Slashdot Mirror
College Students Hijack $80 Million Yacht With GPS Signal Spoofing
colinneagle writes "A team of students at the University of Texas at Austin built and successfully tested a custom GPS spoofing device to remotely redirect an $80 million yacht onto a different route. The project was completed with the permission of the yacht's owners in the Mediterranean Sea this past June. Because the yacht's crew relies entirely on GPS signal for direction, the students were able to lead the yacht onto a different course without the knowledge of anyone on-board. The GPS spoofing device essentially over-powered all other GPS signals using until the spoofed signal was the only one that the yacht followed. The team then used the GPS spoofing device to convince the ship's crew to redirect onto a different route voluntarily. By changing the signal on the spoofing device, the students led the crew to believe that the ship was drifting off-course to the left. In response, the crew steered the ship to the right, thinking that it would get the ship back on course, when it actually brought the ship off the course entirely."
http://tech.slashdot.org/story/13/07/26/2344215/gps-spoofing-with-3000-worth-of-equipment-and-a-laptop
and that was a step up to the military ones.
Of course you can spoof wireless signals, that is why I ran cat6 to my GPS sats. Even if a solar EMP thing destroys the circuitry I can get a pretty good approximation from the slack in the cable.
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
sure you can they clearly state the crew was unaware that its course was being altered by them, by that logic no controlled experiment can ever be considered a success
also this is a re-post from last week c'mon /. pay attention
I'd imagine there's a difference between the owner and the crew when it's an 80 million dollar yacht...
Difficult to believe they committed so many dangerous crimes and are bragging about it
Care to name a few? Specifically?
Keep in mind they didn't physically disable the ship's controls, they just lied to it about its current location. The crew on board still had every possible means available to them to maneuver the ship away from any threats that may have appeared.
"permission from the owner" (who apparently was not even aboard) does nothing to mitigate this.
Of course it does! He, and only he, gets to decide where his boat should go next. And the very fact of his involvement mitigates most of your mythical "dangerous" argument, since presumably the owner wouldn't have let them redirect it over, say, a giant rock just below the surface. Or into pirate-filled Somalian waters. Or across national boundaries that might get them into a pissing contest with various countries over imaginary lines on the map.
Perhaps more to the point - You can't trust GPS to get you to your destination. Period. This story demonstrates an active attack on that, but the crew of any vehicle always needs to have a backup plan available at a moment's notice. If you really want to point fingers here, try the ship's navigator who somehow failed to notice that reality didn't match his charts.
Not a skipper, but I do fly. If I was on the bridge, at some point I would have noticed that the Magnetic compass heading was not matching the GPS heading.
There are many different GPS-like systems available now. Glonass is the Russian version and has been available for a long time. Also the EU has Galileo coming on line real soon now. Also heard about both China and India developing their own. Units that can rely on multiple sources would definitely be harder to spoof.
If you feared that you were under GPS spoof attack while using the GPS on your phone, you could fairly easily detect this by writing an app that compares the GPS heading with your magnetic heading.
That was the turning point of my life--I went from negative zero to positive zero.
Perhaps more to the point - You can't trust GPS to get you to your destination. Period. This story demonstrates an active attack on that, but the crew of any vehicle always needs to have a backup plan available at a moment's notice. If you really want to point fingers here, try the ship's navigator who somehow failed to notice that reality didn't match his charts.
The scary bit is whether the navigator even knows how to read charts any more. Or do dead reckoning or celestial navigation.
The transportation industry is relying more and more on technology and less on human knowlege to get from point A to point B. GPS, Airline Autopilots and Instrument Landing Systems, train automation are all making significant in-roads to the point that the humans on board are just blindly trusting it.
I foresee the auto industry going in the same direction. I tease my kids that their kids will not know how to drive a car. Indeed my kids have never looked at a paper map.
I think it's time for a revision to the L2C, L1C and L5 civilian GPS specifications. Right now all signals, if/when present (some are at demo stage only), transmit a default message with no navigational data. It seems to me that messages on those signals should use public cryptography techniques to verify the authenticity and integrity of navigational data. It is feasible to do so, since L2C, L5 and L1C all use a packetized format and to-spec receivers must ignore unknown packets. Thus a cryptographic signature packet can be added in a fully backwards-compatible fashion. Properly done, this prevents spoofing of the navigational data, including preventing replay attacks. It should be sufficient to pretty much end spoofing once and for all.
A successful API design takes a mixture of software design and pedagogy.
Any helmsman worth his salt would have noticed a change in the direction of the swell, the sun, moon, stars, compass, so I would say the crew was not standing a good watch if they weren't properly observing their environment.
I think it's time for a revision to the L2C, L1C and L5 civilian GPS specifications. ...
It seems to me that messages on those signals should use public cryptography techniques to verify the authenticity and integrity of navigational data.
It should be sufficient to pretty much end spoofing once and for all.
You don't need to be able to generate false signals to defeat GPS. Fixes are based on time of flight of signals. Simply altering propogation delay is sufficient.
Yes, the crew followed the GPS, like good little auomatons. But being a sailor, especially a navigator or quartermaster is more than just reading a GPS.
If the bridge crew is not competent enough to read a compass nor experienced enough to look at the sky and realize that something was wrong, they shouldn't be entrusted to control anything more experienced than a dinghy. There's this really cool gadget that, with a little work, tells you almost exactly where you are at. It's called a sextant. Put that together with a decent clock and there's no reason to be sailing in the wrong direction.