4 ms·

That is laughable and doesn't provide any kind of military utility. What is the value of spoofing GPS by putting everyone into the same point, with zero inferre

That is laughable and doesn't provide any kind of military utility. What is the value of spoofing GPS by putting everyone into the same point, with zero inferred velocity and acceleration vectors, while other data sources like inertial will easily tell the supposed victim this is all wrong? Also, M-code can't be affected this way because it is encrypted, and military grade GPS receivers use virtual directed beams so they are next to impossible to simply jam, either.

jhayward 9y ago
M-code encryption doesn't protect against rebroadcast, which is what this attack seems to be. And beam-forming has its own limitations which can be fairly easily overcome by signal strength. It may be that military mitigation involves defining a carefully circumscribed envelope of signal strength, checks against inertial references, alternative time sources, etc. But it's not trivial or laughable.
- wyager 9y ago
  M-code contains time and ephemeris data, yes? (Since it's supposed to be "autonomous".) It seems like it would be quite easy to detect replay attacks.
  - PeterisP 9y ago
    The receiver likely doesn't have an accurate enough clock to reliably detect a quick (a tiny fraction of a second) replay attack if it can't hear the original transmitters due to intentional interference; most GPS systems would treat any differences between internal time and the time from the GPS data as a sign that their clock is drifting and needs to be adjusted, and it should be that way because their clock is inaccurate and drifting.
    - anovikov 9y ago
      Let's see: if the transmitter of spoofing signal is 3km away from the received (less than meaningful minimum - 3km distance is easily covered on inertial alone with no precision loss) it means 1us error. On 30km, 10us error. Is that really hard to have clock that precise on a receiver?
      - PeterisP 9y ago
        Yes, it is quite hard - standard oscillators used in electronics can easily drift up to a second a day (we don't notice because many devices update their time from GPS signal or cell data), and even really good ones will still drift for a millisecond quite quickly and it definitely can't rely on accuracy measured in us. For getting such an accuracy, IIRC, at the very least you'd need a temperature-controlled environment (so, not feasible in mobile devices) because the standard approaches will be slightly faster/slower depending on temperature.
        anovikov 9y ago
        There are atomic clocks that weigh only about 35 grams. They cost $15K though, so probably too expensive for munitions, except nukes, but fine for aircraft and ships, and probably for some land vehicles. Having ±5.0E-11 accuracy and <1E-11 @1000s short term stability. So enough for any aircraft sortie or ship action in a region of probable GPS spoofing (precise enough for days). Even OCXO will be enough given short duration of stay in a spoofed environment (typical OCXO will give you 50 seconds, but it is more than enough time to be within 300 meters from a spoofer, unless you are on foot). Or 500 seconds within 3000 meters, which is same speed - 6 m/s - which you have to maintain to be able to filter out spoofing. Several times more in practice because these are all RMS, not max errors. But 30 m/s is 5 sigmas which is military (nuclear, to be precise) definition of 'safe', so all aircraft/munitions are safe, and ships are big and expensive enough to justify $15,000 atomic clock.
        wyager 9y ago
        Wow! Thank you for the detailed description. I didn't realize atomic clocks had become so small. After searching, I see you can even buy rubidium clocks with similar accuracy for around $1000 in single quantities! Very impressive.

jhayward 9y ago

M-code encryption doesn't protect against rebroadcast, which is what this attack seems to be. And beam-forming has its own limitations which can be fairly easily overcome by signal strength. It may be that military mitigation involves defining a carefully circumscribed envelope of signal strength, checks against inertial references, alternative time sources, etc. But it's not trivial or laughable.

wyager 9y ago
M-code contains time and ephemeris data, yes? (Since it's supposed to be "autonomous".) It seems like it would be quite easy to detect replay attacks.
- PeterisP 9y ago
  The receiver likely doesn't have an accurate enough clock to reliably detect a quick (a tiny fraction of a second) replay attack if it can't hear the original transmitters due to intentional interference; most GPS systems would treat any differences between internal time and the time from the GPS data as a sign that their clock is drifting and needs to be adjusted, and it should be that way because their clock is inaccurate and drifting.
  - anovikov 9y ago
    Let's see: if the transmitter of spoofing signal is 3km away from the received (less than meaningful minimum - 3km distance is easily covered on inertial alone with no precision loss) it means 1us error. On 30km, 10us error. Is that really hard to have clock that precise on a receiver?
    - PeterisP 9y ago
      Yes, it is quite hard - standard oscillators used in electronics can easily drift up to a second a day (we don't notice because many devices update their time from GPS signal or cell data), and even really good ones will still drift for a millisecond quite quickly and it definitely can't rely on accuracy measured in us. For getting such an accuracy, IIRC, at the very least you'd need a temperature-controlled environment (so, not feasible in mobile devices) because the standard approaches will be slightly faster/slower depending on temperature.
      - anovikov 9y ago
        There are atomic clocks that weigh only about 35 grams. They cost $15K though, so probably too expensive for munitions, except nukes, but fine for aircraft and ships, and probably for some land vehicles. Having ±5.0E-11 accuracy and <1E-11 @1000s short term stability. So enough for any aircraft sortie or ship action in a region of probable GPS spoofing (precise enough for days). Even OCXO will be enough given short duration of stay in a spoofed environment (typical OCXO will give you 50 seconds, but it is more than enough time to be within 300 meters from a spoofer, unless you are on foot). Or 500 seconds within 3000 meters, which is same speed - 6 m/s - which you have to maintain to be able to filter out spoofing. Several times more in practice because these are all RMS, not max errors. But 30 m/s is 5 sigmas which is military (nuclear, to be precise) definition of 'safe', so all aircraft/munitions are safe, and ships are big and expensive enough to justify $15,000 atomic clock.
        wyager 9y ago
        Wow! Thank you for the detailed description. I didn't realize atomic clocks had become so small. After searching, I see you can even buy rubidium clocks with similar accuracy for around $1000 in single quantities! Very impressive.