16 ms·
Ships fooled in GPS spoofing attack suggest Russian cyberweapon
- gaius 9y agoYou will be relieved to know that the military is on top of this and regularly trains for GPS jamming scenarios https://www.ofcom.org.uk/spectrum/information/gps-jamming-exercises https://www.ofcom.org.uk/spectrum/information/gps-jamming-ex...
- stuff4ben 9y agoIf you RTFA, you'll note that jamming is different than spoofing. And no it doesn't make me feel relieved that the military "is on top of this". Whose military? Why should we trust them? State actors with the capability to spoof GPS signals can do much harm to even their own citizens.
- lfam 9y agoIt's not comforting, indeed. But you should know that the various space-based positioning systems (GPS, GLONASS, BeiDou etc) are deployed and administered by the respective governments of their countries of origin. They were invented for the military and can be selectively disabled or degraded for civilian users. Does anyone think it's possible for non-governments to stand up replacements for these systems, from either a technical or legal / political perspective?
- jdavis703 9y agoIt'd be very easy to make a law outlawing high-resoluton satellite positioning systems. All lawmakers would need to claim is it was a national security issue that terrorists could use blah blah. From a technical perspective it's not hard at all, but corporations are probably leery of launching (no pun intended) such a business.
- GrumpyYoungMan 9y ago> If you RTFA, you'll note that jamming is different than spoofing. Military GPS signals (P-code and future M-code) are encrypted, so spoofing is somewhat less of a concern for the military. See https://en.wikipedia.org/wiki/GPS_signals#Precision_code https://en.wikipedia.org/wiki/GPS_signals#Precision_code and https://en.wikipedia.org/wiki/GPS_signals#Military_.28M-code.29 https://en.wikipedia.org/wiki/GPS_signals#Military_.28M-code... Outside of the military, both academia and industry are well aware of the potential for spoofing of civilian GNSS signals and have been developing proof of concept attacks and countermeasures for quite some time. See, for example, http://gpsworld.com/inexpensive-hack-spoofs-gps-in-smartphones-drones/ http://gpsworld.com/inexpensive-hack-spoofs-gps-in-smartphon... and https://www.ion.org/publications/abstract.cfm?articleID=14780 https://www.ion.org/publications/abstract.cfm?articleID=1478...
- ChuckMcM 9y agoIn the case of using the encrypted GPS I would guess that spoofing would look like jamming. Basically if you were getting a GPS signal and it wasn't encrypted correctly you would consider it invalid but you're probably not seeing the real satellites because you're seeing the spoof signal. The net result being you are seeing no GPS signal you can trust. That reduces down to the previously solved problem of operating with no GPS at all.
- gaius 9y agoWhose military? If you "RTFA" you will observe that OFCOM is the UK regulator.
- blibble 9y agothe plot of Tomorrow Never Dies wasn't that far fetched after all?
- bald 9y agoawesome.... exactly my thought :)
- ge0rg 9y agomany NATO guided bombs, missiles and drones rely on GPS navigation There are separate code sets for civilian and military GPS, and the latter should only be availability to US military equipment manufacturers. What I wonder is whether that means some NATO equipment will be misdirected by spoofing attacks and other will not, or if the attackers actually are able to spoof both types of signal.
- jhayward 9y ago> if the attackers actually are able to spoof both types of signal. Interestingly, the military GPS signal is encrypted using what is called the A/S "anti-spoof" code. Which was deployed in the '70s. So you know they've been thinking about it for quite some time. Practically speaking: Assuming one can shield the spoofer receiver from its own transmitter there's no real reason why a spoofer can't set up a receiver at one location and rebroadcast the encrypted signal as received there. If rebroadcast at sufficient power it would easily overpower the true signal, and would indicate the spoofer position rather than true position everywhere it was the strongest signal. Sort of like if you just moved everyone's antenna to the spoofer location using a very long antenna cable. It would be very interesting to know what military receivers do to mitigate such an attack. I haven't seen anything in open literature. I suppose it would be (rightfully so) classified technology.
- jdavis703 9y agoIs this really possible? I don't know much technical details about GPS, but I thought a large component was time-based. If my understanding is correct, wouldn't rebroadcasting fail because the times didn't match correctly?
- jhayward 9y agoThe question is: match with what? Part of the GPS calculation is to figure out what time it is. There is no reference needed other than what the satellites broadcast. If you are rebroadcasting the entire GPS signal it includes all of the satellites, and will be self-consistent. Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so. If the receiver has some sort of out-of-channel time reference that is accurate to nanosecond levels I suppose that could be used as a check, but that sort of thing takes an atomic clock and doesn't fit in a wristwatch.
- krona 9y agoReminds me of the Iran–U.S. RQ-170 incident, when a CIA drone was captured by Iranian forces; one of the leading theories was GPS spoofing, although naturally Lockheed Martin denied that it was vulnerable to such a simple (for a nation state) attack.
- banku_brougham 9y agoTime to break out from storage: sextant, compass, paper map, ...
- jdavis703 9y agoThe Navy was a couple years ahead of you, they've already started training officers to navigate by non-electric means: http://www.npr.org/2016/02/22/467210492/u-s-navy-brings-back-navigation-by-the-stars-for-officers http://www.npr.org/2016/02/22/467210492/u-s-navy-brings-back....
- yborg 9y agoThe fact that they stopped at all astonishes me. In a military context, it's certainly conceivable that a ship would take some kind of battle damage that would disable its electronic nav systems. Middies also used to learn how to sail with canvas, did they stop that, too?
- fooker 9y agoGPS goes wonky near the Kremlin, as every tourist knows.
- jhayward 9y agoThis is fairly old news. Reports are a year or two old and suggest that Russian security uses GPS spoofing anywhere V. Putin may be located, presumably as a defense against drone type attacks or surveillance. The spoofed location is often an airport. The black sea spoofing could be related to a visit to e.g., Sochi. Alternatively Russia could be deploying the spoofers on ships now, which would seem to have offensive implications as well as defense. (sorry, no links)
- roywiggins 9y agoSounds like a semi-reliable Putin Detector could be set up if you wanted to...
- jhayward 9y agoIt would also be fairly short-lived in battle, since the spoofer is broadcasting its own location in a highly accurate "place ordnance here" manner.
- subway 9y agoMore likely it is broadcasting the position of the satellite it is spoofing, with altered timing. edit: that doesn't prevent other means of locating the source of an rf signal
- jhayward 9y agoYou can't spoof the encrypted signal by simulating a satellite, you have to capture the real signal and rebroadcast it as an overpowering signal so targets can't get the direct broadcast at their location. This means that everyone who is getting the overpowered signal will compute the same location, which will be the antenna of the spoofer.
- delinka 9y agoLet's think through that. In order to spoof GPS, you need to overpower the true GPS signal with your own. You put some transmitters in a location, and anyone attempting to get a GPS fix while in that location gets spoofed data and the wrong location. Now, if you're close enough to get the spoofed signal, you're close enough to see Putin's entourage and know he's probably nearby. If you're not close, you don't get spoofed. So I'm uncertain of the utility of this Putin Detector.
- knackery 9y agoWhere is the proof that Russia is behind this?
- knackery 9y agoWhere is the proof that Russia is behind all this?
- oneplane 9y agoOn the map probably. If you wanted to do this, it wouldn't be handy to do it in a country or for a country that actively scans for radio spoofing, jamming or illegal use of radio bands. Considering that out of all the countries nearby only one or two would have the means it's not hard to figure out would would want to do this.
- oneplane 9y agoNot only old news as suggested in other comments, but not hard to do either; IIRC, this was done 1 or 2 DEF CONs ago, not only for GPS, but also for older systems that use radio beacons (Aircraft? not sure..) and A-GPS (spoofing GSM radios).
- samstave 9y agohttp://www.rtl-sdr.com/spoofing-gps-locations-with-low-cost-tx-sdrs/ http://www.rtl-sdr.com/spoofing-gps-locations-with-low-cost-...
- oneplane 9y agoYes! That's the one I was looking for. I guess going for 2014 or older wasn't going to get me the 2015 presentations ;-) It is pretty effective in illustrating how easy it is to break such a system. Easy as in, you don't need a big nation state actor to do this.
- technofiend 9y agoFunnily enough I have a legitimate use for this: correcting GPS drift in a location with poor GPS availability. I would love to carry around a Raspberry Pi with an attached SDR that let me fine tune the signal so it's accurate versus showing me across the street, down the block or aimlessly wandering in circles.
- anovikov 9y agoThat is laughable and doesn't provide any kind of military utility. What is the value of spoofing GPS by putting everyone into the same point, with zero inferred velocity and acceleration vectors, while other data sources like inertial will easily tell the supposed victim this is all wrong? Also, M-code can't be affected this way because it is encrypted, and military grade GPS receivers use virtual directed beams so they are next to impossible to simply jam, either.
- jhayward 9y agoM-code encryption doesn't protect against rebroadcast, which is what this attack seems to be. And beam-forming has its own limitations which can be fairly easily overcome by signal strength. It may be that military mitigation involves defining a carefully circumscribed envelope of signal strength, checks against inertial references, alternative time sources, etc. But it's not trivial or laughable.
- wyager 9y agoM-code contains time and ephemeris data, yes? (Since it's supposed to be "autonomous".) It seems like it would be quite easy to detect replay attacks.
- PeterisP 9y agoThe receiver likely doesn't have an accurate enough clock to reliably detect a quick (a tiny fraction of a second) replay attack if it can't hear the original transmitters due to intentional interference; most GPS systems would treat any differences between internal time and the time from the GPS data as a sign that their clock is drifting and needs to be adjusted, and it should be that way because their clock is inaccurate and drifting.
- anovikov 9y agoLet's see: if the transmitter of spoofing signal is 3km away from the received (less than meaningful minimum - 3km distance is easily covered on inertial alone with no precision loss) it means 1us error. On 30km, 10us error. Is that really hard to have clock that precise on a receiver?
- stevefeinstein 9y agoThe takeaway I get from this is that whenever the Kremlin is attacked, they'd rather the nearby Airports take the hit. I guess then no one will leave, and no one will come in.
- netsharc 9y agoIsn't it the other way? You're in your garden in Moscow but the GPS says you're thr airport. A missile heading for the airport will think "I'm on target!" as it lands on your head.
- jorblumesea 9y agoI feel like this also tips the hand of someone trying to track Vlad down. All you have to do is set up gps devices in/around major Russian areas (Sochi, Moscow), and when you start seeing anomalies, he's probably nearby.
- dba7dba 9y agoWe may soon see 'inertial navigation system (INS)' to supplement GPS. I wonder if the cost of producing/maintaining it could be lowered significantly enough using new sensors developed for use in smartphones and such.
- sayhii 9y agoTypical Americans. Tomorrow they will write that Russia is a third world gasoline-station-country without any technology or weapons with dumb people and is unable for anything. Pure cognitive dissonance.
- Impractical 9y agoI guess we could go back to navigating by the stars. Alternatively we could go back to using LORAN... way less expensive than satellites and more robust with modern micro controller technology. With their output power they would be hard to scramble the frequencies by wattage output flooding on the same frequency. If they also used timed frequency hopping they could further protect it.
- Slobbinson 9y agoYou don't just need signing, because that can be replayed. You need distance bounding protocols to stop replay, but that requires interactive communication.
- radicaldreamer 9y agoI wonder if this played any role in the recent Navy accident. It seems there were multiple safeguards which failed, but it would be very interesting if there were GPS issues as well. http://www.cnn.com/2017/06/16/politics/us-navy-destroyer-collides-with-merchant-ship-japan/index.html http://www.cnn.com/2017/06/16/politics/us-navy-destroyer-col...
- lisper 9y agoUnlikely. The ACX crystal was traveling in a straight line for hundreds of miles before the collision. Just before the collision she made a slight turn to port in order to navigate a narrow straight. Her trajectory was entirely consistent with her destination. There's no indication she didn't know exactly where she was. (And I mean that literally: the ship knew where it was. The evidence indicates that the crew was asleep.) Reference: http://blog.rongarret.info/2017/06/theres-something-very-odd-about-uss.html http://blog.rongarret.info/2017/06/theres-something-very-odd...
- ericcumbee 9y agoWasn't this part of the plot to "Tomorrow Never Dies"?