4 ms·

Is this really possible? I don't know much technical details about GPS, but I thought a large component was time-based. If my understanding is correct, wouldn't

Is this really possible? I don't know much technical details about GPS, but I thought a large component was time-based. If my understanding is correct, wouldn't rebroadcasting fail because the times didn't match correctly?

jhayward 9y ago
The question is: match with what? Part of the GPS calculation is to figure out what time it is. There is no reference needed other than what the satellites broadcast. If you are rebroadcasting the entire GPS signal it includes all of the satellites, and will be self-consistent. Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so. If the receiver has some sort of out-of-channel time reference that is accurate to nanosecond levels I suppose that could be used as a check, but that sort of thing takes an atomic clock and doesn't fit in a wristwatch.
- PhantomGremlin 9y ago
  Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so. That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there. If the receiver has some sort of out-of-channel time reference that is accurate to nanosecond levels I suppose that could be used as a check, but that sort of thing takes an atomic clock and doesn't fit in a wristwatch. You're way off in your accuracy estimate. Oven controlled crystal oscillators have been around for at least 50 years. Probably a lot more. And they're dirt cheap. All they are is some temperature stabilization around an ordinary crystal oscillator. Quoting from the (always highly accurate) :) Wikipedia: The short term frequency stability of OCXOs is typically 1x10−12 over a few seconds, while the long term stability is limited to around 1x10−8 (10 ppb) per year by aging of the crystal https://en.wikipedia.org/wiki/Crystal_oven#Accuracy https://en.wikipedia.org/wiki/Crystal_oven#Accuracy An OCXO isn't practical in a tiny drone or a wristwatch, but it's highly practical in any military instrument that weighs more than a few pounds.
  - jhayward 9y ago
    > That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there. I made a mistake in ambiguously referring to two things: processing delay at the spoofer, and speed-of-light based time difference between spoof signal and direct broadcast at the receiver. However, I'm not aware of any crystal based clocks that are suitable for high dynamic range G environments that would be easy to use as an independent reference for any reasonable amount of time. They all suffer in shock/vibration conditions, and need external conditioning to maintain longer term stability. Maybe the military has 'em, but I guarantee they cost a lot more than a GPS rec.eiver
    - PhantomGremlin 9y ago
      They all suffer in shock/vibration conditions Interesting. I didn't know that. There's a comment on another thread that someone just made: https://news.ycombinator.com/item?id=15007006 https://news.ycombinator.com/item?id=15007006 And now you can buy a genuine atomic wristwatch. Here's a few sentences from the linked website: In each atomic physics unit is a small vessel of Caesium 133, an oven to heat it to 130°C, a laser to excite the atoms and a microwave resonator that resonates at the hyperfine transition frequency of the atoms, 16,546,737,186,000 vibrations per hour, with an accuracy of one 5 parts in 10-11. https://www.hoptroff.com/pages/about-us https://www.hoptroff.com/pages/about-us The same shock/vibration limitation probably applies to it. Still, it exists! I think. I wouldn't spend that much money to find out if it was real.
      - jhayward 9y ago
        Some links you might find interesting: https://www.microsemi.com/products/timing-synchronization-systems/time-frequency-references/chip-scale-atomic-clock https://www.microsemi.com/products/timing-synchronization-sy... http://www.oewaves.com/media-events/item/50-oewaves-to-develop-an-all-optical-integrated-micro-primary-atomic-clock-ao-impac-for-darpa http://www.oewaves.com/media-events/item/50-oewaves-to-devel... http://www.gps.gov/governance/advisory/meetings/2016-05/lutwak.pdf http://www.gps.gov/governance/advisory/meetings/2016-05/lutw... https://www.darpa.mil/program/micro-technology-for-positioning-navigation-and-timing https://www.darpa.mil/program/micro-technology-for-positioni... I haven't seen much (haven't been looking either tho) since the Micro-PNT program which was in 2008. Sometimes that means that things are getting interesting, other times it's a dry hole. I'm interested in any later developments if you know of them.
joecool1029 9y ago
>Is this really possible? I don't know much technical details about GPS, but I thought a large component was time-based. Yes, it's possible mostly because you can drown out the weak signals coming from satellites with much stronger terrestrial ones. There is also a new generation of GPS planned that will help mitigate future attacks, but it's getting delayed like crazy: https://en.wikipedia.org/wiki/GPS_Block_IIIA https://en.wikipedia.org/wiki/GPS_Block_IIIA Also, see this article on how it's technically feasible: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Lin-Huang-Qing-Yang-GPS-Spoofing.pdf https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20pre...
mikeash 9y ago
At its core, GPS works by having each satellite continually broadcast the current time. By observing the time-of-flight differences from multiple satellites (at least 4), the receiver can then compute its position and the current time. There's a lot more to it, of course, in terms of how it's encoded and how you know where the satellites are and such, but that's the basic principle. Note that the receiver itself doesn't know what time it is until it gets a position lock from the satellites. Receivers can have onboard clocks, which helps them calculate their position and the time more quickly than starting up with no idea of the time at all, but it's just a helper, not a requirement. Even if you have one, the onboard clock will necessarily be much less accurate than the ones on the GPS satellites, so any (reasonable) delta will be assumed to be clock drift, not spoofing. So, if I set up a receiver at point A, then rebroadcast the signals I receive to your receiver at point B, and your receiver is blocked from getting the true signals at B, your receiver will think it's at point A. It will also think that the current time is behind, by whatever the rebroadcasting delay is, but it won't have any way of knowing that's wrong. As far as mitigation goes, if your receiver was running before the spoof signal started to arrive then you could easily notice that things had suddenly gone crazy. I think military equipment that depends on GPS also has backup inertial navigation systems which would quickly show any divergence, and allow it to continue without GPS input (albeit at reduced accuracy).

jhayward 9y ago

The question is: match with what? Part of the GPS calculation is to figure out what time it is. There is no reference needed other than what the satellites broadcast. If you are rebroadcasting the entire GPS signal it includes all of the satellites, and will be self-consistent. Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so. If the receiver has some sort of out-of-channel time reference that is accurate to nanosecond levels I suppose that could be used as a check, but that sort of thing takes an atomic clock and doesn't fit in a wristwatch.

PhantomGremlin 9y ago
Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so. That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there. If the receiver has some sort of out-of-channel time reference that is accurate to nanosecond levels I suppose that could be used as a check, but that sort of thing takes an atomic clock and doesn't fit in a wristwatch. You're way off in your accuracy estimate. Oven controlled crystal oscillators have been around for at least 50 years. Probably a lot more. And they're dirt cheap. All they are is some temperature stabilization around an ordinary crystal oscillator. Quoting from the (always highly accurate) :) Wikipedia: The short term frequency stability of OCXOs is typically 1x10−12 over a few seconds, while the long term stability is limited to around 1x10−8 (10 ppb) per year by aging of the crystal https://en.wikipedia.org/wiki/Crystal_oven#Accuracy https://en.wikipedia.org/wiki/Crystal_oven#Accuracy An OCXO isn't practical in a tiny drone or a wristwatch, but it's highly practical in any military instrument that weighs more than a few pounds.
- jhayward 9y ago
  > That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there. I made a mistake in ambiguously referring to two things: processing delay at the spoofer, and speed-of-light based time difference between spoof signal and direct broadcast at the receiver. However, I'm not aware of any crystal based clocks that are suitable for high dynamic range G environments that would be easy to use as an independent reference for any reasonable amount of time. They all suffer in shock/vibration conditions, and need external conditioning to maintain longer term stability. Maybe the military has 'em, but I guarantee they cost a lot more than a GPS rec.eiver
  - PhantomGremlin 9y ago
    They all suffer in shock/vibration conditions Interesting. I didn't know that. There's a comment on another thread that someone just made: https://news.ycombinator.com/item?id=15007006 https://news.ycombinator.com/item?id=15007006 And now you can buy a genuine atomic wristwatch. Here's a few sentences from the linked website: In each atomic physics unit is a small vessel of Caesium 133, an oven to heat it to 130°C, a laser to excite the atoms and a microwave resonator that resonates at the hyperfine transition frequency of the atoms, 16,546,737,186,000 vibrations per hour, with an accuracy of one 5 parts in 10-11. https://www.hoptroff.com/pages/about-us https://www.hoptroff.com/pages/about-us The same shock/vibration limitation probably applies to it. Still, it exists! I think. I wouldn't spend that much money to find out if it was real.
    - jhayward 9y ago
      Some links you might find interesting: https://www.microsemi.com/products/timing-synchronization-systems/time-frequency-references/chip-scale-atomic-clock https://www.microsemi.com/products/timing-synchronization-sy... http://www.oewaves.com/media-events/item/50-oewaves-to-develop-an-all-optical-integrated-micro-primary-atomic-clock-ao-impac-for-darpa http://www.oewaves.com/media-events/item/50-oewaves-to-devel... http://www.gps.gov/governance/advisory/meetings/2016-05/lutwak.pdf http://www.gps.gov/governance/advisory/meetings/2016-05/lutw... https://www.darpa.mil/program/micro-technology-for-positioning-navigation-and-timing https://www.darpa.mil/program/micro-technology-for-positioni... I haven't seen much (haven't been looking either tho) since the Micro-PNT program which was in 2008. Sometimes that means that things are getting interesting, other times it's a dry hole. I'm interested in any later developments if you know of them.

joecool1029 9y ago

>Is this really possible? I don't know much technical details about GPS, but I thought a large component was time-based. Yes, it's possible mostly because you can drown out the weak signals coming from satellites with much stronger terrestrial ones. There is also a new generation of GPS planned that will help mitigate future attacks, but it's getting delayed like crazy: https://en.wikipedia.org/wiki/GPS_Block_IIIA https://en.wikipedia.org/wiki/GPS_Block_IIIA Also, see this article on how it's technically feasible: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Lin-Huang-Qing-Yang-GPS-Spoofing.pdf https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20pre...

mikeash 9y ago

At its core, GPS works by having each satellite continually broadcast the current time. By observing the time-of-flight differences from multiple satellites (at least 4), the receiver can then compute its position and the current time. There's a lot more to it, of course, in terms of how it's encoded and how you know where the satellites are and such, but that's the basic principle. Note that the receiver itself doesn't know what time it is until it gets a position lock from the satellites. Receivers can have onboard clocks, which helps them calculate their position and the time more quickly than starting up with no idea of the time at all, but it's just a helper, not a requirement. Even if you have one, the onboard clock will necessarily be much less accurate than the ones on the GPS satellites, so any (reasonable) delta will be assumed to be clock drift, not spoofing. So, if I set up a receiver at point A, then rebroadcast the signals I receive to your receiver at point B, and your receiver is blocked from getting the true signals at B, your receiver will think it's at point A. It will also think that the current time is behind, by whatever the rebroadcasting delay is, but it won't have any way of knowing that's wrong. As far as mitigation goes, if your receiver was running before the spoof signal started to arrive then you could easily notice that things had suddenly gone crazy. I think military equipment that depends on GPS also has backup inertial navigation systems which would quickly show any divergence, and allow it to continue without GPS input (albeit at reduced accuracy).