to receive and regenerate the signals. It's not a trivial thing to do, but it's not like there are only six people in the world who could do it (I used to work on CSMA and a bit of GPS).

Re:Which signal?

[Pinhedd]

This is correct. P code isn't very easy to use as it requires first acquiring CA code and then transferring the lock to a decoder. The newer M code is quite a bit more versatile but very little is known about it.

Re:Which signal?

[KDN]

From memory, all the satellites are in the same orbital inclination, so shifting the apparent constellation in time could work. However, I am not a GPS expert, so there may be other factors at stake. Also, there is a simple counter measure, at least for planes and missiles: shield the antenna from receiving from the ground.

Terrorism

[Anonymous Coward]

Created, managed, controlled, dictated, and fostered by the CIA

All terrorist acts are inside jobs my friends, as was 9/11.

http://www.ae911truth.org/

As for the "serious concerns about terrorism" , you should be asking your congress people who the real terrorists are.

Re:Terrorism

[Anonymous Coward]

who the real terrorists are.

Oh, this is easy. It's man, of course! I saw The Twilight Zone when I was a kid.

A more technical explanation

[Anonymous Coward]

Old news. If you want a less sensationalistic, more technical discussion of how this is done, see this article http://www.gpsworld.com/drone-hack/.

In brief:
1) Yes, it's possible but there are a lot of issues that make it less than practical
2) It's a non-issue for military positioning systems, which use encrypted, time-stamped signals.
3) Experts are already aware of the problem and are working on solutions.

Re:A more technical explanation

[ebno-10db]

Old news. If you want a less sensationalistic, more technical discussion of how this is done, see this article http://www.gpsworld.com/drone-hack/.

In brief:
1) Yes, it's possible but there are a lot of issues that make it less than practical
2) It's a non-issue for military positioning systems, which use encrypted, time-stamped signals.
3) Experts are already aware of the problem and are working on solutions.

What issues make it less than practical? I read the article and I didn't see any major problems with doing it, nor did the authors.

As for "experts are already aware of the problem and are working on solutions", it reminds me of the last scene in the 1st Indiana Jones movie, where the Ark of the Covenant is being put into a seemingly endless warehouse. "Don't worry Dr. Jones, we have top people working on it". "Who?" asks Jones. "Top people".

Yes, it is possible to fix, but does that mean it isn't worth paying attention to? It hasn't been fixed yet. I also didn't find the article Slashdot linked to to be terribly sensationalistic.

Re:A more technical explanation

[Anonymous Coward]

>What issues make it less than practical?
Try reading the paragraph that starts with "Developing a full spoofer-based control system for a UAV is a difficult problem..." and the two that start with "Constructing from scratch a sophisticated GPS spoofer like the one developed by UT is not easy..." or the one that starts with "There are also a number of promising non-cryptographic techniques for civil GPS spoofing detection...". More techniques are being added all the time; subscribe to GPS World if you want updates.

>Yes, it is possible to fix, but does that mean it isn't worth paying attention to?
You're welcome to pay attention if you feel like it but it won't get the problem fixed any faster. The ultimate solution, the authenticable civilian signal proposed in the article, would require launching a new constellation of satellites, a fifteen to twenty year undertaking.

Re:A more technical explanation

[ebno-10db]

Try reading the paragraph that starts with "Developing a full spoofer-based control system for a UAV is a difficult problem..."

You mean the paragraph that also says "causing a UAV to spin out of control and crash is not difficult with a spoofer"?

"Constructing from scratch a sophisticated GPS spoofer like the one developed by UT is not easy..."

Which ends with "the trend toward software-defined GNSS receivers for research and development, where receiver functionality is defined entirely in software downstream of the A/D converter, has significantly lowered the bar to spoofer development in recent years."

or the one that starts with "There are also a number of promising non-cryptographic techniques for civil GPS spoofing detection...".

Which certainly jibes well with my statement that "it is possible to fix".

You're welcome to pay attention if you feel like it but it won't get the problem fixed any faster.

That's true of most of the news I read. Should I take it that you never read news or consider the possibilities unless changing it is under your direct control? If so, why are you even reading this site or commenting here?

"Terrorist", sure....

[Anonymous Coward]

I'm so sick about the high-tech terrorist straw man. Let's be honest, the first to use technology like that, probably against their own population, are our governments.

Terrorist don't use cyberweapons of mass destruction, three letter agencies do.

sorry bout that

[Anonymous Coward]

Had a party, left my black Book of inventions that should never be built out on the coffee table..
And some escaped.. good luck with that, plenty more where that came from.

farewell

[Spaham]

Say goodbye to your laptop onboard :)
problem fixed \o/

Well, obviously

[russotto]

There's a reason the encryption on the P(Y) signal is part of a system called "anti-spoofing". The potential to spoof the C/A code was understood from the beginning, and it getting cheaper is expected as well.

Still many unanswered questions

[dwillden]

How close were they? Sounds like they were on the ship. Can this attack be performed by technologically unskilled "terrorists" from a distance or might the captain get suspicious of the small ship following at less than 100 meters. Or will the pirates have to board the ship to do this. Just because it can be done by highly educated professional researchers who do nothing but try to find ways to do this does not mean terrorists can do it. Yes the Iranians did it with a drone but do we know exactly how they did it, did they have to fly in close proximity to it? Or build a network of vastly overpowered GPS ground stations to overpower the satellite signals?

Re:Still many unanswered questions

[ebno-10db]

Just because it can be done by highly educated professional researchers who do nothing but try to find ways to do this does not mean terrorists can do it.

No, it doesn't. I'm not going to loose sleep over this. But that doesn't mean it's not a concern and shouldn't be fixed.

Re:Still many unanswered questions

[fulldecent]

Or, put a battery powered system in a container on that ship. And control it like any other long-distance remote-controlled system.

Load of garbage

[Anonymous Coward]

These clowns have no clue about how real navigation SYSTEMS, like the ones I work on, work. I'm not going to give these idiots what they need, but to put it very simply: we specifically verify, as part of our development testing, that messing with the GPS signals will not cause any problems. When lives depend upon the SYSTEMS you develop, you do not make them vulnerable to the sort of amateur-hour sensationalist "experiments" of twerps like these guys (who, if they REALLY knew how to do this stuff, would be DOING and not TEACHING). What they are doing is good for PR, great for scaring the public into demanding new laws, and probably a good way to get papers published and more research grant money... but they are not keeping anybody I know in the industry from sleeping well at night.... of course WE know exactly how our stuff works and how it will react to various events. NOTE: they are "spoofing" GPS systems (not the complete navigation systems) on a commercial ship and on a model airplane (not an actual "drone") .... ooooooooohhhhhh, SO scary!

Re:Load of garbage

[Anonymous Coward]

You sound like an insufferable, arrogant faggot. Did you get beat up a lot when you were a kid?

Re:Load of garbage

[ebno-10db]

These clowns have no clue about how real navigation SYSTEMS, like the ones I work on, work.

We are so impressed. You've heard of redundancy and sanity checking. Ooh-ahh.

I'm not going to give these idiots what they need ...

Don't worry, they can figure it out just fine without your vast and impressive knowledge.

Re:Load of garbage

[mmell]

Yeah, he did get beat up a lot - by guys like you.

Now, he's your boss. For teh win!

Re:Load of garbage

[Anonymous Coward]

I had doubts too. How do you make a ship steer right and left while tricking the crew into thinking the ship is in a straight line?

Aside from any kind of measurements or readouts about what the steering system is doing, don't they feel the direction changes?

Seen this before

[Anonymous Coward]

This sounds like the plot from https://en.wikipedia.org/wiki/Tomorrow_Never_Dies, but with less sexy spies and less stealth ships.

Already didn't happen

[Anonymous Coward]

Wired had a good article that explains the reasons why their claim is probably false

http://www.wired.com/dangerroom/2011/12/iran-drone-hack-gps/

Re:Already didn't happen

[Anonymous Coward]

That same article states that the US Military knew that GPS spoofing was a possible danger for 20-30 years.

Ship or Plane????

[l0ungeb0y]

a terrorist could take over the navigation of a ship or even a plane,

Put a few dozen of these between LA and Long Beach and you can create traffic jams that will cripple a fundamental portion of the manufacturing supply chain to the US by sending tourists and GPS addicted drivers to the wrong off ramps, causing them to get back on, thereby blocking access to the main arterials and causing miles of gridlock and congestion preventing vital shipment from getting to and from the Ports in a timely manner. And just how long would it take for the DoT or local authorities to realize that a week long Carmageddon was maliciously manufactured?

Tomorrow Never Dies

[Anonymous Coward]

Awesome, we can make James Bond movies happen!

Re:Tomorrow Never Dies

[ebno-10db]

Awesome, we can make James Bond movies happen!

On Slashdot you can easily find the know-how to do everything in a James Bond movie, except get the girl.

EXCEPT FOR THE RUDDER POSITION INDICATOR

[mutantSushi]

They can spoof the GPS position which plots on a navigational map, but if the ship is not moving in a straight line that means the rudder (or steerable propulsion pods) need to move, which have their own indicators. If the steering is locked to a wheel, the ship will not turn unless that wheel turns.

Re:EXCEPT FOR THE RUDDER POSITION INDICATOR

[ebno-10db]

If all you need to tell your bearing is the rudder position, then why was the compass considered a big deal?

Re:EXCEPT FOR THE RUDDER POSITION INDICATOR

[Anonymous Coward]

Steering a ship isn't like driving a car. There are currents and winds to compensate for as well.

Re:EXCEPT FOR THE RUDDER POSITION INDICATOR

[mutantSushi]

Of course rudder position doesn't indicate heading, which is why I did'nt write that. But if GPS spoofing is to "take over navigation without pilot detection" and divert a ship or plane from it's straight line path, that means the rudder needs to turn to achieve that adjusted path... Which the pilots would be able to detect if an autopilot initiates it, and if they are not on autopilot, GPS spoofing alone cannot "take over navigation".

Re:EXCEPT FOR THE RUDDER POSITION INDICATOR

[ebno-10db]

That's true if you suddenly make a major change in heading, but a few degrees is another matter.

Re:EXCEPT FOR THE RUDDER POSITION INDICATOR

[rts008]

I am far out of any area I actually know about here, but consider this:

What if wind, or ocean currents require a rudder correction to maintain course, and the rudder stays 'locked' so that the needed steering adjustments never happen. I can see that ship getting off course, maybe even catastrophically.

I would think that scenario possible, but if I am mistaken, I would like to be corrected. :-)

You cannot have too much knowledge in life. I would rather learn something, than remain ignorant.

HP-41cv

[Anonymous Coward]

I have a nav pac with an hp-41cv, along with a bunch of handwritten ocean seafaring notes in the manual

I'll take that over your new fangled gps stuff any day.

I wonder who j hazelwood was

Re:HP-41cv

[Ken_g6]

I wonder who j hazelwood was

Apparently nobody with mod points looked this up. Although I guess if you have to look something up to get the punch line of a joke, maybe it isn't very funny.

Dear Americans

[Anonymous Coward]

Fuck you and your "terrorist" bullshit.

Sincerely,
The Rest Of The World ("that place beyond your country borders")

=================

Seriously, I'm getting tired of this crap. I guess I should expect nothing less from Fox News. It's unbelievable- someone finds an exploit in some existing system, and suddenly the entire thing is tied to terrorism. Why? What does that add to the story? Nothing of value from my point of view. It seems like mindless scaremongering, and frankly the frequency at which stories like this occur is quite alarming. It's almost as if the American public has been conditioned towards the word "terrorism", and they expect to hear it as some sort of indication that the government or some random agency is doing its job or something.

Seriously???

[Jane Q. Public]

Gimme a break. "I'm not about to claim otherwise, but the evidence is actually pretty thin..." gets modded as "flamebait"???

I just love how there are still people who mod people down for telling the truth, just because it's not politically correct. I thought the "politically correct" fad died out more than 5 years ago.

Re:Seriously???

[Anonymous Coward]

Because the evidence is not thin, and even if it was, you do not need huge amounts more proof to prove the most obvious and likely explanation. The "terrorists" had motive (fanatical religion) and means (when hijackers take over the plane no one thought they would try to crash it while still inside, standard orders where do what the hijackers say) and there is plenty of evidence they where on the plains and took them over . It was not even that hard to do, where is the evidence thin?

And yes several paranoid people have claimed to have proof that the plains could not have taken down the building, as if they would have to act as bombs. This is not how the plains took the building down, a good fire halves the strength of steal well before it starts to melt (and the fireproofing in the world trade centre had already proven insufficient and was early in the proses of being replaced), this is all that is needed to explain the collapse.

Re:Seriously???

[dryeo]

You're unclear about whether talking about the 9/11 hijackers or the GPS spoofers. I first thought that you were talking about 9/11 where the evidence is pretty clear that someone flew some planes into some buildings. I'm not knowledgeable enough to comment on the GPS spoofing though it seems possible.

Re:Seriously???

[Jane Q. Public]

"You're unclear about whether talking about the 9/11 hijackers or the GPS spoofers. I first thought that you were talking about 9/11 where the evidence is pretty clear that someone flew some planes into some buildings."

Considering that I quoted the part I was replying to, it hardly seems unclear to me.

But the second thing is: yes, definitely, somebody flew some airplanes into some buildings. Just about anybody would have to be a fool to claim otherwise. But what does that have to do with my comment?

Re:Seriously???

[dryeo]

Perhaps I should have replied to your first post which had this,

"Actually no, fuck the terrorists, they're third world noobs living in mud huts and the best they could do in 12 years of trying realyl hard is to hijack a few planes with knives. You have more to fear from your own government than any terrorist."

And that's assuming, of course, that they really did it to begin with. I'm not about to claim otherwise, but the evidence is actually pretty thin and there is a lot of counter-evidence. That's just the truth.

It was unclear what you were talking about. Not deserving "flamebait" but deserving being ignored. Context was really not clear.

Re:Seriously???

[Jane Q. Public]

"Perhaps I should have replied to your first post which had this,"

WHOOSH...

It's only unclear because you did not take into account the context in which my comment actually appeared, and then assumed I meant something I did not.

I can't help you with this; it's your problem.

Re:Seriously???

[Anonymous Coward]

When all you want to do is flame, everything looks like flamebait.

Re:Seriously???

[Anonymous Coward]

"Actually no, fuck the terrorists, they're third world noobs living in mud huts and the best they could do in 12 years of trying realyl hard is to hijack a few planes with knives. You have more to fear from your own government than any terrorist."

And that's assuming, of course, that they really did it to begin with. I'm not about to claim otherwise, but the evidence is actually pretty thin and there is a lot of counter-evidence. That's just the truth.

If that's really "just the truth"... How is the evidence pretty thin? What's the counter-evidence?

Re:Seriously???

[Jane Q. Public]

"If that's really "just the truth"... How is the evidence pretty thin? What's the counter-evidence?"

Are YOU serious? You want me to present years worth of widely-available information, that you apparently have never even heard of, in a Slashdot comment?

Really?

And you really don't recognize that the evidence that THOSE particular people really did it, is thin?

Just asking.

Re:Seriously???

[Anonymous Coward]

If the counter evidence is widely-available, it should be quick and easy to post a link. Or maybe you don't actually have any counter evidence, and you're just blustering?

Re:Seriously???

[Jane Q. Public]

"If the counter evidence is widely-available, it should be quick and easy to post a link. Or maybe you don't actually have any counter evidence, and you're just blustering?"

And I can argue just as equally and validly: *IF* it is so easily and widely available, then why are you asking ME to provide it to you? Why don't you know it already?

Re:Seriously???

[Anonymous Coward]

Bluster it is, then.

Archaic Tools

[Bucc5062]

There is this strange device called a...what was it a gain...oh a compass. The cool device that relies on something pretty hard to spoof, Earth's magnetic field as I remember. Ships and airplanes still carry a compass on board (well I know airplanes do) as backup to all that electronic stuff, because every now and then the power goes out and pilots are trained to fly and navigate by compass. They also cross check (or they should) the modern equipment with the analog to validate the primary instruments.

Just because someone says they can do something does not mean its really viable or will work well. Still waiting on flying cars, long lasting batteries, and fusion power plants so this type of drama news is not even close to registering on the danger meter.

Re:Archaic Tools

[Dominare]

Yes, or perhaps we could install some kind of giant light in the sky, the position of which would provide an easy reference frame for one's heading.

Re:Archaic Tools

[ebno-10db]

Fusion power? That's 20 years off.

Re:Archaic Tools

[Anonymous Coward]

It's not that hard... I have several compass spoofing devices attached to my refrigerator right now.

Re:Archaic Tools

[Anonymous Coward]

A small coil arround the compass, or a large one around the boat will take care of the compass. Don't forget this jammer needs to be on the ship to begin with, so it may not be to hard to create a fixed magnetic field to pull the compass to match the new gps coords.

Tomorrow Never Dies

[Dwedit]

Didn't this kind of thing happen in that James Bond film, Tomorrow Never Dies?

That's how Iran hijacked a US drone

[SensitiveMale]

and Obama and the DoD didn't do a damn thing about it.

GPS does have authentication

[Anonymous Coward]

It's called the P/Y code and it's cryptographically secure (sort of).

These jamming/spoofing attacks would generally not work in aircraft situations, because of internal cross checks. A big ship would have similar.

A small boat (50 ft sort of thing) with a consumer GPS hooked up to the autopilot? Yeah, I'd believe you could spoof it, because it relies on a human as the safety measure. Hmm, GPS says heading 90 degrees, but the compass says we're heading 0? Something is wrong.

steer off course without the captain knowing?

[Anonymous Coward]

Only if the captain never looks at the compass or the position of the helm.

If the ship's master is willing to let the ship be guided only by GPS with no cross checks, then he deserves what he or she gets.

This is, in concept, no different than those stories of people driving into parks by blindly following their GPS instructions.

This is what sensor integration is for!!!

[John Sokol]

We have gps, gyro's , accelerometers, magnetometers in our Cell phones.

It would seem anyone serious would use GPU in conjuction with Inertial sensors and also include maybe a 180 Sky view to check the sun or stars positions and LORAN, VAR and VOR as well as shortwave, commercial terrestrial TV and Radio broadcast strength, phase, call signs which could also provide decent navigation information.

In addition there are navigation units that combine GPS and GLONASS the Russian version to gain better accuracy and reliability.
http://www.qualcomm.com/media/blog/2011/12/15/gps-and-glonass-dual-core-location-your-phone

There is also IRNSS: India, Galileo: EU and Compass: China.

Lastly if on land, I think Google is also using Wifi MAC addresses which should in theory be unique although some low end vendors reuse them or just make them up.

It's news worthy but isn't at the same time ...

[oztiks]

To say that I didn't know this was possible until now would be far from the truth.

As an avid Air Crash Investigation fan, both my wife and myself watch this show on a regular basis. I surmised this was possible a number of years ago. I also thought the concept of spoofing transponders on Cars when we eventually started adapting this technology to Cars was also going to pose similar issues as well and funnily enough it was something that did make the news (don't remember the article now but it did make Slashdot) but was done so to trump autonomous driving, for whatever political agenda.

In all honesty, there is NO WAY to step around this problem unless you get rid of autonomous driving/piloting all together. Because of some simple facts

a) You can't tokenise any form of communication because it then deems the process unreliable
b) You can't encrypt it for the same reason
c) You can't in anyway make it COMPLICATED again for the same reason
d) You can't get rid of it because it makes flying unsafe.
e) It's a security hole that cannot be patched, fixed or resolved. Period.

Also the fact that this is a pretty common and is a widespread issue, which only really just made POC now is an absolute joke.

Re:It's news worthy but isn't at the same time ...

[EmperorArthur]

Ahh, but you can sign those packets the GPS satellites are sending. The US military uses encrypted GPS to prevent precisely this kind of attack. It also allows them to use their selective denial system to cut off part of the world without affecting their own systems. Ask the Russians about what their latest trip into Georgia taught them about their reliance on GPS.

So, yes the US can fix it, and should. Every country that is working on their own GPS alternative should as well.

Software defined radio is changing the world. It's bringing the price to capture signals down to a $20 USB TV tuner, and the price to send signals to a few thousand dollars. Not bad for something that used to require millions in fab costs to build transmitter ASICS.

Re:It's news worthy but isn't at the same time ...

[profplump]

What are you talking about? There are all sorts of things you can do to mitigate such attacks.

For one, you can sign GPS data without encrypting it. Old equipment can use the plain-text data without issue. New equipment can optionally verify the signature, if that makes sense in the particular application. If your systems does choose to verify the signature it can choose to ignore bad signatures, to warn the user, to throw out the lone bad signal, to throw out the whole fix calculation, etc. There's nothing technically complicated about that at all.

Another approach is to cross-verify this data. Planes and boats have inertial guidance (along with accelerometers, magnetometers, altimeters, etc.), which can easily be compared against each other to determine if one system is providing inaccurate data. And several of those systems require no external reference, making them quite difficult to hack. Combining all that data, throwing out the bits that don't match, and calculating a best-fit solution is pretty common even in low-end position/orientation systems, and I have to assume it's bog-standard in things like planes (or could be if it's not). Even cars have access to a lot of other data (wheel speed, engine speed, compass, etc.) that can be used for similar purposes.

And there are simple signal-based protections you can apply, that raise the complexity of an attack without requiring any modification to the broadcast signal. For example, you could use multiple antennas to ensure you're only listening for signals from the right slice of sky. You could track changes in signal level. You could track bitstream synchronization. None of that would prevent a local radio from overpowering the real system, but it would help you catch the switchover.

Not to mention you could provide some absolute reference via out-of-band tracking and comm. -- a system on the ground gets an actual fix based on radar/etc., and every minute or two sends out that fix with a timestamp via a non-GPS comm system. The on-board position tracker could then validate that external fix against its internal fix at the same time, and take appropriate action if there's a mismatch. This wouldn't stop short-term/small-delta attacks, as the data isn't instant and has some margin of error, but it would prevent long-term/large-delta attacks.

And you can do all of those at the same time -- together that's a lot of protection. I also suspect there are a lot of other things you could do to mitigate such attacks; this is just the list of things I could name of without any research or consideration.

It's also worth noting that removing autonomous course tracking (not even actual driving, but the whole navigation solution, as human pilots use the same navigational systems the computer does) does not solve this problem. It's not technically complicated to construct a sextant/stopwatch/etc. that gives false readings to misdirect whatever form of navigation the crew might undertake, even with no computers in sight.

Re:It's news worthy but isn't at the same time ...

[K. S. Kyosuke]

In all honesty, there is NO WAY to step around this problem unless you get rid of autonomous driving/piloting all together.

Why? Wouldn't GPS/INS data integration with rejecting spurious GPS inputs help here?

Re:It's news worthy but isn't at the same time ...

[bn-7bc]

What you described is soemthing like Galileos public regulated service , well PRS is encrypted but I suspect tis is just e way for ESA to collect a bit of revenue

Re:It's news worthy but isn't at the same time ...

[AmiMoJo]

And yet it didn't seem to work very well with that drone the Iranians captured through GPS spoofing. The problem seems to be that if you jam the encrypted signal the receiver falls back to the unencrypted one. Presumably the drone had inertial guidance as well, but clearly the system needs a bit of work.

Re:It's news worthy but isn't at the same time ...

[Anonymous Coward]

Accept iran had nothing to do with the drone coming down, the drone was defective and crashed, the rest of the story from Iran is pure fantasy/

Re:It's news worthy but isn't at the same time ...

[gl4ss]

And yet it didn't seem to work very well with that drone the Iranians captured through GPS spoofing. The problem seems to be that if you jam the encrypted signal the receiver falls back to the unencrypted one. Presumably the drone had inertial guidance as well, but clearly the system needs a bit of work.

if they could do that I doubt we would be seeing any gps drones flying around anywhere.. it just went down.

I guess a good start for civilian tech would be to try to do directional analysis on the signal - to be more certain that it is coming from the direction where the satellite should be. for big planes this might work.

Re:It's news worthy but isn't at the same time ...

[richard.cs]

This is well known to be possible, has been done for years, and you can buy commercial test equipment that sends spoof GPS signals (for testing GPS receivers obviously). More importantly there's another simpler way that cannot be dealt with by signing - just relay GPS signals from elsewhere.

If you capture GPS data at a point in space and retransmit the whole lot with enough power that the receiver sees only your signals then the receiver sees all the same phase relationships that put it in the location where you captured the data. It has no way of knowing it's been delayed by a few microseconds and signed GPS signals would look perfect. The only way around that is to compare it with inertial navigation, loran, etc or perhaps to have a very accurate clock on board to try and spot the extra delay.

Re:It's news worthy but isn't at the same time ...

[tibit]

What you claim as facts is a bunch of made up rubbish, sorry. First of all, what do you mean by tokenisation of communication? If you mean that tokens = packets than that's insane, so let's hope you mean something lese. Why the heck do you even need to talk about tokenisation?

If you like a doofus imply that encryption makes things less reliable, then that's just borderline clinical insane. Protip for the clueless: it's precisely the encryption of GPS's P-code that makes it pretty much spoof-proof. These days there are P(Y)-code receivers that don't need the hand off word (HOW) from C/A code. To accomplish that feat, they use optical correlators that perform the Fourier transform needed for fast correlation of the very long P(Y) code with the incoming signal in order to detect where in the sequence the code is, without using HOW. There's no one spoofing that.

While spoofing is somewhat theoretically possible, it'd require a fairly gargantuan effort. You'd need a station with a bunch (dozen) of fairly large (IIRC ~10m diameter) dishes tracking the individual satellites. And you'd need stations all around the globe so that you would have continuous coverage of all the satellites - the number of stations would be in the dozens, too. You could then receive good signal from each satellite individually, signal good enough to just read the P(Y) code without doing the correlations. As I've said, that's pretty crazy, and no single nation could pull it off since you really need to install equipment all over the world, and it's not stuff that fits in a suitcase. Oh, and of course you'd need to collect all those signals, put them through signal processing to recode them with fake data, and then transmit that in real time to the location where you intend to spoof stuff. I'm pretty damn sure the military receivers don't like date rollbacks, so it's not like you could record stuff last year and transmit this year.

Alas, GPS signal's encryption utilizes a stream cipher and not public key cryptography. But they do use public key crypto for key management. If it's ever found out how to break the cipher to extract the key, they may simply re-key the receivers more often - presumably the key extraction won't be an overnight thing. Now of course PKC is not the hardest thing to implement, far from it, as it can be done even on tiny 8 bit microcontrollers. But even RSA is still state of the art public key crypto, so you can get pretty good results without making it complicated. No need for complications, really.

So, you're just full of it. Where on Earth did you learn all this crap, or are you on some purposeful disinformation campaign?

Re:It's news worthy but isn't at the same time ...

[tibit]

Another silly one. If the done used the unencrypted C/A GPS signal, then that's a specification or implementation issue that applies to all civilian users. If the issue was indeed spoofing (unlikely), then the drone must have used the C/A signal, because that's the only one that's feasible to be spoofed. The P(Y) signal is encrypted and is processed by modern receivers with key management via public crypto. The P(Y) signal could be spoofed in theory, if you had a couple thousand dishes around the world to capture individual signals 24/7.

Re:It's news worthy but isn't at the same time ...

[John.Banister]

I spend most of my life at sea these days. Unless it's really foggy, I can generally detect an anomalous course change by looking out the window. I'll bet airplane pilots in VFR conditions can do the same.

Re:It's news worthy but isn't at the same time ...

[Anonymous Coward]

On a big ship, putting a receiver on each end of the ship and verifying the ship stays the correct length and pointed the right direction would be simple and effective.
    The bad guy is in one place. He can fake the geometry to satisfy one receiver location, but satisfing two or more raises the game.

Considering the age and simplicity of the threat, it seems almost criminal for a big ship not to do this.
      You would want a plan to re-enable the spoofing succeptability feature after you get boarded by pirates.

Re:It's news worthy but isn't at the same time ...

[Matt_Bennett]

Yay! Someone that actually understands the technology and effort behind this. So many self styled experts that really don't understand the technology and effort behind this- thanks for being a voice of reason and reality, tibit!

Re:It's news worthy but isn't at the same time ...

[Anonymous Coward]

(Replying to my own comment)

If the receivers had a common time base and geometry engine, it would further step up the game.
If the receivers could send signals to each other and do auto survey, even better.

That's easily enough features for a new Garmin 'Spoof Proof' line of professional receivers.

Also way more new stuff that your average S/W patent.
      Except that it just got published.
   

Re:It's news worthy but isn't at the same time ...

[EdZ]

My suspicion is the drones designers wrote in a fallback to allow use of C/A if it somehow lost P(Y). I'm sure somebody though this was a wonderful idea and failed to think through exactly why this was stupid. Or maybe it initially used C/A until they were given the key necessary for P(Y), but never got around to commenting out the fallback section of the code. The rest of the attack is obvious: use a high power (relative to a signal from a satellite) jammer, a higher power spoofing signal, and guide the drone to wherever you want it to be while telling it that it is flying back to base.

Re:It's news worthy but isn't at the same time ...

[drinkypoo]

And yet it didn't seem to work very well with that drone the Iranians captured through GPS spoofing.

And yet there is still no evidence whatsoever that this is what happened to the drone. I trust the Iranian government about as much as I trust my own government, which is to say, not at all.

Re:It's news worthy but isn't at the same time ...

[drinkypoo]

I have to wonder if you couldn't do this with DGPS alone. You know how far the two receivers are from one another. If that value changes, warning! My antique Garmin GPS 12 units will do DGPS...

Re:It's news worthy but isn't at the same time ...

[dj245]

Making a GPS antenna that was only good for a half-hemisphere would be the cheaper option. Is there really a great need to obtain GPS signals from the ground? I don't see WAAS being at all critical for drones or regular airplanes. Flying inverted could be a problem, but when you are flying inverted, your location is generally of little concern.

Re:It's news worthy but isn't at the same time ...

[MiG82au]

I'm not familiar with the aircraft incident that you seem to be claiming has relevance. How do you make the FMS trust only the GPS info when it also has INS and navaid position info?

Re:It's news worthy but isn't at the same time ...

[AmiMoJo]

Unless perhaps the Chinese have the private key.

Re:It's news worthy but isn't at the same time ...

[gl4ss]

Making a GPS antenna that was only good for a half-hemisphere would be the cheaper option. Is there really a great need to obtain GPS signals from the ground? I don't see WAAS being at all critical for drones or regular airplanes. Flying inverted could be a problem, but when you are flying inverted, your location is generally of little concern.

I guess there might be possible problem of bounce then, but that would be a nice addition. though, usually I guess they're on the top of the plane anyways.

that you can generate a gps signal with 3k doesn't surprise me that much. that it would prove a practical way to move gps based equipment around would be a surprise, unless you count diy drones.

Re:It's news worthy but isn't at the same time ...

[sabri]

I spend most of my life at sea these days. Unless it's really foggy, I can generally detect an anomalous course change by looking out the window. I'll bet airplane pilots in VFR conditions can do the same.

When I fly VFR, I don't need GPS, it just helps me avoid airspace that I should not be in. However, when it comes to IFR conditions, GPS is really helpful. Chasing the magenta line, as professional pilots call it (I'm just a low-life private pilot). When that Magenta line is off by 1 kilometer, that can become a serious issue. For example here in the Bay Area.

Re:It's news worthy but isn't at the same time ...

[John.Banister]

Is there any backup for GPS or other information source in IFR conditions?

On a boat near shore, there's the picture from the radar, which will let you know something's up if it doesn't match what the electronic map suggests you ought to be seeing. That can be helpful if a bird decides to try and perch on a GPS antenna. Far from shore, it would be harder to recognize a problem, but also harder for a position error to create catastrophic circumstances.

Re:It's news worthy but isn't at the same time ...

[sabri]

Is there any backup for GPS or other information source in IFR conditions?

Yes, much actually. VOR/DME and ADF are radio based navigational aids. And then there is of course the simple compass.

Re:It's news worthy but isn't at the same time ...

[John.Banister]

Glad to hear it. For boats, there used to be Loran C (which was radio based), but it's essentially gone. The magnetic compass works pretty well, but doesn't compensate for drift. I was one of the people riding a little Russian tug from Magadan out to a seafood processing vessel in the Sea of O. once and noticed a gap on the paper chart where they were plotting our course. I asked "why the gap," and the reply I got was ~"last night we crossed near a freighter that had GPS, so we called over and asked where we were."

Re:It's news worthy but isn't at the same time ...

[delt0r]

You are mostly wrong on your list. It can be fixed and can be reliable and quite frankly is reliable (tokenizing will not make it unreliable, why would it?). Thing is that it would cost a lot to change many of the older legacy systems and there is a lot of older aircraft that don't use the newer systems.

This does not spoof the military encrypted GPS band that airline GPS receivers use. Pilots seem to like flying into the ground more than machines. Current aircraft, mechanical or computational failure still results in a crashed aircraft. Pilots cannot break the laws of physics.

Re:It's news worthy but isn't at the same time ...

[tibit]

I doubt it. It's easier to attack the stream cipher than the private key. Armed with a receiver with a high-gain tracking antenna, you can pretty much recover the key stream since you know both the publicly documented P code, and what the low frequency bit stream the P code is applied to.

I doubt that C/A would ever need to be used as a fallback. If you can receive C/A, you are receiving P(Y). There'd be no advantage to falling back to C/A, since that expressly reduces the robustness of the location data and makes it prone to spoofing. I mean, come on, they're willing to go the optical correlator route just to avoid having to rely on HOW from C/A!

When you're spoofing GPS, you don't do any jamming, you just need to present your own signal of sufficient strength. That's about it. There's also the complication that many GPS receivers don't have automatic gain control - it'd be useless when you're receiving from multiple transmitters at variable distances from you.

Re:It's news worthy but isn't at the same time ...

[tibit]

Besides, if you really want to send an aircraft off track, you may just own it outright, no need to fuck GPS for everyone in the vicinity, you know. Various "dismissals" by "officials" come from people who seriously don't know what they are talking about. There's no one at FAA who really understands it at such a level. No one. The bullshit about "certified" hardware not being subject to the exploits: lol, and what, if you buy it on eBay you suddenly magically get obsolete, non-certified stuff?

I'm pretty damn sure the more modern airliners where everything sits on a common bus (say TT-Ethernet) are even more vulnerable, since once you own any one device on the bus, you presumably can find vulnerabilities in other devices and own them as well. The old Honeywell FMS is a simpler device that doesn't give you as much potential for breaking other stuff. I'm pretty damn sure that on a Dreamliner, if you own the device that receives ACARS, you can soon own everything to the point where even pilots can't override you. All it takes is one stack overflow somewhere.

Re:It's news worthy but isn't at the same time ...

[wwphx]

For sailing ships, they just need to take some sextant readings at night. Doesn't help during the day, though.

GPS is not seen as a trusted device....

[lookingglass]

Don't know about ships or drones, but in airplanes the GPS only provide part of the picture. Navigation in airplanes require at least 2 (different) means of assessing position (radio beacon (NDB), GPS/VOR/Tacan/MLS/ILS/Radar/Compass/map/Etc). As those means are always cross checked against each others, a malfunctioning/corrupted GPS would be found relatively quickly.

Now if only...

[Anonymous Coward]

All captains exclusively used the new and already obsolete GPS system exclusively for navigation...that'd be even scarier!

Everything Fox News says is a lie

[Anonymous Coward]

Even true things, once said on Fox News, become lies.

And the children!

[hduff]

What about the children?

007 will take care of this

[Joe_Dragon]

And he has the right to give on the spot death sentences

Sorry, no

[Anonymous Coward]

1. Not Homosexual

2. Never been beat up

3. Insufferable and arrogant? No... but very tired of headline-hungry jerks pushing sensationalized "demonstrations" of the supposed weaknesses of various technologies to gullible journalists (who fail to display the proper fact-checking skills and skepticism that used to be expected of journalists) which can then lead to new laws/regulations getting written by idiot lawyers and their "expert" staff members and lobbyists that make things in technical fields just that much more annoying... all for no actual benefit. Did I take an insulting tone relative to these guys? Sure. They ran to the press screaming the sky was falling and claiming to have unearthed a terrible danger which only they could see (and those of us who have been using GPS in nav systems for years are presumably too stupid to know) ... like the morons who surface every few years to frighten "soccer moms" about arsenic in apple juice (Hint: arsenic occurs naturally in apple seeds, which get squished as apples are juiced and which is at such low levels it has never provably harmed anybody) and such people deserve disdain.

Your obnoxious homophobic reply leads me to suspect you were one of the idiots involved...

um

[Anonymous Coward]

"Don't worry, they can figure it out just fine without your vast and impressive knowledge."

Apparently not. Sorry, but this should have been obvious to you....think about it....

And, no, I never claimed to have any "vast and impressive knowledge"... I am ALWAYS learning new things... but apparently I, and many others in the field do indeed have more knowledge and experience in how our systems work than these guys do. Odd that you seem to think people not involved in a technical matter know more than those who are.

Spoof a magnetic field ?

[feufeu]

"something pretty hard to spoof, Earth's magnetic field" - Obviously you have never been near a compass with an ordinary screwdriver...

Re:Spoof a magnetic field ?

[Bucc5062]

Touche' However Were there a terrorist bent on effecting my course he/she would need to be pretty damn close to the compass, at which point the captain may become suspicious (one would hope). Yes, I have dealt with the screwdriver effect.

Doesn't Matter

[sexconker]

Our navy still uses the stars and physical maps to triple check navigation.

Tomorrow never dies

[Anonymous Coward]

Don't worry, 007 is on his way :)

Well known

[drolli]

This possibility has been known since a long time.

However the scope is limited by the fact that GPS signals are wea and have a similar power everywhere, which implies that you (sitting on the gorund and beign subject to a 1/r^2 law in the power somebody reseives from you have to be close to the attack target (unless you want to set of everything, including the differential GPS stations) or use a very directed beam (difficult in real life).

It also meant that the vessel you want to control has no other means of navigation (not true for planes).

So, yes, it is a possibility to attack a ship/plane, but not an easy one.

Cryptography doesn't help against GPS spoofing.

[valpr]

Our company is developing and producing some GPS based hardware (GPS GNSS OBUs). Even so I'm working in a different group, not involved in design/support of these, back in 2007 we had internal courses for R&D employes that was presented by a professor who is considered to be one of the leading authorities in design of GPS (unfortunately I don't remember his name right now). One of the thing that was said on these courses was that GPS spoofing is a problem that isn't possible to prevent by means of cryptography. Here is explanation why: Let say you have two directional antennas:
- the first antenna receives GPS satellite signal
- and second is retransmitting the same signal with higher effect in the direction of GPS receiver you want to spoof.
The only thing is required to spoof positioning of GPS receiver is to put a few microseconds delay in retransmitted signal. Having higher output effect from spoofing antenna can make original satellite signal to be completely invisible for spoofed GPS receiver (satellite signal is rather weak, so it would not be any problem in achieving this). The position is calculated by time difference between timestamped signals received from different satellites visible to GPS receiver. So, the satellite and receiver can encrypt and sign the signal whatever they want. But for as long as adversary is able to receive satellite signal and retransmit exact same signal with few microseconds delay, with higher effect - spoofing of GPS receiver is a done deal.

Re:Cryptography doesn't help against GPS spoofing.

[Anonymous Coward]

Even if you simply relay it without adding delay it will already degrade GPS beyond being useful. The position a receiver receiving the relayed signal will receive is the position of the spoofers reception antenna. The extra delay added (to all sats) will affect the clock bias state in the receiver, but the calculated position will be identical.

Precisely delaying the signals from different sats seems difficult to me. How would you know which signal is transmitted by which sat if you cannot unspread the encrypted signal (using a phased array, and discrimination based on direction of arrival?).

While maybe possible I think this is far fetched (probably the people who can pull it off are not the kind of people generally interested in terrorism). An active gps antenna connected to an amplifier connected to a directional antenna seems quite easy to build, in fact, it can be bought online as a 'gps repeater'.

Re:Cryptography doesn't help against GPS spoofing.

[russotto]

You can't even receive the P(Y) code without the encryption key.

Re:Cryptography doesn't help against GPS spoofing.

[valpr]

You can't even receive the P(Y) code without the encryption key.

Why would you care about content when you can always simply retransmit the signal. Few microseconds delay in receiving signal by GPS receiver is sufficient to spoof it.

true dat

[cellurl]

I looked into this a couple years back. He is correct.

If you like speeding tickets, click here"

Very expensive way to cheat at Ingress?

[earthforce_1]

Although I guess you could teleport a whole army of spoofers around with this.

So What?

[Anonymous Coward]

I've been sailing for 55 years. In my previous job, a few years back, I spent several years writing software for GPS tracking devices. I don't, and won't rely on GPS for navigation. Which is not to say I don't think it's cool, just that I'm not eager to trust my life to it, and see no need to do that either.

There is a story I read somewhere about a cruising couple. If either of them doubted the position the other had arrived at, they stopped dead and went nowhere until they agreed on what their true location was.

Only scary when terrorists do it?

[Datamonstar]

I think it raises some serious issues for being used at all by anyone. Not just terrorists.

GPS spoofing

[MattCarter1337]

So why did they have it posted online, when it could be used for terrorist purposes. Didn't Osama Bin Laden have a valid internet connection? well so do most others so they have probably look up spoofing now and are learning how to do this. Thank you the IDIOT who posted this.

Also...

[AdamWill]

"This raises some serious issues for this being used for terrorist purposes."

Also, much more importantly, I can see the lightbulbs going off in the scriptwriting room for the Die Hard series from here.