Hacker News Reader

Comment by jgrahamc | Hacker News Reader

So, they spoofed GPS and jammed the rest of the communications to make it land automatically. Given that there are test transmitters for GPS devices used when consumer devices are being created it's not a surprise that they managed to do this. Not very long ago there was a GPS jamming exercise in the UK done on a military range.

I realize that as a Westerner I shouldn't be rooting for the Iranians but if they did spoof GPS, jam the rest of the communications and get this thing to land thinking it was at its home base then it's at least a neat hack.

Also, in the article there's a quote from someone dissing the Iranians' technical ability. This seems like a mistake. Iran is not a 'stone age' country like Afghanistan.

View on HN

Hmm, the GPS signal the military uses is supposed to be encrypted and un-spoofable.

I wonder if Iran cracked it. If so, can the US reset the key easily?

[1] http://en.wikipedia.org/wiki/GPS_signals#Precision_code

Maybe there's a safety fallback to normal GPS when the encrypted GPS goes out. The alternative would be no GPS at all in which case they'd need to send an actual human in to shoot it down or capture it.

The P code is on a different frequency, so the Iranians could have just jammed the P code, and then presumably the drone would rely on the the unencrypted C/A code which they spoofed.

Sigh..

I hope it was not that insecure.

All of the military GPS receivers also use the civilian signal to initialize their position to lock on to the military encrypted signal. I would assume that in the event that they lose the P code, that they would revert to the C/A code.

Still a horrible security design if that is the case.

Simply jamming something should not by-pass an authentication mechanism.

If a human being lost GPS signal, they'd start using landmarks, or based on their last known position, just use dead reckoning to get over friendly airspace, then ask for help. Programming that into a drone takes time and so costs money. Maybe the drone was the victim of cost cutting?

I don't know their actual hacking mechanism, but a replay attack could be done such that valid but incorrect GPS data is sent to the drone. The gist of it is that one records signals coming from GPS satellites and retransmits them. It could be transmitted with enough power to drown out any signal from actual GPS satellites.

There should be a time component in the signal that wouldn't match the internal clock, but maybe enough satellites saying the same thing would trigger a self correction... or it would disregard all GPS data.

Time is literally what GPS satellites are broadcasting.

Yep: "Radio waves are electromagnetic energy, which means they travel at the speed of light (about 186,000 miles per second, 300,000 km per second in a vacuum). The receiver can figure out how far the signal has traveled by timing how long it took the signal to arrive." - http://electronics.howstuffworks.com/gadgets/travel/gps2.htm

you don't have to understand a signal to jam it.

unless it also has frequency hopping when it senses a jam.

how would the satellite in space detect a jam on the ground ? we're talking gps jamming. state your source

I think there is no need to hack the signal. It can be done by capturing and delaying signals. What you need for that is

1) the location of satellites. You can probably get it from the commercial signal.

2) transmission system, which overpowers signals from satellites. Many amateurs have it too.

3) location of the receiver you want to distract. I have no idea, how this works, but apparently it is possible.

4) program that calculates right delays for each signal so that plane will locate itself incorrectly.

Maybe the droid was programmed so, that GPS overrides other locationing devices, if it is working and the droid thought that GPS was working.

As jgrahamc says: "I realize that as a Westerner I shouldn't be rooting for the Iranians but if they did spoof GPS, jam the rest of the communications and get this thing to land thinking it was at its home base then it's at least a neat hack."

http://en.m.wikipedia.org/wiki/Replay_attack

I'm not sure, if I'm thinking this way too simply, but I don't think any of those countermeasures work in this case. I don't know, if satellite gets signals from GPS-device (I don't think so), when using military signal, but anyway it will get exactly the same signal, as it would get in non-disturbed system. Similarly the droid will have exactly the same signal from satellite, only delayed.

When commercial GPS-devices begin to locate themselves, they need four satellites for the process: Three for the coordinates and one for time. I believe, that military system works the same way. If you cut down the signals for a while, the droid will, when the signal (delayed one) comes back, maybe adjust it's clock a couple of 1/10000ths of second to get GPS-locationing back in business. And after that the signal transmitter decides, where the droid will fly.

Many guesses here, but this is just one suggestion free for discussion, how the system might work...

The chances of this machine relying completely on GPS for navigation is closer to none than slim.

I'm not saying the article is completely wrong, just that it's probably missing a giant part of what happened.

You are likely correct. I doubt it relies on GPS for complete navigation, but it might rely on GPS to correct drift in an inertial system in which case if you spoofed GPS a little bit for a while (hours?) you might be able to trick the drone into thinking it was somewhere near where it should have been.

Given that Iran and Afghanistan have a border and the Iranians say it was captured in the NE of Iran then it's not impossible that they simply managed to get it to drift off course into their territory and land.

If course it is missing a giant part of what happened. Do you think the Iranians would tell about all aspects of it to a newspaper?

Not very long ago there was a GPS jamming exercise in the UK done on a military range

I am on The List for notification of these exercises, and they are happening with increasing frequency. Someone has decided that a GPS denial scenario is looking probable and is preparing accordingly.

There is some more information on GPS jamming at http://www.ausairpower.net/TE-GPS-Guided-Weps.html.

Reply on news.ycombinator.com