GPS Spoofing on aircraft transiting Middle East – an update
ops.group
ops.group
I don't follow - is the spoofing done by someone on the plane, by other aircraft, by satellite, or some other way?
Is there ever a risk that a plane can be caused to crash by fooling its GPS (what will it do if acc. to GPS there is a mountain ahead?)
Also, what is the risk that similar spoofs will send self driving cars into crowds of people?
(My background: Can fly a lite-plane. Have read this [highly recommended] - https://ciechanow.ski/gps. Neither helps. Please ELI5.)
I can't speak for much simpler smaller aircraft with e.g. 2 or 4 seats. They may well have only GNSS to rely on. However, if you are at any point unsure as to where you are exactly, you can always try to grab a VOR-DME radial or the intersection of 2 VORs.
The IRUs are aligned and fixed to a position before the aircraft is even pushed back from the gate (you cannot align and fix them while moving). What conventionally happens is that you tell the FMS what airport you're at, and it knows the coordinates for that airport. You also tell it what gate you're at, and it usually knows the coordinates for that gate. It will also show you what it thinks your current GNSS position is, and then you pick one of these as your IRU starting point -- usually the gate, but sometimes the GNSS receiver position. One would hope that the pilots would visually validate that the GNSS receiver position is very close to the airport position before entering that into the IRU.
If, in the air, you have 2 or 3 IRUs all in agreement with each other, and telling you that you're at position X within an uncertainty of, say, 1 nautical mile, and you also have a GNSS receiver telling you that you're at position Y, and Y is greater than, say, 10 nautical miles away from X, then the GNSS receiver is obviously wrong and should be ignored.
IRUs are not perfect, but they are certainly accurate enough to get you to where you need to be, unaided.
I find it bizarre that the aircraft systems would ignore perfectly functional IRUs that are in agreement with each other, or, even worse, use (potentially hostile) GNSS data to "correct" them. In the absence of this "correction", the IRUs are completely tamper proof; there is simply no way, without being on the aircraft in question, to get them to say anything different.
Jamming GPS seems easy, like many countries could do. Spoofing GPS seems fairly complex. And causing the GPS to show a stationary location while moving seems closer to a large nation-state capability that maybe they've sold to some partners to test in the region.
I sense the purpose is to get airplanes to cross borders without authorization so they could be forcibly led to land and hostages could be captured (not about causing them to crash). The regions highlighted in the article cover a large region that the ME3 use to run the European and American flights.
Spoofing is harder. Again, the downlink protocol is well known and unencrypted.
But for receivers, it's easy to simply say that you will ignore all transmissions that are too close to the horizon -- say 15 degrees or so. That should eliminate all ground-based spoofing attacks. Antennas that can do this can be bought commercially and are not ITAR restricted, and probably only cost about a thousand dollars or so. Additional capabilities beyond just ignoring signals too close to the horizon gets you into military grade technology, and is likely to be ITAR restricted, and cost tens of thousands of dollars per antenna -- or more.
Tallysman is a well known vendor for GNSS antennas, including some that have the ability to ignore signals too close to the horizon. Check their catalog.
When a GPS receiver gets a lock, it should normally see something like about ten satellites at the same time (if it has a clear view of the skies). You only need four to get a lock on your position, and the others can be used to help narrow down the error in your great circle calculations. If you're a full multi-band GNSS receiver (GPS, Galileo, Glonass, BeiDou, QZSS, IRSS, etc...), you might see dozens of satellites all at once, and be capable of tracking 500 or more simultaneous satellites.
Of course, we're not talking about GNSS position augmentation systems like WAAS, or GNSS RTK systems. That's a different set of methods for detecting errors in the GNSS signals that are sent from the satellites and then transmitting those corrections via another medium or frequency band, so that receivers can get much more accurate position calculations -x to the centimeter or better.
For each satellite you track, you can detect or calculate their azimuth and right ascension, which is their polar coordinates relative to your location.
Each of the satellites is numbered within their own constellation, and the GNSS protocols have each satellite transmitting the almanac information that tells you where all the satellites are (roughly). So, if you see GPS-17 suddenly transmitting from a new location that doesn't match the almanac, you can ignore it.
Likewise, the strength of each signal can be relatively easily calculated, based on location and distance, so even if you see GPS-17 transmitting from roughly the right location but with a much stronger signal, then you can ignore that.
Beyond that, each antenna is an analog device, and therefore has a unique transmission fingerprint. If you see GPS-17 suddenly transmitting from roughly the right location with roughly the right signal strength but the transmission fingerprint has changed, then you can probably safely ignore that. Of course, they do sometimes change out satellites, so a change in transmission fingerprint might be legitimate, but that's a relatively rare occurrence, and they don't change out all the satellites at once.
If you're going to be successful at spoofing, you're going to have to have your transmitters aloft. They're going to have to know the full almanac of the satellites they're spoofing. They're going to have to know the location of the target you want to spoof. They're going to have to calculate what position(s) they need to be in so that their signal comes from roughly the right direction and velocity relative to the target. They're going to need to be able to calculate what signal strength they should be broadcasting with so that they don't seem suddenly much louder or much weaker. And then I have no idea how they would replicate the transmission fingerprint of another antenna, but I guess they have enough time to study the problem and come up with solutions.
So, jamming is relatively easy. But true spoofing all the way down the line, that is pretty tough. I'm sure that at least some nation states can do it, and they're probably using some classified tools that have been developed by some companies, so presumably those companies could also do it.
But it's not easy.
Frankly, I'd be more concerned that someone could breach the uplink control-plane protocol for the satellites and cause them to actually move to other locations or otherwise take over part or all of the constellation and do other things with them.