Hacker News Reader

Comment by monocasa | Hacker News Reader

Can't you override GPS too? I thought that was part of the exploit chain that netted Iran a stealth drone.

The Iran thing is dubious. If they did pull it off it required state level resources. Eventually it might be possible with commercial hardware but there isn't a lot of cheap stuff on the market that can generate the frequencies needed at the requisite power. It's worth noting that while the real GPS signal is very weak, the antennas that receive it are on the top of the plane and are somewhat directional. The receivers also have some minimal integrity checking capability IIRC.

This is not to say it's impossible, but with the current stuff on the market and required software investment I'd put it at an order of magnitude or two higher execution complexity than grabbing a VHF radio and messing with ILS beams.

> The Iran thing is dubious. If they did pull it off it required state level resources.

https://www.cnet.com/news/truck-driver-has-gps-jammer-accide... (Truck driver has GPS jammer, accidentally jams Newark airport)

I've already taken over GPS (not jam, emulate all 12 sattelites for a takeover) in a dummy load environment (large paint can grounded). It was with a ADALM-Pluto. Tx was only 5mW but I could easily build a multistage amplifier and filtered appropriately.

Why dont I? Its illegal and its ethically wrong, and its not my focus of study.

I concur.

Generating the requisite signal is easy to do with opensource code and just $200 or so of equipment.

I bet the drone didn't use the military encrypted GPS because they didn't want encryption keys to fall into the wrong hands (they're global), or just because the effort to load the new GPS keys every week was too much, The attackers just jammed and then spoofed GPS, and by providing a very strong signal, any kalman filters designed to merge signals from inertial units would be fooled.

Most of the dubiousness I've seen is wrt the fact that the DoD claims that RQ-170's use inertial guidance and terrain following since GPS is so easily gamed (jam encrypted ranges, spoof civilian ranges). Even the DoD claims that a GPS attack itself is easy.

Of course none of the DoD's version of events explains why then Iran has a mostly intact RQ-170...

I get banner ads all the time on slashdot for enterprise GPS ‘testing’ gear.

> The Iran thing is dubious. If they did pull it off it required state level resources.

The Islamic Republic of Iran, by definition, has state level resources. In addition to their own resources, they have close ties with Russia and China. I agree with your ballpark of an order of magnitude higher complexity than messing with ILS, but that's well within Iran's capabilities.

There are a couple of very interesting articles on GPS spoofing. Not only is it doable [0] but there are some interesting cases that most people don't really think about. Consider that GPS is often used as a timing signal by various financial entities (including stock exchanges). If you override the legitimate GPS signal (not a lot of power required as you'll be much closer to the receiver) and introduce a small deviation into the timing signal you can create some very interesting (and profitable) effects in the stock market. [1]

Even introducing an error into the system can cause disastrous effects [2]

[0] https://arstechnica.com/information-technology/2018/07/a-225...

[1] https://radionavlab.ae.utexas.edu/images/stories/files/paper...

[2] https://blog.themistrading.com/2012/07/could-gps-spoofing-ca...

Jamming is relatively easy. Spoofing is a bit harder.

Reply on news.ycombinator.com