Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Report deems Russia a pioneer in GPS spoofing attacks

zdnet.com

Post reply on HN
Print view View original

21–30 of 83 posts

Re: Report deems Russia a pioneer in GPS spoofing attacks

#21

Post by atemerev »

jhayward wrote: post #19
atemerev wrote: post #18

Earlier quoted context omitted.

All modern digital signature systems protect against replay attacks (by signing sequential counters, timestamps or other state information, or using cypher block chaining).

All of those things require some alternate source of ground truth, e.g., a trusted clock. There is no such thing in GNSS systems. They are the ground truth. There is no way to combat a replay attack without some second source which would obviate much of what a GNSS delivers.

GPS time is monotonously increasing. If you ignore all messages with timestamps lower than the last one received, and check their digital signatures, you should be protected against replay attacks at least until the next cold restart (or GPS time counter reset, which is once in 20 years).

There are other possibilities (CTR/CFB encryption modes, relying on increasing counter and/or previous messages contents).

Or am I missing something? Could you please describe the attack vector with these assumptions?

Re: Report deems Russia a pioneer in GPS spoofing attacks

#22

Post by woodruffw »

michaelt wrote: post #11
anonymousDan wrote: post #2

Would these kind of attacks be made redundant by Galileo?

TLDR: no. GPS spoofing can be done as a replay attack; record the signal at the airport, rebroadcast at the Kremlin louder than the direct satellite signal and voilà, your receiver says you’re at the airport. As it’s just a replay attack of the original signal, encryption can’t help.

> As it’s just a replay attack of the original signal, encryption can’t help.

Couldn't this be mitigated by added a nonce or using CBC within the cryptosystem? Replay attacks are well understood; I'd be surprised if any (eventual) proposal for signed/encrypted GPS didn't include something to defend against them.

Re: Report deems Russia a pioneer in GPS spoofing attacks

#23

Post by jhayward »

atemerev wrote: post #21
jhayward wrote: post #19

Earlier quoted context omitted.

All of those things require some alternate source of ground truth, e.g., a trusted clock. There is no such thing in GNSS systems. They are the ground truth. There is no way to combat a replay attack without some second source which would obviate much of what a GNSS delivers.

GPS time is monotonously increasing. If you ignore all messages with timestamps lower than the last one received, and check their digital signatures, you should be protected against replay attacks at least until the next cold restart (or GPS time counter reset, which is once in 20 years). There are other possibilities (CTR/CFB encryption modes, relying on increasing counter and/or previous messages contents). Or am I…

TLDR: you essentially never see repeated time stamps.

GPS time is broadcast in the very low bit rate (50 BPS) NAV message, once every 6 seconds. In between the receiver counts at the chip rate (1023 kHz) just counting signal transitions.

A rebroadcast attack happens at the speed of light. A signal is received at Moscow airport and is beamed to the Kremlin via some alternate transport path. At the Kremlin the signal is broadcast immediately at higher power than is possible for the direct signal. This happens at the speed of light.

There is nothing you can do about this without access to a clock that is at least as precise as the GPS satellite's multi-million-dollar onboard clock, which you then somehow keep correctly synchronized at all times.

There are some things that can be done to detect rebroadcast in the RF domain by looking at time of arrival across an antenna array, but again, that's not going to happen in a cell phone or wrist appliance.

There are some techniques that are used to discern direct path signals from multipath ones which involve tracking the lower power level signals, but rebroadcasters make sure they are radiating enough power to put that technique outside the dynamic range of the receiver.

Re: Report deems Russia a pioneer in GPS spoofing attacks

#24

Post by jhayward »

woodruffw wrote: post #22
michaelt wrote: post #11

Earlier quoted context omitted.

TLDR: no. GPS spoofing can be done as a replay attack; record the signal at the airport, rebroadcast at the Kremlin louder than the direct satellite signal and voilà, your receiver says you’re at the airport. As it’s just a replay attack of the original signal, encryption can’t help.

> As it’s just a replay attack of the original signal, encryption can’t help. Couldn't this be mitigated by added a nonce or using CBC within the cryptosystem? Replay attacks are well understood; I'd be surprised if any (eventual) proposal for signed/encrypted GPS didn't include something to defend against them.

As I loosely explained in another comment, you essentially never see repeats. The replay happens at the speed of light, and time stamps are broadcast once every 6 seconds at 50 BPS.

The receiver sees the rebroadcast because it captures the receiver's RF chain by being the strongest signal.

Re: Report deems Russia a pioneer in GPS spoofing attacks

#26

Post by stevespang »

In the Balkans war, Russia was caught selling GPS spoofers to our adversaries, average price $20 to $30K. US military simply installed downward seeking GPS signal seekers on smart bombs, problem solved. Then of course, adversaries installed GPS spoofers near hospitals, Chinese embassy, unethical targets, typical of rogue nations and despots.

Re: Report deems Russia a pioneer in GPS spoofing attacks

#27

Post by robertAngst »

ohadron wrote: post #25

Wouldn't it be possible to mitigate some of the effect of these spoofers using on-board navigation system with an IMU? Or it least allow for it's detection?

I work in automotive telematics-

You can always store 'last known location', the rest is math. The military has/will have this.

However this is a non-issue at the moment for auto, and with 5G/autonomous coming out, GPS might be seeing its last useful days in my part.

Re: Report deems Russia a pioneer in GPS spoofing attacks

#28

Post by Nokinside »

ohadron wrote: post #25

Wouldn't it be possible to mitigate some of the effect of these spoofers using on-board navigation system with an IMU? Or it least allow for it's detection?

You can make spoofing harder. Most of these spoofing attacks target off-the-self drone GSP, and don't work against adversary who plan against them.

If you want to spoof more expensive gear, like those used in commercial shipping, you do it gradually. You start by transmitting the correct coordinates and then gradually start to increase the difference between correct and false coordinates. When done gradually, IMU can't detect GPS spoofing.

Unfortunately many otherwise good navigation systems are not doing even the bare minimum to detect spoofing. It's not the cost. Spoofing protection has not been priority.

Re: Report deems Russia a pioneer in GPS spoofing attacks

#29

Post by duxup »

ccnafr wrote: post #3

To be fair, the report is authored by an US entity. I'm sure if they could have studied US operations without losing their funding they would have found similar deployments by US forces, albeit, I think not as widespread. The US has always seemed to have better tech, and GPS spoofing is cheap, from what the article states, which makes it ideal for the cash-bootstrapped Russian military.

> I'm sure if they could have studied US operations without losing their funding they

Is that actually the case?

Re: Report deems Russia a pioneer in GPS spoofing attacks

#30

Post by duxup »

jhayward wrote: post #20
atemerev wrote: post #15

Earlier quoted context omitted.

Aren't military drones using the military GPS profile with encrypted messages? Those cannot be easily spoofed, AFAIK.

Full-blown spoofing, ie, being able to generate a 'valid' sui generis GPS signal is effectively ruled out by encryption. However a replay attack that uses a valid signal received at some other locate re-broadcast at a second place is not affected by encryption. You can imagine lots of clever ways to use a re-broadcast attack to draw a drone off course.

>However a replay attack that uses a valid signal received at some other locate re-broadcast at a second place is not affected by encryption.

That seems like a pretty obvious and absurd sort of vulnerability.

Post reply on HN