Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ships fooled in GPS spoofing attack suggest Russian cyberweapon

newscientist.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: Ships fooled in GPS spoofing attack suggest Russian cyberweapon

#71

Post by jhayward »

PhantomGremlin wrote: post #70
jhayward wrote: post #23

Earlier quoted context omitted.

The question is: match with what? Part of the GPS calculation is to figure out what time it is. There is no reference needed other than what the satellites broadcast. If you are rebroadcasting the entire GPS signal it includes all of the satellites, and will be self-consistent. Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so. If the receiver has som…

Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so. That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there. If the receiver has some sort of out-of-channel time reference…

> That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there.

I made a mistake in ambiguously referring to two things: processing delay at the spoofer, and speed-of-light based time difference between spoof signal and direct broadcast at the receiver.

However, I'm not aware of any crystal based clocks that are suitable for high dynamic range G environments that would be easy to use as an independent reference for any reasonable amount of time. They all suffer in shock/vibration conditions, and need external conditioning to maintain longer term stability. Maybe the military has 'em, but I guarantee they cost a lot more than a GPS rec.eiver

Re: Ships fooled in GPS spoofing attack suggest Russian cyberweapon

#72

Post by anovikov »

PeterisP wrote: post #67
wyager wrote: post #39

Earlier quoted context omitted.

M-code contains time and ephemeris data, yes? (Since it's supposed to be "autonomous".) It seems like it would be quite easy to detect replay attacks.

The receiver likely doesn't have an accurate enough clock to reliably detect a quick (a tiny fraction of a second) replay attack if it can't hear the original transmitters due to intentional interference; most GPS systems would treat any differences between internal time and the time from the GPS data as a sign that their clock is drifting and needs to be adjusted, and it should be that way because their clock is ina…

Let's see: if the transmitter of spoofing signal is 3km away from the received (less than meaningful minimum - 3km distance is easily covered on inertial alone with no precision loss) it means 1us error. On 30km, 10us error. Is that really hard to have clock that precise on a receiver?

Re: Ships fooled in GPS spoofing attack suggest Russian cyberweapon

#73

Post by PeterisP »

anovikov wrote: post #72
PeterisP wrote: post #67

Earlier quoted context omitted.

The receiver likely doesn't have an accurate enough clock to reliably detect a quick (a tiny fraction of a second) replay attack if it can't hear the original transmitters due to intentional interference; most GPS systems would treat any differences between internal time and the time from the GPS data as a sign that their clock is drifting and needs to be adjusted, and it should be that way because their clock is ina…

Let's see: if the transmitter of spoofing signal is 3km away from the received (less than meaningful minimum - 3km distance is easily covered on inertial alone with no precision loss) it means 1us error. On 30km, 10us error. Is that really hard to have clock that precise on a receiver?

Yes, it is quite hard - standard oscillators used in electronics can easily drift up to a second a day (we don't notice because many devices update their time from GPS signal or cell data), and even really good ones will still drift for a millisecond quite quickly and it definitely can't rely on accuracy measured in us.

For getting such an accuracy, IIRC, at the very least you'd need a temperature-controlled environment (so, not feasible in mobile devices) because the standard approaches will be slightly faster/slower depending on temperature.

Re: Ships fooled in GPS spoofing attack suggest Russian cyberweapon

#74

Post by PhantomGremlin »

jhayward wrote: post #71
PhantomGremlin wrote: post #70

Earlier quoted context omitted.

Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so. That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there. If the receiver has some sort of out-of-channel time reference…

> That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there. I made a mistake in ambiguously referring to two things: processing delay at the spoofer, and speed-of-light based time difference between spoof signal and direct broadcast at the…

They all suffer in shock/vibration conditions

Interesting. I didn't know that.

There's a comment on another thread that someone just made: https://news.ycombinator.com/item?id=15007006

And now you can buy a genuine atomic wristwatch.

Here's a few sentences from the linked website: In each atomic physics unit is a small vessel of Caesium 133, an oven to heat it to 130°C, a laser to excite the atoms and a microwave resonator that resonates at the hyperfine transition frequency of the atoms, 16,546,737,186,000 vibrations per hour, with an accuracy of one 5 parts in 10-11. https://www.hoptroff.com/pages/about-us

The same shock/vibration limitation probably applies to it. Still, it exists! I think. I wouldn't spend that much money to find out if it was real.

Re: Ships fooled in GPS spoofing attack suggest Russian cyberweapon

#75

Post by anovikov »

PeterisP wrote: post #73
anovikov wrote: post #72

Earlier quoted context omitted.

Let's see: if the transmitter of spoofing signal is 3km away from the received (less than meaningful minimum - 3km distance is easily covered on inertial alone with no precision loss) it means 1us error. On 30km, 10us error. Is that really hard to have clock that precise on a receiver?

Yes, it is quite hard - standard oscillators used in electronics can easily drift up to a second a day (we don't notice because many devices update their time from GPS signal or cell data), and even really good ones will still drift for a millisecond quite quickly and it definitely can't rely on accuracy measured in us. For getting such an accuracy, IIRC, at the very least you'd need a temperature-controlled environm…

There are atomic clocks that weigh only about 35 grams. They cost $15K though, so probably too expensive for munitions, except nukes, but fine for aircraft and ships, and probably for some land vehicles. Having ±5.0E-11 accuracy and Even OCXO will be enough given short duration of stay in a spoofed environment (typical OCXO will give you 50 seconds, but it is more than enough time to be within 300 meters from a spoofer, unless you are on foot). Or 500 seconds within 3000 meters, which is same speed - 6 m/s - which you have to maintain to be able to filter out spoofing. Several times more in practice because these are all RMS, not max errors. But 30 m/s is 5 sigmas which is military (nuclear, to be precise) definition of 'safe', so all aircraft/munitions are safe, and ships are big and expensive enough to justify $15,000 atomic clock.

Re: Ships fooled in GPS spoofing attack suggest Russian cyberweapon

#77

Post by jhayward »

PhantomGremlin wrote: post #74
jhayward wrote: post #71

Earlier quoted context omitted.

> That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there. I made a mistake in ambiguously referring to two things: processing delay at the spoofer, and speed-of-light based time difference between spoof signal and direct broadcast at the…

They all suffer in shock/vibration conditions Interesting. I didn't know that. There's a comment on another thread that someone just made: https://news.ycombinator.com/item?id=15007006 And now you can buy a genuine atomic wristwatch. Here's a few sentences from the linked website: In each atomic physics unit is a small vessel of Caesium 133, an oven to heat it to 130°C, a laser to excite the atoms and a microwave res…

Some links you might find interesting:

https://www.microsemi.com/products/timing-synchronization-sy...

http://www.oewaves.com/media-events/item/50-oewaves-to-devel...

http://www.gps.gov/governance/advisory/meetings/2016-05/lutw...

https://www.darpa.mil/program/micro-technology-for-positioni...

I haven't seen much (haven't been looking either tho) since the Micro-PNT program which was in 2008. Sometimes that means that things are getting interesting, other times it's a dry hole. I'm interested in any later developments if you know of them.

Re: Ships fooled in GPS spoofing attack suggest Russian cyberweapon

#78

Post by wyager »

anovikov wrote: post #75
PeterisP wrote: post #73

Earlier quoted context omitted.

Yes, it is quite hard - standard oscillators used in electronics can easily drift up to a second a day (we don't notice because many devices update their time from GPS signal or cell data), and even really good ones will still drift for a millisecond quite quickly and it definitely can't rely on accuracy measured in us. For getting such an accuracy, IIRC, at the very least you'd need a temperature-controlled environm…

There are atomic clocks that weigh only about 35 grams. They cost $15K though, so probably too expensive for munitions, except nukes, but fine for aircraft and ships, and probably for some land vehicles. Having ±5.0E-11 accuracy and Even OCXO will be enough given short duration of stay in a spoofed environment (typical OCXO will give you 50 seconds, but it is more than enough time to be within 300 meters from a spoof…

Wow! Thank you for the detailed description. I didn't realize atomic clocks had become so small. After searching, I see you can even buy rubidium clocks with similar accuracy for around $1000 in single quantities! Very impressive.
Post reply on HN