Slashdot Mirror
College Students Hijack $80 Million Yacht With GPS Signal Spoofing
colinneagle writes "A team of students at the University of Texas at Austin built and successfully tested a custom GPS spoofing device to remotely redirect an $80 million yacht onto a different route. The project was completed with the permission of the yacht's owners in the Mediterranean Sea this past June. Because the yacht's crew relies entirely on GPS signal for direction, the students were able to lead the yacht onto a different course without the knowledge of anyone on-board. The GPS spoofing device essentially over-powered all other GPS signals using until the spoofed signal was the only one that the yacht followed. The team then used the GPS spoofing device to convince the ship's crew to redirect onto a different route voluntarily. By changing the signal on the spoofing device, the students led the crew to believe that the ship was drifting off-course to the left. In response, the crew steered the ship to the right, thinking that it would get the ship back on course, when it actually brought the ship off the course entirely."
Can't really say you directed it on a different route when the owner agrees to let you.
"Cowardice in a race, as in an individual, is the unpardonable sin." --Teddy Roosevelt
http://tech.slashdot.org/story/13/07/26/2344215/gps-spoofing-with-3000-worth-of-equipment-and-a-laptop
Difficult to believe they committed so many dangerous crimes and are bragging about it; "permission from the owner" (who apparently was not even aboard) does nothing to mitigate this. Therefore difficult to believe the story is true. Even though people are idiots....
and that was a step up to the military ones.
Of course you can spoof wireless signals, that is why I ran cat6 to my GPS sats. Even if a solar EMP thing destroys the circuitry I can get a pretty good approximation from the slack in the cable.
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
kinda like how the Asiana pilots should've learned basic flying skills and not rely on auto-throttle all the time.
Or like how our school districts want to buy an iPad for every student even though they can't read or memorize a basic multiplication table.
Right turn ahead to an dead end.
Now all we need is a stealth boat and we're all set to re-enact a Bond movie.
I saw a documentary about this involving the British Navy and a media tycoon.
I think we're going to be okay because this is illegal. It doesn't matter that it was done far away from Texas, US laws apply everywhere.
It seems that it is basically the same technology to be used on a 700€ rowboat.
'Once scientists, even the dim-witted social scientists, get muzzled, the Western Civilization is finished.' - oldhack
They have the power to due stuff with out the owner saying so.
also this gps hack may of been braking some maritime laws as well.
We have seen that over reliance on GPS is a problem. I have lead astray following Google maps using GPS. Although I can imagine some applications in hijacking oil tankers and the like, I would hope that such vessels would have secondary systems.
I can see this as a countermeasure against drones.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
Oh wait.
And spend the money on it BEFORE you install the jacuzzi.
Not a skipper, but I do fly. If I was on the bridge, at some point I would have noticed that the Magnetic compass heading was not matching the GPS heading.
There are many different GPS-like systems available now. Glonass is the Russian version and has been available for a long time. Also the EU has Galileo coming on line real soon now. Also heard about both China and India developing their own. Units that can rely on multiple sources would definitely be harder to spoof.
If you feared that you were under GPS spoof attack while using the GPS on your phone, you could fairly easily detect this by writing an app that compares the GPS heading with your magnetic heading.
That was the turning point of my life--I went from negative zero to positive zero.
Not only are (some) rooted people spoofing in the Ingress game, now you can do it with overriding the GPS signals.
Not really, you can get quite far by learning to multiply by 2 and 10, divide by 2, and add and subtract. Learning the squares is quite useful, too. Not quite as quick as rote memorisation, but not everyone's suited to being a conformist drone. I got the highest grade going in my mathematics exams right up until college with such basic techniques.
I don't know about you, but I don't get many people stopping me on the street to demand I perform simple multiplication. Even if I did, I'd tell them to JFGI.
Being a computer scientist was probably half the problem - when you've been programming from age 5, it becomes abundantly clear that the how and why of mathematics are important, and not the mere implementation detail of arithmetic.
Luckily, I don't have an $80 million yacht...
On unrelated not,e FAA just orders pilots on SFO approach to use GPS for landing,
Presumably the person doing the spoofing would be piloting blind since their GPS would be effected just as much as the target's GPS?
If so then it seems like GPS spoofing would be of limited usefulness unless you just wanted a ship or plane or whatever to get lost and expend all it's fuel in the process.
I think it's time for a revision to the L2C, L1C and L5 civilian GPS specifications. Right now all signals, if/when present (some are at demo stage only), transmit a default message with no navigational data. It seems to me that messages on those signals should use public cryptography techniques to verify the authenticity and integrity of navigational data. It is feasible to do so, since L2C, L5 and L1C all use a packetized format and to-spec receivers must ignore unknown packets. Thus a cryptographic signature packet can be added in a fully backwards-compatible fashion. Properly done, this prevents spoofing of the navigational data, including preventing replay attacks. It should be sufficient to pretty much end spoofing once and for all.
A successful API design takes a mixture of software design and pedagogy.
The price of the yacht has nothing to do with this! Fuck you slashdot and your stupid god damn headlines!
Also, fuck you yacht owners for only having GPS navigation. Something of that kind of money could run what Ethanol-Fueled (tm) was talking about on that other story about dead reckoning with sonar or something. Or a fucking sextant.
Is there any technical details on the yachts gear? Were they using RAIM?
Lends a whole new meaning to the term computer piracy. Yarr.
Hoist Number One and Number Six.
Just the basic compass. So you may see the "real" heading.
If the answer is yes then the students' device may be a useful countermeasure. Other munitions and military airplanes may also be guided by GPS. I would guess there's some kind of encryption in military applications, but not sure. Imagine a shooting war using GPS guided military things and the opposition had one of these countermeasure devices and sent the munitions back to where they came from. So much for high tech guidance of military equipment.
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Any helmsman worth his salt would have noticed a change in the direction of the swell, the sun, moon, stars, compass, so I would say the crew was not standing a good watch if they weren't properly observing their environment.
Not a GPS expert, but I do know a little bit about crypto. :-) I assume GPS is broadcast, not a unicast / synchronous protocol.
I am not sure if this is a solution, unless you can be sure that the receiver doesn't receive the original signals. A spoof attack is really just replying the signals with different timing or direction, right? The signal *would* be authentic, just would be delayed or or from a different angle. (Think single time replay.) The problem here is that the element you care about -- the timing data of the signal itself -- wouldn't actually be protected by the key itself, since the data is based on local observation.
(This all assumes the attack relies on replying identical signals with offset timing, not modifying timestamp data in the signals themselves.)
I think if I were designing a system for use by the military, I'd reverse the direction -- i.e. have the groundstation send up an inquiry, and have the response come back *with* the timing data for the requester. Combine this with public key crypto, and its fairly unbreakable. Unfortunately, it would require strong transmitters, and wouldn't scale terribly well, since every such unit would require a satellite uplink. But, if you're designing for the military -- or perhaps even civil aviation, its the way to go.
Btw, for civil uses, the use of ground stations (lots of them -- perhaps at each cell tower) would do a long way to address the scalability considerations for a request/response system.
Man given wrong map goes to wrong place. Full story at 11.
GPS spoofing is interesting, sure. But it ain't new, and the application here isn't exactly a mind-blowing revelation of the technique's potential...
I think it's time for a revision to the L2C, L1C and L5 civilian GPS specifications. ...
It seems to me that messages on those signals should use public cryptography techniques to verify the authenticity and integrity of navigational data.
It should be sufficient to pretty much end spoofing once and for all.
You don't need to be able to generate false signals to defeat GPS. Fixes are based on time of flight of signals. Simply altering propogation delay is sufficient.
So that's how they get all those pilgrims to Mecca... they have a network of massively powered GPS transmitters around the world that try to redirect everyone to Saudi Arabia.
Explains why you hear those stories about people getting directed to drive into bodies of water.
Ground breaking..
Fat chance trying such a trick with Long John Silver aboard!
>I think it's time for a revision to the L2C, L1C and L5 civilian GPS specifications.
Sure, all that will take is replacing the entire GPS satellite constellation. Hope you have a few hundred billion dollars of money just laying around..
I come fer yer booty!! And if ye be trying to steer clear of me piratey waters, Aye'll call the GPS sirens on ye!!
Iran hijacked a US drone back in 2011 doing this
kinda off topic but...does any one still use LOng RAnge Navigation? http://www.loran.org/
Just asking.
The US Navy stopped teaching it a few years ago.
Yes, the crew followed the GPS, like good little auomatons. But being a sailor, especially a navigator or quartermaster is more than just reading a GPS.
If the bridge crew is not competent enough to read a compass nor experienced enough to look at the sky and realize that something was wrong, they shouldn't be entrusted to control anything more experienced than a dinghy. There's this really cool gadget that, with a little work, tells you almost exactly where you are at. It's called a sextant. Put that together with a decent clock and there's no reason to be sailing in the wrong direction.
The GPS satellites are dumb relays with local timebases, roughly speaking. You don't need to modify anything on the satellites to transmit arbitrary NAV data. The changes are to the ground segment software only.
A successful API design takes a mixture of software design and pedagogy.
Except that when you're seeing more than the minimum amount of satellites, there are simple feasibility checks that will trigger if you push the target too far off. In open space, like on sea, you can detect such spoofing if it's off by merely 50m or so. Remember that the ephemerides tell you where the satellites are supposed to be at any time. If you've got redundant signals, like you most often do, there are no solutions to changes in the signals that will still be self-consistent, IIRC. Some solutions, if they exist, put you at some spot very far from the original position, a spot you have no control over.
A successful API design takes a mixture of software design and pedagogy.
Due to the rather arbitrary phasing of the satellites, replay attacks are pretty much infeasible. Even if they were feasible, GPS receivers know what the time is - they have pretty decent timebases. Time rolling back is a big no-no. If you've got your timebase synced up to crypto-validated time source "up there", the time won't ever roll back. Even "tiny" rollbacks, just a few ms worth, are not only detectable, but can't happen with the real GPS system. If you detect it, it only will due to spoofing or serious problems with the infrastructure - that's when you have to turn off the receiver's position output, if it's not a hybrid receiver with an IMU.
A successful API design takes a mixture of software design and pedagogy.
Also remember that whatever position fix you get automatically validates the location of satellites in space, especially once you've got more than the minimum number of satellites needed for a fix. Since the receivers would keep unspoofable ephemerides, you can't really make the satellites "appear" to be somewhere else. The most you could spoof things is within a rather narrow position window, +/-100m or so.
A successful API design takes a mixture of software design and pedagogy.
It's just software. And no, you don't need an entirely new satellite just to update the software. These things are maintained regularly. It could be patched, much as the Mars rovers get patches.