6 ms·

many NATO guided bombs, missiles and drones rely on GPS navigation There are separate code sets for civilian and military GPS, and the latter should only be av

• jhayward 9y ago
  > if the attackers actually are able to spoof both types of signal. Interestingly, the military GPS signal is encrypted using what is called the A/S "anti-spoof" code. Which was deployed in the '70s. So you know they've been thinking about it for quite some time. Practically speaking: Assuming one can shield the spoofer receiver from its own transmitter there's no real reason why a spoofer can't set up a receiver at one location and rebroadcast the encrypted signal as received there. If rebroadcast at sufficient power it would easily overpower the true signal, and would indicate the spoofer position rather than true position everywhere it was the strongest signal. Sort of like if you just moved everyone's antenna to the spoofer location using a very long antenna cable. It would be very interesting to know what military receivers do to mitigate such an attack. I haven't seen anything in open literature. I suppose it would be (rightfully so) classified technology.
  • jdavis703 9y ago
    Is this really possible? I don't know much technical details about GPS, but I thought a large component was time-based. If my understanding is correct, wouldn't rebroadcasting fail because the times didn't match correctly?
    • jhayward 9y ago
      The question is: match with what? Part of the GPS calculation is to figure out what time it is. There is no reference needed other than what the satellites broadcast. If you are rebroadcasting the entire GPS signal it includes all of the satellites, and will be self-consistent. Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so. If the receiver has some sort of out-of-channel time reference that is accurate to nanosecond levels I suppose that could be used as a check, but that sort of thing takes an atomic clock and doesn't fit in a wristwatch.
      • PhantomGremlin 9y ago
        Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so. That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there. If the receiver has some sort of out-of-channel time reference that is accurate to nanosecond levels I suppose that could be used as a check, but that sort of thing takes an atomic clock and doesn't fit in a wristwatch. You're way off in your accuracy estimate. Oven controlled crystal oscillators have been around for at least 50 years. Probably a lot more. And they're dirt cheap. All they are is some temperature stabilization around an ordinary crystal oscillator. Quoting from the (always highly accurate) :) Wikipedia: The short term frequency stability of OCXOs is typically 1x10−12 over a few seconds, while the long term stability is limited to around 1x10−8 (10 ppb) per year by aging of the crystal https://en.wikipedia.org/wiki/Crystal_oven#Accuracy https://en.wikipedia.org/wiki/Crystal_oven#Accuracy An OCXO isn't practical in a tiny drone or a wristwatch, but it's highly practical in any military instrument that weighs more than a few pounds.
        • jhayward 9y ago
          > That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there. I made a mistake in ambiguously referring to two things: processing delay at the spoofer, and speed-of-light based time difference between spoof signal and direct broadcast at the receiver. However, I'm not aware of any crystal based clocks that are suitable for high dynamic range G environments that would be easy to use as an independent reference for any reasonable amount of time. They all suffer in shock/vibration conditions, and need external conditioning to maintain longer term stability. Maybe the military has 'em, but I guarantee they cost a lot more than a GPS rec.eiver
          • PhantomGremlin 9y ago
            They all suffer in shock/vibration conditions Interesting. I didn't know that. There's a comment on another thread that someone just made: https://news.ycombinator.com/item?id=15007006 https://news.ycombinator.com/item?id=15007006 And now you can buy a genuine atomic wristwatch. Here's a few sentences from the linked website: In each atomic physics unit is a small vessel of Caesium 133, an oven to heat it to 130°C, a laser to excite the atoms and a microwave resonator that resonates at the hyperfine transition frequency of the atoms, 16,546,737,186,000 vibrations per hour, with an accuracy of one 5 parts in 10-11. https://www.hoptroff.com/pages/about-us https://www.hoptroff.com/pages/about-us The same shock/vibration limitation probably applies to it. Still, it exists! I think. I wouldn't spend that much money to find out if it was real.
    • joecool1029 9y ago
      >Is this really possible? I don't know much technical details about GPS, but I thought a large component was time-based. Yes, it's possible mostly because you can drown out the weak signals coming from satellites with much stronger terrestrial ones. There is also a new generation of GPS planned that will help mitigate future attacks, but it's getting delayed like crazy: https://en.wikipedia.org/wiki/GPS_Block_IIIA https://en.wikipedia.org/wiki/GPS_Block_IIIA Also, see this article on how it's technically feasible: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Lin-Huang-Qing-Yang-GPS-Spoofing.pdf https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20pre...
    • mikeash 9y ago
      At its core, GPS works by having each satellite continually broadcast the current time. By observing the time-of-flight differences from multiple satellites (at least 4), the receiver can then compute its position and the current time. There's a lot more to it, of course, in terms of how it's encoded and how you know where the satellites are and such, but that's the basic principle. Note that the receiver itself doesn't know what time it is until it gets a position lock from the satellites. Receivers can have onboard clocks, which helps them calculate their position and the time more quickly than starting up with no idea of the time at all, but it's just a helper, not a requirement. Even if you have one, the onboard clock will necessarily be much less accurate than the ones on the GPS satellites, so any (reasonable) delta will be assumed to be clock drift, not spoofing. So, if I set up a receiver at point A, then rebroadcast the signals I receive to your receiver at point B, and your receiver is blocked from getting the true signals at B, your receiver will think it's at point A. It will also think that the current time is behind, by whatever the rebroadcasting delay is, but it won't have any way of knowing that's wrong. As far as mitigation goes, if your receiver was running before the spoof signal started to arrive then you could easily notice that things had suddenly gone crazy. I think military equipment that depends on GPS also has backup inertial navigation systems which would quickly show any divergence, and allow it to continue without GPS input (albeit at reduced accuracy).
  • cpncrunch 9y ago
    >there's no real reason why a spoofer can't set up a receiver at one location and rebroadcast the encrypted signal as received there I can't really see this working if you have an inertial navigation backup system. It would be easy to detect the large error in GPS position and just ignore the GPS.
    • jhayward 9y ago
      You'll need two alternatives to GPS to be able to tell whether it's a malfunction in GPS, or the inertial nav. e-loran is such a third alternative.
      • jjoonathan 9y ago
        Only if you assume they're equally likely to fail. Since INS is much less susceptible to spoofing and ought to have a fairly low nominal failure rate, in wartime it might be reasonable to assume disagreements are due to spoofing.
        • cpncrunch 9y ago
          Also, I believe most airliners have 2 or 3 INS systems, so it would be easy to see (or detect) if one of them has failed. It seems unlikely that all the gyros would silently fail...that would only happen if the gyros tumbled, or power failure to the gyros, but there would presumably be an error indication in either of those situations. (Also, these days they use ring laser gyros, which don't tumble or stop spinning).
          • jjoonathan 9y ago
            Speaking of which, are RLGs actually difficult to manufacture or is the military intentionally stopping them from getting into civilian hands? Even the best cell phone sensor fusion seems to result in an obnoxiously shitty map experience.
            • jhayward 9y ago
  • jjoonathan 9y ago
    Detection 1: Constantly run HFDF on all GPS frequencies. You know where your own transmitters live. Process of elimination. Detection 2: Compare GPS velocity vector to INS velocity vector. For fixed installations, have two receivers spaced some distance apart and compare GPS location. Detection 3: Measure the time delay between GPS and your RTC. With a GPS disciplined RTC, drift should be low enough to make this viable. Detection 4: Look for jumps in GPS location or time. Mitigation 1: Send black vans, soldiers, or missiles as appropriate to rogue transmission locations determined by HFDF or the encoded position of spoofed signal. Mitigation 2: Frequency-agile and mobile GPS substitutes almost certainly have a prominent role in EW strategy. Of course, as you note, the details have to be classified, but it's pretty easy to speculate what form the overall strategy will take.
  • GrumpyYoungMan 9y ago
    You're talking about a GPS repeater. Such systems are commercially available to rebroadcast a GPS signal within a building where the signal wouldn't penetrate, but require a license to operate, IIRC. As for countermeasures, well, whoever's holding the receiver is bound to get suspicious if they move and the reported position doesn't. :) Jokes aside, there is work being done integrating other sensors (inertial, compass, gyro, etc.) to do dead reckoning to detect errors in the position and motion reported by the GNSS receiver. As an aside, "GPS" technically refers only to the positioning system operated by the United States. The generic term is "GNSS" (global navigation satellite system) and encompasses GPS, GLONASS, Galileo, Beidou, etc.)
    • Nokinside 9y ago
      > there is work being done integrating other sensors Integrated navigation systems GPS/INS are already default in many critical civilian systems. They sell these systems as a single package. These systems are still vulnerable against satellite-lock takeover where the spoofer who starts with repeating the correct signal and diverges from it gradually.
• mikeash 9y ago
  I don't know that any military equipment relies on GPS. They use it preferentially, but have other things they can fall back to. JDAMs, for example, have an inertial navigation system in addition to GPS. I'm sure that these weapons have the ability to detect spoofing by seeing that GPS is diverging significantly from the INS output. The weapon is less accurate without GPS so spoofing (or just plain jamming) could be used to reduce its accuracy somewhat, but probably couldn't be used to make it hit a completely different target.
• Nokinside 9y ago
  There are several types of spoofing attacks and it's possible to use spoofing as type of jamming attack against military GPS units from a distance where pure jamming is not effective. Older receivers require lock into C/A code before moving to encrypted P(Y). The new M-code attempts to solve some of these issues. The simplest form of GPS spoofing sends made up signals that misdirects the GPS receiver. Military equipment is protected against these kinds of attacks with authenticated signals. Carry-off attacks (satellite-lock takeover) start with broadcasting perfectly synced repeat of the original signal. This kind of attack can be used to make munitions and missiles to lose their signal lock in critical time. It's also possible that there are multiple weaknesses and bugs in the military receivers that can be exploited. Iranians were somehow able to trick RQ-170 drone to land on Iran. When Iranians captured U.S. Navy patrol boat it was because there was mysterious navigation error.