Researchers Mount Successful GPS Spoofing Attack Against Road Navigation Systems | Hacker News Reader

Researchers Mount Successful GPS Spoofing Attack Against Road Navigation Systems

bleepingcomputer.com

67 points0xbxd48 comments

GPS messages are not cryptographically signed so of course they can be spoofed. Who designed these things?

GPS messages for civilian use are unencrypted. The US Military has access to another set of signals that ARE encrypted.

Can still be jammed of course, but hacking GPS was the plot of the Bond Film "Tomorrow Never Dies", where Rupert Murdoch attempts to instigate a global war to sell more newspapers

Signing messages is completely separate from encryption.

Also there is no longer separate quality gps for military vs civilian use:

https://www.cnet.com/news/celebrating-10-years-of-gps-for-th...

Fair point on signed vs encrypted, I was simply pointing out that the ordinary civilian GPS isn't all there is.

And while that L1 GPS signal has had selective availability turned off, that can always be turned back on again. Plus, using the military parts of L2 GPS in combination with L1 do give a higher accuracy than civilian GPS units can achieve.

Navstar claimed that this would not be possible anymore, but I find that hard to believe.

There is presently no difference in accuracy between military and civilian GPS signals. The civilian / unencrypted stream is no longer intentionally degraded, as it once was (via "Selective Availability").

But there are still multiple datastreams, and the military one is still encrypted, and the military retains the ability to degrade or disable or degrade the civilian/unencrypted signal if circumstances require it, although it is hard to imagine a circumstance where this would be desirable, given the proliferation of civilian GPS receivers among military personnel, disruption to civil aviation / airlift capability, etc.

The military GPS signal from the Block III satellites is called "M-Code":

https://en.wikipedia.org/wiki/GPS_signals#Military_(M-code)

Selective availability is no longer available on newer satellites. I assume they can still shut off the stream though.

Crappy firmware could ignore signatures but would definitely notice if no key could be found to successfully reverse mandatory encryption.

I don't think this is really news. Anyone with an SDR good enough could easy replicate and alter GPS signals. Since the satellites are so far away, spoofing and jamming are simple affairs. You could affect GPS for miles with something you can carry in your pocket.

You can see a crude form of this around tall buildings. Multipath from large structures is enough to "spoof" GPS by hundreds of meters.

The novel part here is tacking on the map data to only generate malicious instructions that are plausible. Not a massive hurdle but not something you do in an afternoon either.

In the sixties a system of wires buried in the centre of the road lanes was invented to guide autonomous vehicles.

they could have specific signals injected to specify what road and what lane etc

This would be a far more robust and simpler way of achieving autonomous vehicle use.

Sounds like an installation and maintenance nightmare. Something like identical rfid chips could provide similar data, and you could simply scatter a handful into the asphalt as it is poured. Or only put chips whenever the road diverges from a straight line

This sounds somewhat impractical, heres some reasons why:

1. Concrete and asphalt significantly attenuate radio signals, especially reinforced concrete.

2. Both concrete and asphalt expand and contract, and would likely damage the chips.

3. Asphalt isn't exactly solid at all times, compounding the issue above.

4. Reading said chips would be difficult, as they would only be in range for a few tens of milliseconds.

Good point on #1 & 4, it'd have to be really near the top, and would need super fast read speeds; although #2+3 would be non issues if properly encased.

Crazy idea: turn road stripes into magnetic tape, encode the data and read it like a tape player :P

You could probably get away with optical encoding, just paint a barcode down the center.

Until a deer is hit by the vehicle, or somebody loses a bucket of paint from the rear of their truck.

Regarding #4, I know RFID chips and readers are used for positioning in the Helsinki subway, but I don't know if they have some kind of special antennas allowed by the tracks and the long cars.

Possibly also Eurobalise? [1] The Berlin S-Bahn's ZBS (basically "tram") also uses it. But the U-Bahn ("metro") isn't mentioned, and no metro system is mentioned on that Wikipedia page. So I suppose it is some kind off underground variant?

[1] https://news.ycombinator.com/item?id=17548552

I don't know if Eurobalise is based on RFID. Here's some more public info on the Helsinki RFID case: "rugged, intelligent and innovative turnkey solutions for railroad infrastructure providers and train operators based on passive Gen2 RFID technology." https://turckvilant.com/success_story/helsinki-metro/

And here's a reverse system where the track identifies the passing wagons: https://turckvilant.com/success_story/running-at-250km-h/

Re: #4, this type of technology is already in use for trains and works at speeds of up to 500 km/h. Of course those are always perfectly aligned.

https://en.m.wikipedia.org/wiki/Eurobalise

Very cool -- I was not aware of this.

It's interesting that RFID developed out of, partly, a desire by freight train operators to track traincars as they moved around switching yards (moving past fixed readers). The Eurobalise system is sort of the reciprocal of that idea.

Definitely just throwing RFIDs into the asphalt would be inefficient.

They could instead be mounted on the lane-separation poles / walls, on the cat-eye embedded marks, and other things that are installed on the road anyway, and have a good protection and line-of-sight.

Putting an RFID chip into the lane reflectors / raised pavement markers seems like it would be a good step, and could be useful both to autonomous systems and driver-assist / navigation systems. I doubt it would add a significant percentage to their cost.

The nice thing is that you really don't need to use any intelligence when placing the markers. They could be permanently set with a random GUID at time of manufacture, and then just installed in the road. After installation, someone (e.g. Google Maps car or crowdsourced project) could drive the road and cross-reference the RFID GUIDs to their actual location.

A metal strip laid along the intended path would be a more elegant, scalable method. We already have the means for producing bulk steel extrusion, and it would be a simple enough matter to have a vehicle follow a strip like that. Simply lower a cam follower to near-ground level, and let the mechanical forces do the steering for you.

Of course, you could opt for multiple strips with convex upper surfaces, and wheels with concave ones, such that you obviate the need for a cam follower - gravity provides the forces needed to center a wheel along its guidance strip.

If you wanted to bring an Uber/Lyft/Didi model into this, you'd have multiple riders sharing the vehicle (netting them a lower fare, of course), and the conveyance would make several stops along the way. It's true that this might not offer door-to-door convenience, but apparently Uber et al have had success with getting their riders to walk short distances to catch their rides, so we know that it's a viable business model.

I've been sitting on some of these ideas for years. Send me your VC contacts, I'd love to get in touch.

If you expose the metal strip you could use it as a power rail for electric cars, too! Although that would leave your highways being potentially deadly to walk on...

Edit: Also if you're using shaped wheels to guide the car along the road, I think we've just reinvented the tram.

That's the point, this is a tram. Autonomous electric mini-trains would be far better than whatever we have today and will have in the near future.

I quite like trams (especially those from my home town[1]), but there's nothing simple about installing a continuous metal strip on every road. They were replacing an intersection of tram lines near where I lived in Brussels, and it took them over six months for the whole process, with tremendous disruption for the whole area.

[1] https://www.lisbonlux.com/images/transportation/rua-augusto-... https://st.depositphotos.com/1000848/4380/i/950/depositphoto...

Trams with regular tires work just as well as trams on tracks, and can follow electrical wires above ground. Many electric city buses and trams operate this way.

There are quite a few methods that could be employed to guide vehicles, from overhead lines, to hip-level rails, to infrared, electrical and magnetic buried lines, and so on.

The reason we don't implement them is the public doesn't want to invest in public transit because they prefer driving their inefficient dangerous polluting cars.

You still need a driver to stop when someone runs out in front, which means you're not going to be running at a 2 minute frequency in every direction.

Here is a classic clip from the 1970's as to where the future was going to be:

https://www.youtube.com/watch?v=_ATNdGVpH8A

Wires under the road to message drivers and roadside transmitters never caught on but a lot could be done with very basic electronics.

"Researchers Mount Successful Attack on Navigational Wires Buried Under Roads Using Commonly Found Garden Implements"

No more than likely that’s attacks on fiber optic cables near roadways. Anyhow, I think the plan is to put it beneath the road surface.

If you're fine with physically digging up roads in order to cause car crashes, you can do that regardless of whether the vehicles on them are autonomous or not...

Is this applicable to aircraft?

Yes, but you can also navigate via radio beacons, or by simple map and protractor if you really had too.

Obviously, planes took off and landed just fine for many years before GPS was invented / released to the public.

Ironically the incident that caused it to be released was flight KAL 007 from Anchorage to Seoul. Plane misnavigated into Soviet airspace and was shot down. A congressman aboard, plus about 200 others, were killed.

You can also navigate a car using a map. The point of a spoof is misdirection.

I'm pretty sure you could replace a paper map in a car with a fake paper map. Analog spoofing.

Someone hacking your paper, in person, means you have much larger problems.

Most hacks rely on attacks of scale. They don't care about you. They care about some percentage of "you" that makes their hack work.

Of course, the very hacking has changed significantly since I started years ago. It used to be about exploration and investigation - it was much more akin to trespassing than anything else.

Now, it's about making money and influence control. That saddens me.

Analog DOSsing in WW2:

https://www.iwm.org.uk/collections/item/object/205019014

"A signpost in Surrey being dismantled as part of a campaign to remove everything which may prove of value to the enemy, should invasion occur."

Or by a system of giant arrows on the ground

https://www.citylab.com/life/2015/02/why-is-america-dotted-w...

Yes. Its possible, not only in research settings but it has been used for real. Remember that US drone that Iran claimed it captured after it violated it's airspace, which Obama then denied only to later confirm it was captured and asked it back.

https://en.wikipedia.org/wiki/Iran%E2%80%93U.S._RQ-170_incid...

It's been captured by this attack. So, great that researchers in the west can now demonstrate it for civilian technology. But news it is not. Not to me at least.

Note that the GPS spoofing is Iran's claim, and has never been proved. I find it highly dubious, since for military aircraft the primary navigation device is an Inertial Navigation System (INS). If in the case of a large departure between INS and GPS data the drone chooses to rely only on GPS only, then it is grossly, almost negligently ill-designed for military operations.

That said, GPS spoofing against civilian drones that do rely on GPS only has been consistently demonstrated and published in the literature, see https://doi.org/10.1002/rob.21513 or https://doi.org/10.1016/j.ifacol.2016.10.412 for interesting examples. Here's a demo video of the first paper: https://www.youtube.com/watch?v=6qQXVUze8oE

Again, relying purely on GPS and inertial sensors is foolhardy.

There's 2 hemispheres we could navigate with: land, and stars. I know the old Minutemen missile controllers used a CCD and massive lens to do dead reckoning for steering. (Yes, a friend has a said minutemen missile controller board).

But we need to get away from this 'lets rely on a tech that can be hacked'.

Didn't know about the Minuteman, but I know that the SR-71 featured an astroinertial navigation system that indeed used the stars for correcting the inertial data: https://timeandnavigation.si.edu/multimedia-asset/nortronics...

ICBMs and SLBMs use primarily inertial navigation (with a starting position provided from the launch facility); the stellar navigation systems correct it by adding a mid-course position fix.

I do not know for sure, but I would be willing to bet, that the missiles are capable of reaching their target with reasonable accuracy in the absence of the mid-course stellar fix, since in a nuclear war with enough exo-atmospheric detonations, it might not be possible to visualize the fixed stars at the right time (and a requirement to do this would be an obvious vulnerability for a missile defense system, e.g. you could hit the missile with a laser from a space platform at the right moment and spoof the stellar nav system).

Agreed and the more informed speculation about the RQ-170 that I have read is very skeptical of the Iranian GPS-spoofing story. The RQ-170 supposedly has at least doubly-redundant, possibly triply-redundant, position-fixing systems, and it seems nearly impossible that GPS failure or spoofing wouldn't have been anticipated in the design.

Some have suggested that the aircraft might have crashed for other reasons and been recovered by Iran, and the GPS spoofing story is propaganda on their part in order to explain how they came into possession of it.

I suspect we will not know the real story until all the documents are declassified at some point in the future.

http://aviationintel.com/iran-says-it-spoofed-the-rq-170-sen...

While the others are talking about that yes you can fool aircraft I must also add that in training Dead Reckoning (looking at the ground) is extremely enforced. There are definitely people that become lazy and just rely on their GPS, but routes are planed ahead and generally people will circle some objects along the way that they are suppose to see. The point is that you want redundancy. You're in a plane, you better know where you're going, how far you got left, and if you can make it to an airport (or your alt).

That's also how it was done before GPSs were available. That and different types of radio beacons.

Reply on news.ycombinator.com