Hacker News Reader

Comment by AWildC182 | Hacker News Reader

And with WAAS, the world is moving towards GPS approaches anyway. Even without careful planning anyone with a mildly powerful VHF radio and a yagi antenna can jam ILS, VORs and ATC comms rather effectively and has been able to since the end of WWII.

I've seen these articles pop up a few times in the past couple days but everyone in aviation already knows that there isn't any security on this stuff. People even jam ATC for giggles sometimes[1]. There's enough redundancy that nothing bad has happened as a result so everyone goes on with life. I think this is just low hanging defcon fruit targeting non aviation-aware readers.

[1] https://www.youtube.com/watch?v=ZvA_-linhg8

View on HN

> People even jam ATC for giggles sometimes.

Or impersonate. One of my pilot friends was planning a trip across the CA Central Valley, and he reported with some bemusement that there was at active NOTAM (NOtice To Air Men) to be on guard about some guy in the Fresno area that was impersonating ATC. Apparently it had been happening for months and nothing much by way of investigation had taken place.

At this point I pretty much concluded that bad Part 15 devices or PG&E power line noise h0rk1ng over my ham radio reception was not going to get any attention, ever, if the FCC can't be bothered to find an ATC impersonator. I mean really, there are hams that do hidden transmitter hunts purely for sport. A posse of them could find that clown easily on any random Saturday morning and not be late for lunch.

> there are hams that do hidden transmitter hunts purely for sport. A posse of them could find that clown easily on any random Saturday morning and not be late for lunch.

So why don't they?

What is a bunch of random nerds going to do? They have no power to fine or arrest. All they can do is document the evidence and turn it over to the FCC, which does happen on occasion. But, I have listened to ARRL division directors talking about trying for years to get well-documented egregious cases of malicious interference dealt with by the FCC. The FCC just can not be bothered. It's not so much that they can't be bothered to collect evidence, which they can't, but even if they have evidence, that can't be bothered to act on it. The FCC should be a technical organization but is pathetically political.

One of my ham friends deals with the FCC often, because he works in spectrum management at the NTIA. The stories he tells make me never want to set foot in D.C. except to visit all the museums that my taxes fund.

No power to fine or arrest isn't entirely true.

What stops them from finding who's transmitting and then filing a civil suit?

They keep telling you that the FCC has the power to do it but does not have the political will.

You need to get the community organised for a hunt. I recall one that happened when a rogue retransmitter managed to spill religious radio onto TWR2 frequency at local Airport

You're assuming it would broadcast long enough to find the station, not a hit and run operation. And even if there was a constant signal, they could be using a repeater.

The T-hunting game is usually pretty spicy, with intermittent transmissions and propagation hacks. A repeater adds no difficulty at all.... just DF the input of the repeater.

Or impersonate indeed [0]

[0] https://www.youtube.com/watch?v=7WKZNGisSqM

Username checks out :)

Ars technica cited a researcher at Northwestern that said GPS isn't necessarily a perfect fallback

> One reason: the types of runway misalignments that would be effective in a spoofing attack typically range from about 32 feet to 50 feet, since pilots or air traffic controllers will visually detect anything bigger. It’s extremely difficult for GPS to detect malicious offsets that small. A second reason is that GPS spoofing attacks are relatively easy to carry out.

https://arstechnica.com/information-technology/2019/05/the-r...

Can't you override GPS too? I thought that was part of the exploit chain that netted Iran a stealth drone.

The Iran thing is dubious. If they did pull it off it required state level resources. Eventually it might be possible with commercial hardware but there isn't a lot of cheap stuff on the market that can generate the frequencies needed at the requisite power. It's worth noting that while the real GPS signal is very weak, the antennas that receive it are on the top of the plane and are somewhat directional. The receivers also have some minimal integrity checking capability IIRC.

This is not to say it's impossible, but with the current stuff on the market and required software investment I'd put it at an order of magnitude or two higher execution complexity than grabbing a VHF radio and messing with ILS beams.

> The Iran thing is dubious. If they did pull it off it required state level resources.

The Islamic Republic of Iran, by definition, has state level resources. In addition to their own resources, they have close ties with Russia and China. I agree with your ballpark of an order of magnitude higher complexity than messing with ILS, but that's well within Iran's capabilities.

Most of the dubiousness I've seen is wrt the fact that the DoD claims that RQ-170's use inertial guidance and terrain following since GPS is so easily gamed (jam encrypted ranges, spoof civilian ranges). Even the DoD claims that a GPS attack itself is easy.

Of course none of the DoD's version of events explains why then Iran has a mostly intact RQ-170...

I've already taken over GPS (not jam, emulate all 12 sattelites for a takeover) in a dummy load environment (large paint can grounded). It was with a ADALM-Pluto. Tx was only 5mW but I could easily build a multistage amplifier and filtered appropriately.

Why dont I? Its illegal and its ethically wrong, and its not my focus of study.

I concur.

Generating the requisite signal is easy to do with opensource code and just $200 or so of equipment.

I bet the drone didn't use the military encrypted GPS because they didn't want encryption keys to fall into the wrong hands (they're global), or just because the effort to load the new GPS keys every week was too much, The attackers just jammed and then spoofed GPS, and by providing a very strong signal, any kalman filters designed to merge signals from inertial units would be fooled.

> The Iran thing is dubious. If they did pull it off it required state level resources.

https://www.cnet.com/news/truck-driver-has-gps-jammer-accide... (Truck driver has GPS jammer, accidentally jams Newark airport)

I get banner ads all the time on slashdot for enterprise GPS ‘testing’ gear.

There are a couple of very interesting articles on GPS spoofing. Not only is it doable [0] but there are some interesting cases that most people don't really think about. Consider that GPS is often used as a timing signal by various financial entities (including stock exchanges). If you override the legitimate GPS signal (not a lot of power required as you'll be much closer to the receiver) and introduce a small deviation into the timing signal you can create some very interesting (and profitable) effects in the stock market. [1]

Even introducing an error into the system can cause disastrous effects [2]

[0] https://arstechnica.com/information-technology/2018/07/a-225...

[1] https://radionavlab.ae.utexas.edu/images/stories/files/paper...

[2] https://blog.themistrading.com/2012/07/could-gps-spoofing-ca...

Jamming is relatively easy. Spoofing is a bit harder.

Reply on news.ycombinator.com