Ships fooled in GPS spoofing attack suggest Russian cyberweapon

https://www.newscientist.com/article/2143499-ships-fooled-in-gps-spoofing-attack-suggest-russian-cyberweapon/

by ohjeez • 9 years ago

107 73 9 years ago

gaius2• 9 years ago

You will be relieved to know that the military is on top of this and regularly trains for GPS jamming scenarios https://www.ofcom.org.uk/spectrum/information/gps-jamming-ex...

stuff4ben• 9 years ago

If you RTFA, you'll note that jamming is different than spoofing. And no it doesn't make me feel relieved that the military "is on top of this". Whose military? Why should we trust them? State actors with the capability to spoof GPS signals can do much harm to even their own citizens.

lfam• 9 years ago

It's not comforting, indeed.

But you should know that the various space-based positioning systems (GPS, GLONASS, BeiDou etc) are deployed and administered by the respective governments of their countries of origin. They were invented for the military and can be selectively disabled or degraded for civilian users.

Does anyone think it's possible for non-governments to stand up replacements for these systems, from either a technical or legal / political perspective?

GrumpyYoungMan2• 9 years ago

If you RTFA, you'll note that jamming is different than spoofing.

Military GPS signals (P-code and future M-code) are encrypted, so spoofing is somewhat less of a concern for the military. See https://en.wikipedia.org/wiki/GPS_signals#Precision_code and https://en.wikipedia.org/wiki/GPS_signals#Military_.28M-code...

Outside of the military, both academia and industry are well aware of the potential for spoofing of civilian GNSS signals and have been developing proof of concept attacks and countermeasures for quite some time. See, for example, http://gpsworld.com/inexpensive-hack-spoofs-gps-in-smartphon... and https://www.ion.org/publications/abstract.cfm?articleID=1478...

ChuckMcM• 9 years ago

In the case of using the encrypted GPS I would guess that spoofing would look like jamming. Basically if you were getting a GPS signal and it wasn't encrypted correctly you would consider it invalid but you're probably not seeing the real satellites because you're seeing the spoof signal. The net result being you are seeing no GPS signal you can trust. That reduces down to the previously solved problem of operating with no GPS at all.

gaius2• 9 years ago

Whose military?

If you "RTFA" you will observe that OFCOM is the UK regulator.

blibble• 9 years ago

the plot of Tomorrow Never Dies wasn't that far fetched after all?

bald• 9 years ago

awesome.... exactly my thought :)

ge0rg• 9 years ago

many NATO guided bombs, missiles and drones rely on GPS navigation

There are separate code sets for civilian and military GPS, and the latter should only be availability to US military equipment manufacturers. What I wonder is whether that means some NATO equipment will be misdirected by spoofing attacks and other will not, or if the attackers actually are able to spoof both types of signal.

jhayward11• 9 years ago

if the attackers actually are able to spoof both types of signal.

Interestingly, the military GPS signal is encrypted using what is called the A/S "anti-spoof" code. Which was deployed in the '70s. So you know they've been thinking about it for quite some time.

Practically speaking: Assuming one can shield the spoofer receiver from its own transmitter there's no real reason why a spoofer can't set up a receiver at one location and rebroadcast the encrypted signal as received there. If rebroadcast at sufficient power it would easily overpower the true signal, and would indicate the spoofer position rather than true position everywhere it was the strongest signal. Sort of like if you just moved everyone's antenna to the spoofer location using a very long antenna cable.

It would be very interesting to know what military receivers do to mitigate such an attack. I haven't seen anything in open literature. I suppose it would be (rightfully so) classified technology.

jdavis7033• 9 years ago

Is this really possible? I don't know much technical details about GPS, but I thought a large component was time-based. If my understanding is correct, wouldn't rebroadcasting fail because the times didn't match correctly?

cpncrunch3• 9 years ago

there's no real reason why a spoofer can't set up a receiver at one location and rebroadcast the encrypted signal as received there

I can't really see this working if you have an inertial navigation backup system. It would be easy to detect the large error in GPS position and just ignore the GPS.

jjoonathan5• 9 years ago

Detection 1: Constantly run HFDF on all GPS frequencies. You know where your own transmitters live. Process of elimination.

Detection 2: Compare GPS velocity vector to INS velocity vector. For fixed installations, have two receivers spaced some distance apart and compare GPS location.

Detection 3: Measure the time delay between GPS and your RTC. With a GPS disciplined RTC, drift should be low enough to make this viable.

Detection 4: Look for jumps in GPS location or time.

Mitigation 1: Send black vans, soldiers, or missiles as appropriate to rogue transmission locations determined by HFDF or the encoded position of spoofed signal.

Mitigation 2: Frequency-agile and mobile GPS substitutes almost certainly have a prominent role in EW strategy. Of course, as you note, the details have to be classified, but it's pretty easy to speculate what form the overall strategy will take.

GrumpyYoungMan2• 9 years ago

You're talking about a GPS repeater. Such systems are commercially available to rebroadcast a GPS signal within a building where the signal wouldn't penetrate, but require a license to operate, IIRC.

As for countermeasures, well, whoever's holding the receiver is bound to get suspicious if they move and the reported position doesn't. :) Jokes aside, there is work being done integrating other sensors (inertial, compass, gyro, etc.) to do dead reckoning to detect errors in the position and motion reported by the GNSS receiver.

As an aside, "GPS" technically refers only to the positioning system operated by the United States. The generic term is "GNSS" (global navigation satellite system) and encompasses GPS, GLONASS, Galileo, Beidou, etc.)

mikeash2• 9 years ago

I don't know that any military equipment relies on GPS. They use it preferentially, but have other things they can fall back to. JDAMs, for example, have an inertial navigation system in addition to GPS. I'm sure that these weapons have the ability to detect spoofing by seeing that GPS is diverging significantly from the INS output. The weapon is less accurate without GPS so spoofing (or just plain jamming) could be used to reduce its accuracy somewhat, but probably couldn't be used to make it hit a completely different target.

Nokinside3• 9 years ago

There are several types of spoofing attacks and it's possible to use spoofing as type of jamming attack against military GPS units from a distance where pure jamming is not effective. Older receivers require lock into C/A code before moving to encrypted P(Y). The new M-code attempts to solve some of these issues.

The simplest form of GPS spoofing sends made up signals that misdirects the GPS receiver. Military equipment is protected against these kinds of attacks with authenticated signals. Carry-off attacks (satellite-lock takeover) start with broadcasting perfectly synced repeat of the original signal. This kind of attack can be used to make munitions and missiles to lose their signal lock in critical time.

It's also possible that there are multiple weaknesses and bugs in the military receivers that can be exploited.

Iranians were somehow able to trick RQ-170 drone to land on Iran.

When Iranians captured U.S. Navy patrol boat it was because there was mysterious navigation error.

krona• 9 years ago

Reminds me of the Iran–U.S. RQ-170 incident, when a CIA drone was captured by Iranian forces; one of the leading theories was GPS spoofing, although naturally Lockheed Martin denied that it was vulnerable to such a simple (for a nation state) attack.

banku_brougham• 9 years ago

Time to break out from storage: sextant, compass, paper map, ...

jdavis7033• 9 years ago

The Navy was a couple years ahead of you, they've already started training officers to navigate by non-electric means: http://www.npr.org/2016/02/22/467210492/u-s-navy-brings-back....

yborg• 9 years ago

The fact that they stopped at all astonishes me. In a military context, it's certainly conceivable that a ship would take some kind of battle damage that would disable its electronic nav systems.

Middies also used to learn how to sail with canvas, did they stop that, too?

fooker• 9 years ago

GPS goes wonky near the Kremlin, as every tourist knows.

jhayward11• 9 years ago

This is fairly old news. Reports are a year or two old and suggest that Russian security uses GPS spoofing anywhere V. Putin may be located, presumably as a defense against drone type attacks or surveillance. The spoofed location is often an airport. The black sea spoofing could be related to a visit to e.g., Sochi.

Alternatively Russia could be deploying the spoofers on ships now, which would seem to have offensive implications as well as defense.

(sorry, no links)

roywiggins• 9 years ago

Sounds like a semi-reliable Putin Detector could be set up if you wanted to...

jhayward11• 9 years ago

It would also be fairly short-lived in battle, since the spoofer is broadcasting its own location in a highly accurate "place ordnance here" manner.

delinka• 9 years ago

Let's think through that. In order to spoof GPS, you need to overpower the true GPS signal with your own. You put some transmitters in a location, and anyone attempting to get a GPS fix while in that location gets spoofed data and the wrong location.

Now, if you're close enough to get the spoofed signal, you're close enough to see Putin's entourage and know he's probably nearby. If you're not close, you don't get spoofed. So I'm uncertain of the utility of this Putin Detector.

adrianratnapala• 9 years ago

Yes, but the opponent will only see a largish region, probably [a few 1000 km big UPDATE: from other comments here, it seems the region can be much smaller], where the GPS is off and the opponent would usually already know his location to that precision.

Still it might be a worth-while excersise for the NSA -- not so they can target Putin. But to provide one more signal for when he makes some unexpected, hush-hush trip to some central Asian republic or some-such.

omgtehlion• 9 years ago

Can attest this. Area near Kremlin is spoofed to Vnukovo airport for several years already. There were reports about putin's dacha spoofed to the nearest aiport too.

I really do not know about reasons and efficacy. Professional grade multi-gnss receivers can easily filter this crap out, at least they could 5 years ago...

codedokode• 9 years ago

It is probably made against civilian drones. Otherwise there would be a lot of people flying over Kremlin just for fun and annoying security guards.

joering2• 9 years ago

But is it only Kremlin spoofing? I been to wisit DC/White House hoods many time and every time I had problem using google or apple maps. Signal was all over the place.

ortusdux• 9 years ago

Here is a CNN report on it http://money.cnn.com/2016/12/02/technology/kremlin-gps-signa...

They spoof no-fly zones to trick the drones that abide by them. It's hard to image building or retrofitting a surveillance or weapon drone and leaving limiters in place.

I first heard about it on a running forum but I cannot find the link. Apparently, joggers were getting an extra 20 km on their runs because of the spoofing.

knackery• 9 years ago

Where is the proof that Russia is behind all this?

oneplane3• 9 years ago

On the map probably. If you wanted to do this, it wouldn't be handy to do it in a country or for a country that actively scans for radio spoofing, jamming or illegal use of radio bands. Considering that out of all the countries nearby only one or two would have the means it's not hard to figure out would would want to do this.

oneplane3• 9 years ago

Not only old news as suggested in other comments, but not hard to do either; IIRC, this was done 1 or 2 DEF CONs ago, not only for GPS, but also for older systems that use radio beacons (Aircraft? not sure..) and A-GPS (spoofing GSM radios).

samstave• 9 years ago

http://www.rtl-sdr.com/spoofing-gps-locations-with-low-cost-...

oneplane3• 9 years ago

Yes! That's the one I was looking for. I guess going for 2014 or older wasn't going to get me the 2015 presentations ;-)

It is pretty effective in illustrating how easy it is to break such a system. Easy as in, you don't need a big nation state actor to do this.

technofiend• 9 years ago

Funnily enough I have a legitimate use for this: correcting GPS drift in a location with poor GPS availability. I would love to carry around a Raspberry Pi with an attached SDR that let me fine tune the signal so it's accurate versus showing me across the street, down the block or aimlessly wandering in circles.

anovikov3• 9 years ago

That is laughable and doesn't provide any kind of military utility. What is the value of spoofing GPS by putting everyone into the same point, with zero inferred velocity and acceleration vectors, while other data sources like inertial will easily tell the supposed victim this is all wrong?

Also, M-code can't be affected this way because it is encrypted, and military grade GPS receivers use virtual directed beams so they are next to impossible to simply jam, either.

jhayward11• 9 years ago

M-code encryption doesn't protect against rebroadcast, which is what this attack seems to be. And beam-forming has its own limitations which can be fairly easily overcome by signal strength. It may be that military mitigation involves defining a carefully circumscribed envelope of signal strength, checks against inertial references, alternative time sources, etc. But it's not trivial or laughable.

wyager2• 9 years ago

M-code contains time and ephemeris data, yes? (Since it's supposed to be "autonomous".) It seems like it would be quite easy to detect replay attacks.

stevefeinstein• 9 years ago

The takeaway I get from this is that whenever the Kremlin is attacked, they'd rather the nearby Airports take the hit.

I guess then no one will leave, and no one will come in.

netsharc• 9 years ago

Isn't it the other way? You're in your garden in Moscow but the GPS says you're thr airport. A missile heading for the airport will think "I'm on target!" as it lands on your head.

jorblumesea• 9 years ago

I feel like this also tips the hand of someone trying to track Vlad down. All you have to do is set up gps devices in/around major Russian areas (Sochi, Moscow), and when you start seeing anomalies, he's probably nearby.

dba7dba• 9 years ago

We may soon see 'inertial navigation system (INS)' to supplement GPS.

I wonder if the cost of producing/maintaining it could be lowered significantly enough using new sensors developed for use in smartphones and such.

radicaldreamer• 9 years ago

I wonder if this played any role in the recent Navy accident. It seems there were multiple safeguards which failed, but it would be very interesting if there were GPS issues as well.

http://www.cnn.com/2017/06/16/politics/us-navy-destroyer-col...

lisper• 9 years ago

Unlikely. The ACX crystal was traveling in a straight line for hundreds of miles before the collision. Just before the collision she made a slight turn to port in order to navigate a narrow straight. Her trajectory was entirely consistent with her destination. There's no indication she didn't know exactly where she was. (And I mean that literally: the ship knew where it was. The evidence indicates that the crew was asleep.)

Reference: http://blog.rongarret.info/2017/06/theres-something-very-odd...

ericcumbee• 9 years ago

Wasn't this part of the plot to "Tomorrow Never Dies"?

Ships fooled in GPS spoofing attack suggest Russian cyberweapon

Related Stories