Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Texas students fake GPS signals and take control of an $80 million yacht

blog.chron.com

Post reply on HN
Print view View original

51–60 of 102 posts

Re: Texas students fake GPS signals and take control of an $80 million yacht

#51

Post by manarth »

beat wrote: post #27
hawkharris wrote: post #20

Earlier quoted context omitted.

"$80mil yacht uses same GPS as a $80 sell phone, the 6 zeros dont change that." When gauging the newsworthy-ness of a problem, the scope of its impact is always one of the first factors that journalists consider.

Or the appearance of scope. An $80M yacht sounds impressive, but widespread hacking of a million $80 phones would be far more potentially awful.

An $80M yacht sounds impressive…but if it were a tanker full of crude, the outcome could be rather more newsworthy.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#52

Post by mikeash »

toomuchtodo wrote: post #48
hedgie13 wrote: post #36

Earlier quoted context omitted.

Yes, but the weather was clear. No need for ILS in such weather.

Unless of course you've never landed at SFO before in an aircraft you're barely type-rated on.

Neither should matter. A visual landing at any airport is pretty much the same, and the basics don't change for different aircraft. There's nothing at all tricky about a visual approach into SFO.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#53

Post by VLM »

eksith wrote: post #28
michaelt wrote: post #22

Earlier quoted context omitted.

What do you suppose a drone does if the command channel and the encrypted GPS signal are both unavailable/jammed but the unencrypted GPS signal is available? In any case, you don't have to be able to decrypt a GPS signal to be able to replay it - you fly a plane 200m above the drone, record whatever's coming over the air from the satellites and you know precisely what would be at the drone's antenna if it were 200m h…

That would only work if it had a really silly default similar in a way to "automatically connect to available Wi-Fi network" even when it's unsecured. It's possible the manufacturer may have overlooked something like that, but if it is in a military capacity, I doubt they would have left a gaping hole like that. Electronic countermeasures have been in use for several decades now so jamming/hijacking etc... would have…

A traditional problem programmers have is thinking the lower "EE" levels are more complicated than they really are. Such as assuming a mid 2010s era level of complication for a two way communication stream in something designed in the 80s for unidirectional listening.

The way GPS works is pretty much like LORAN (well, maybe more like OMEGA) but with embedded metadata. So you've got 40 satellites who know exactly where they are and exactly what time it is and exactly what frequency is the center of their spread spectrum spread, and they're more than glad to tell you all about it. All 40 of them. Maybe you can see a dozen of them at a time?

Anyway you sync up to the SS signal and that gives you a local offset for your clock and your local oscillator and you know the exact orbital position pertaining to that delta-t (aka distance) and delta-f (aka doppler velocity). Now average together a zillion satellites and solve a least squares puzzle for the most likely location for you. Which also feeds out an internal error correction signal for your internal osc and real time clock.

All the .mil signal does is squirt out a slightly more accurate encrypted signal so you need the same key all the satellites use and the key changes rather often.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#54

Post by fnordfnordfnord »

mbrameld wrote: post #24
zackbloom wrote: post #5

Earlier quoted context omitted.

There is more to it than that though. Aircraft often fly instrument approaches using GPS alone, getting to within 500 feet of the ground while still in clouds. If someone could make the aircraft think it was just a couple extra miles in the wrong direction it could be disastrous.

Do you have a source for aircraft flying using GPS alone? My understanding is that they rely on VOR and ILS systems.

VOR system is on its way out.

http://aeronav.faa.gov/content/aeronav/acfstatus/Presentatio...

Re: Texas students fake GPS signals and take control of an $80 million yacht

#55

Post by dzhiurgis »

mapt wrote: post #49
jug6ernaut wrote: post #11

Earlier quoted context omitted.

How can they fake the gps signal, the military uses encrypted GPS?

The military possesses control over encrypted GPS. The military doesn't actually use it, though, for the most part - the keys are sensitive state secrets, and distributing them apparently requires the proverbial man chained to a suitcase level of paperwork. The encrypted channels are sufficiently underused that drones whose very design is secret that we fly down the Iran-Afghanistan border aren't equipped with them,…

Wasn't there rumours that Russians got ahold of the keys?

Re: Texas students fake GPS signals and take control of an $80 million yacht

#56

Post by dzhiurgis »

forgottenpaswrd wrote: post #25

So a $80 million yatch can't afford an $3000 high quality gyroscope? Now you could buy amazing laser gyroscopes, for planes the Inertial navigation system error could be great, but for ships(that move more than 20X slower) is not.

Compass could do as well, although neither of the devices would be able to compensate for drift caused by wind.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#57

Post by jevinskie »

mapt wrote: post #49
jug6ernaut wrote: post #11

Earlier quoted context omitted.

How can they fake the gps signal, the military uses encrypted GPS?

The military possesses control over encrypted GPS. The military doesn't actually use it, though, for the most part - the keys are sensitive state secrets, and distributing them apparently requires the proverbial man chained to a suitcase level of paperwork. The encrypted channels are sufficiently underused that drones whose very design is secret that we fly down the Iran-Afghanistan border aren't equipped with them,…

I found an interesting slide deck that talks a bit about spoofing and key management. [0] Apparently there are different levels of classification for keys. (pg 23) But they must be derived keys, right? The satellites are only broadcasting one signal, not multiple signals each keyed to one receiver. I think there can only be one possible cipherstream (and thus one key) in the very low bandwidth signal.

[0] http://www.ko4bb.com/Manuals/05)_GPS_Timing/GPS_-_SAASM_brfg...

Re: Texas students fake GPS signals and take control of an $80 million yacht

#58

Post by sebbi »

michaelt wrote: post #22
tlrobinson wrote: post #19

Earlier quoted context omitted.

Parent comment says the military uses encrypted GPS , which should protect against this type of attack.

What do you suppose a drone does if the command channel and the encrypted GPS signal are both unavailable/jammed but the unencrypted GPS signal is available? In any case, you don't have to be able to decrypt a GPS signal to be able to replay it - you fly a plane 200m above the drone, record whatever's coming over the air from the satellites and you know precisely what would be at the drone's antenna if it were 200m h…

The recorded signal would be exactly the same. GPS just sends the clock of the GPS satelites and their positions. You then calculate your position from the runtime of the signals ...

Re: Texas students fake GPS signals and take control of an $80 million yacht

#59

Post by jevinskie »

stanfordkid wrote: post #44
makomk wrote: post #34

Earlier quoted context omitted.

Traditionally, I believe receivers had to lock onto the civilian GPS signal before even trying to lock the encrypted military GPS. Besides, encryption doesn't stop you from receiving the existing signal and repeating it with a well-tuned delay, which is all you really need to do to fake GPS...

Well that would only work if they are using the most simplistic encryption on the planet (i.e an XOR cipher or something like that). In general replaying the same data through an encryption algorithm should not result in the same encrypted result being generated. Thus if you were to replay the existing signal it should decrypt to nonsense.

The parent isn't talking about MITMing the signal to modify it, just to delay/buffer it. No need to decrypt/encrypt. If you could delay the signals from different satellites by different amounts, would that not also change the position?

Re: Texas students fake GPS signals and take control of an $80 million yacht

#60

Post by alphaBetaGamma »

michaelt wrote: post #22
tlrobinson wrote: post #19

Earlier quoted context omitted.

Parent comment says the military uses encrypted GPS , which should protect against this type of attack.

What do you suppose a drone does if the command channel and the encrypted GPS signal are both unavailable/jammed but the unencrypted GPS signal is available? In any case, you don't have to be able to decrypt a GPS signal to be able to replay it - you fly a plane 200m above the drone, record whatever's coming over the air from the satellites and you know precisely what would be at the drone's antenna if it were 200m h…

What your suggesting is going to be tricky to implement. First you can only add delay, not subtract delay, so your specific example will not work: you can not "rebroadcast at the drone's antenna" before the original signal reach the drone.

To overcome this, could record all the gps signals, and rebroadcast them with carefully timed delays. But than gps time as determined by the drone will be different from what a clock in the drone gives, so it could be detected. If you are quick enough it might work, but it's non trivial.

And if the drone uses carrier-phase gps measurements you have a whole bunch of other problems.

Not saying it can't be done, but it's not easy.

Post reply on HN