8 ms·

And with WAAS, the world is moving towards GPS approaches anyway. Even without careful planning anyone with a mildly powerful VHF radio and a yagi antenna can

And with WAAS, the world is moving towards GPS approaches anyway. Even without careful planning anyone with a mildly powerful VHF radio and a yagi antenna can jam ILS, VORs and ATC comms rather effectively and has been able to since the end of WWII. I've seen these articles pop up a few times in the past couple days but everyone in aviation already knows that there isn't any security on this stuff. People even jam ATC for giggles sometimes[1]. There's enough redundancy that nothing bad has happened as a result so everyone goes on with life. I think this is just low hanging defcon fruit targeting non aviation-aware readers. [1] https://www.youtube.com/watch?v=ZvA_-linhg8 https://www.youtube.com/watch?v=ZvA_-linhg8

monocasa 7y ago
Can't you override GPS too? I thought that was part of the exploit chain that netted Iran a stealth drone.
- AWildC182 7y ago
  The Iran thing is dubious. If they did pull it off it required state level resources. Eventually it might be possible with commercial hardware but there isn't a lot of cheap stuff on the market that can generate the frequencies needed at the requisite power. It's worth noting that while the real GPS signal is very weak, the antennas that receive it are on the top of the plane and are somewhat directional. The receivers also have some minimal integrity checking capability IIRC. This is not to say it's impossible, but with the current stuff on the market and required software investment I'd put it at an order of magnitude or two higher execution complexity than grabbing a VHF radio and messing with ILS beams.
  - toomuchtodo 7y ago
    > The Iran thing is dubious. If they did pull it off it required state level resources. https://www.cnet.com/news/truck-driver-has-gps-jammer-accidentally-jams-newark-airport/ https://www.cnet.com/news/truck-driver-has-gps-jammer-accide... (Truck driver has GPS jammer, accidentally jams Newark airport)
  - crankylinuxuser 7y ago
    I've already taken over GPS (not jam, emulate all 12 sattelites for a takeover) in a dummy load environment (large paint can grounded). It was with a ADALM-Pluto. Tx was only 5mW but I could easily build a multistage amplifier and filtered appropriately. Why dont I? Its illegal and its ethically wrong, and its not my focus of study.
    - londons_explore 7y ago
      I concur. Generating the requisite signal is easy to do with opensource code and just $200 or so of equipment. I bet the drone didn't use the military encrypted GPS because they didn't want encryption keys to fall into the wrong hands (they're global), or just because the effort to load the new GPS keys every week was too much, The attackers just jammed and then spoofed GPS, and by providing a very strong signal, any kalman filters designed to merge signals from inertial units would be fooled.
  - monocasa 7y ago
    Most of the dubiousness I've seen is wrt the fact that the DoD claims that RQ-170's use inertial guidance and terrain following since GPS is so easily gamed (jam encrypted ranges, spoof civilian ranges). Even the DoD claims that a GPS attack itself is easy. Of course none of the DoD's version of events explains why then Iran has a mostly intact RQ-170...
  - dillonmckay 7y ago
    I get banner ads all the time on slashdot for enterprise GPS ‘testing’ gear.
  - nwallin 7y ago
    > The Iran thing is dubious. If they did pull it off it required state level resources. The Islamic Republic of Iran, by definition, has state level resources. In addition to their own resources, they have close ties with Russia and China. I agree with your ballpark of an order of magnitude higher complexity than messing with ILS, but that's well within Iran's capabilities.
- Rebelgecko 7y ago
  Jamming is relatively easy. Spoofing is a bit harder.
- Defenestresque 7y ago
  There are a couple of very interesting articles on GPS spoofing. Not only is it doable [0] but there are some interesting cases that most people don't really think about. Consider that GPS is often used as a timing signal by various financial entities (including stock exchanges). If you override the legitimate GPS signal (not a lot of power required as you'll be much closer to the receiver) and introduce a small deviation into the timing signal you can create some very interesting (and profitable) effects in the stock market. [1] Even introducing an error into the system can cause disastrous effects [2] [0] https://arstechnica.com/information-technology/2018/07/a-225-gps-spoofer-can-send-autonomous-vehicles-into-oncoming-traffic/ https://arstechnica.com/information-technology/2018/07/a-225... [1] https://radionavlab.ae.utexas.edu/images/stories/files/papers/summary_financial_sector_implications.pdf https://radionavlab.ae.utexas.edu/images/stories/files/paper... [2] https://blog.themistrading.com/2012/07/could-gps-spoofing-cause-another-flash-crash/ https://blog.themistrading.com/2012/07/could-gps-spoofing-ca...
zymhan 7y ago
Username checks out :) Ars technica cited a researcher at Northwestern that said GPS isn't necessarily a perfect fallback > One reason: the types of runway misalignments that would be effective in a spoofing attack typically range from about 32 feet to 50 feet, since pilots or air traffic controllers will visually detect anything bigger. It’s extremely difficult for GPS to detect malicious offsets that small. A second reason is that GPS spoofing attacks are relatively easy to carry out. https://arstechnica.com/information-technology/2019/05/the-radio-navigation-planes-use-to-land-safely-is-insecure-and-can-be-hacked/ https://arstechnica.com/information-technology/2019/05/the-r...
dbcurtis 7y ago
> People even jam ATC for giggles sometimes. Or impersonate. One of my pilot friends was planning a trip across the CA Central Valley, and he reported with some bemusement that there was at active NOTAM (NOtice To Air Men) to be on guard about some guy in the Fresno area that was impersonating ATC. Apparently it had been happening for months and nothing much by way of investigation had taken place. At this point I pretty much concluded that bad Part 15 devices or PG&E power line noise h0rk1ng over my ham radio reception was not going to get any attention, ever, if the FCC can't be bothered to find an ATC impersonator. I mean really, there are hams that do hidden transmitter hunts purely for sport. A posse of them could find that clown easily on any random Saturday morning and not be late for lunch.
- inetknght 7y ago
  > there are hams that do hidden transmitter hunts purely for sport. A posse of them could find that clown easily on any random Saturday morning and not be late for lunch. So why don't they?
  - p_l 7y ago
    You need to get the community organised for a hunt. I recall one that happened when a rogue retransmitter managed to spill religious radio onto TWR2 frequency at local Airport
  - dbcurtis 7y ago
    What is a bunch of random nerds going to do? They have no power to fine or arrest. All they can do is document the evidence and turn it over to the FCC, which does happen on occasion. But, I have listened to ARRL division directors talking about trying for years to get well-documented egregious cases of malicious interference dealt with by the FCC. The FCC just can not be bothered. It's not so much that they can't be bothered to collect evidence, which they can't, but even if they have evidence, that can't be bothered to act on it. The FCC should be a technical organization but is pathetically political. One of my ham friends deals with the FCC often, because he works in spectrum management at the NTIA. The stories he tells make me never want to set foot in D.C. except to visit all the museums that my taxes fund.

monocasa 7y ago

Can't you override GPS too? I thought that was part of the exploit chain that netted Iran a stealth drone.

AWildC182 7y ago
The Iran thing is dubious. If they did pull it off it required state level resources. Eventually it might be possible with commercial hardware but there isn't a lot of cheap stuff on the market that can generate the frequencies needed at the requisite power. It's worth noting that while the real GPS signal is very weak, the antennas that receive it are on the top of the plane and are somewhat directional. The receivers also have some minimal integrity checking capability IIRC. This is not to say it's impossible, but with the current stuff on the market and required software investment I'd put it at an order of magnitude or two higher execution complexity than grabbing a VHF radio and messing with ILS beams.
- toomuchtodo 7y ago
  > The Iran thing is dubious. If they did pull it off it required state level resources. https://www.cnet.com/news/truck-driver-has-gps-jammer-accidentally-jams-newark-airport/ https://www.cnet.com/news/truck-driver-has-gps-jammer-accide... (Truck driver has GPS jammer, accidentally jams Newark airport)
- crankylinuxuser 7y ago
  I've already taken over GPS (not jam, emulate all 12 sattelites for a takeover) in a dummy load environment (large paint can grounded). It was with a ADALM-Pluto. Tx was only 5mW but I could easily build a multistage amplifier and filtered appropriately. Why dont I? Its illegal and its ethically wrong, and its not my focus of study.
  - londons_explore 7y ago
    I concur. Generating the requisite signal is easy to do with opensource code and just $200 or so of equipment. I bet the drone didn't use the military encrypted GPS because they didn't want encryption keys to fall into the wrong hands (they're global), or just because the effort to load the new GPS keys every week was too much, The attackers just jammed and then spoofed GPS, and by providing a very strong signal, any kalman filters designed to merge signals from inertial units would be fooled.
- monocasa 7y ago
  Most of the dubiousness I've seen is wrt the fact that the DoD claims that RQ-170's use inertial guidance and terrain following since GPS is so easily gamed (jam encrypted ranges, spoof civilian ranges). Even the DoD claims that a GPS attack itself is easy. Of course none of the DoD's version of events explains why then Iran has a mostly intact RQ-170...
- dillonmckay 7y ago
  I get banner ads all the time on slashdot for enterprise GPS ‘testing’ gear.
- nwallin 7y ago
  > The Iran thing is dubious. If they did pull it off it required state level resources. The Islamic Republic of Iran, by definition, has state level resources. In addition to their own resources, they have close ties with Russia and China. I agree with your ballpark of an order of magnitude higher complexity than messing with ILS, but that's well within Iran's capabilities.
Rebelgecko 7y ago
Jamming is relatively easy. Spoofing is a bit harder.
Defenestresque 7y ago
There are a couple of very interesting articles on GPS spoofing. Not only is it doable [0] but there are some interesting cases that most people don't really think about. Consider that GPS is often used as a timing signal by various financial entities (including stock exchanges). If you override the legitimate GPS signal (not a lot of power required as you'll be much closer to the receiver) and introduce a small deviation into the timing signal you can create some very interesting (and profitable) effects in the stock market. [1] Even introducing an error into the system can cause disastrous effects [2] [0] https://arstechnica.com/information-technology/2018/07/a-225-gps-spoofer-can-send-autonomous-vehicles-into-oncoming-traffic/ https://arstechnica.com/information-technology/2018/07/a-225... [1] https://radionavlab.ae.utexas.edu/images/stories/files/papers/summary_financial_sector_implications.pdf https://radionavlab.ae.utexas.edu/images/stories/files/paper... [2] https://blog.themistrading.com/2012/07/could-gps-spoofing-cause-another-flash-crash/ https://blog.themistrading.com/2012/07/could-gps-spoofing-ca...

zymhan 7y ago

Username checks out :) Ars technica cited a researcher at Northwestern that said GPS isn't necessarily a perfect fallback > One reason: the types of runway misalignments that would be effective in a spoofing attack typically range from about 32 feet to 50 feet, since pilots or air traffic controllers will visually detect anything bigger. It’s extremely difficult for GPS to detect malicious offsets that small. A second reason is that GPS spoofing attacks are relatively easy to carry out. https://arstechnica.com/information-technology/2019/05/the-radio-navigation-planes-use-to-land-safely-is-insecure-and-can-be-hacked/ https://arstechnica.com/information-technology/2019/05/the-r...

dbcurtis 7y ago

> People even jam ATC for giggles sometimes. Or impersonate. One of my pilot friends was planning a trip across the CA Central Valley, and he reported with some bemusement that there was at active NOTAM (NOtice To Air Men) to be on guard about some guy in the Fresno area that was impersonating ATC. Apparently it had been happening for months and nothing much by way of investigation had taken place. At this point I pretty much concluded that bad Part 15 devices or PG&E power line noise h0rk1ng over my ham radio reception was not going to get any attention, ever, if the FCC can't be bothered to find an ATC impersonator. I mean really, there are hams that do hidden transmitter hunts purely for sport. A posse of them could find that clown easily on any random Saturday morning and not be late for lunch.

inetknght 7y ago
> there are hams that do hidden transmitter hunts purely for sport. A posse of them could find that clown easily on any random Saturday morning and not be late for lunch. So why don't they?
- p_l 7y ago
  You need to get the community organised for a hunt. I recall one that happened when a rogue retransmitter managed to spill religious radio onto TWR2 frequency at local Airport
- dbcurtis 7y ago
  What is a bunch of random nerds going to do? They have no power to fine or arrest. All they can do is document the evidence and turn it over to the FCC, which does happen on occasion. But, I have listened to ARRL division directors talking about trying for years to get well-documented egregious cases of malicious interference dealt with by the FCC. The FCC just can not be bothered. It's not so much that they can't be bothered to collect evidence, which they can't, but even if they have evidence, that can't be bothered to act on it. The FCC should be a technical organization but is pathetically political. One of my ham friends deals with the FCC often, because he works in spectrum management at the NTIA. The stories he tells make me never want to set foot in D.C. except to visit all the museums that my taxes fund.