Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Texas students fake GPS signals and take control of an $80 million yacht

blog.chron.com

Post reply on HN
Print view View original

61–70 of 102 posts

Re: Texas students fake GPS signals and take control of an $80 million yacht

#61

Post by VLM »

makomk wrote: post #34
eksith wrote: post #28

Earlier quoted context omitted.

That would only work if it had a really silly default similar in a way to "automatically connect to available Wi-Fi network" even when it's unsecured. It's possible the manufacturer may have overlooked something like that, but if it is in a military capacity, I doubt they would have left a gaping hole like that. Electronic countermeasures have been in use for several decades now so jamming/hijacking etc... would have…

Traditionally, I believe receivers had to lock onto the civilian GPS signal before even trying to lock the encrypted military GPS. Besides, encryption doesn't stop you from receiving the existing signal and repeating it with a well-tuned delay, which is all you really need to do to fake GPS...

"I believe receivers had to lock onto the civilian GPS signal before even trying to lock the encrypted military GPS."

That's the old fashioned P(Y) code that they dumped because it sucked and went to the M code that doesn't need P(C) first.

P(Y) code sucked because aside from needing to sync to P(C) first, they fed in the encryption stream at a varying, yet slow enough rate that you essentially got dozens of "known plaintext" packets reporting the same position using the same code. So if you could sync up to the W feed rate, even if you couldn't figure out what it said, you could get a better position after gathering enough data. Then again, for something like a cruise missile while in flight, taking 15 minutes while stationary isn't really all that useful.

The whole design of GPS is an interesting window into tradeoffs between accuracy and time as seen in the 70s. Given enough time you can always average something stationary to ridiculous precision. However the whole thing was designed so strategic weapons in motion couldn't average enough measurements in time to be useful at a strategic weapon level unless you had the .mil keys...

The wikipedia article is kinda interesting.

I currently/used to do stuff in the ham radio microwave bands kinda bracketing the GPS signal, one of those "infinite spare time" projects to program a FPGA to decode my own GPS. Why? Because I can. Right up there with making my own ADS-B receiver which is actually a lot easier on the digital side and about the same level of difficulty on the RF side, more or less.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#63

Post by bjcubsfan »

jug6ernaut wrote: post #9

Click bait title(same as the article, for what its worth). $80mil yacht uses same GPS as a $80 sell phone, the 6 zeros dont change that. To the actual issue, i wonder how practical this is? In that i mean what level of power output is required to override the correct signal and at what distance? Is this something that could be a real issue, impractical? What?

GPS signals are below the noise floor, so it wouldn't take much power to spoof them. You just have to get the gold codes correct (http://en.wikipedia.org/wiki/Gold_code).

Re: Texas students fake GPS signals and take control of an $80 million yacht

#64

Post by VLM »

stanfordkid wrote: post #44
makomk wrote: post #34

Earlier quoted context omitted.

Traditionally, I believe receivers had to lock onto the civilian GPS signal before even trying to lock the encrypted military GPS. Besides, encryption doesn't stop you from receiving the existing signal and repeating it with a well-tuned delay, which is all you really need to do to fake GPS...

Well that would only work if they are using the most simplistic encryption on the planet (i.e an XOR cipher or something like that). In general replaying the same data through an encryption algorithm should not result in the same encrypted result being generated. Thus if you were to replay the existing signal it should decrypt to nonsense.

You've sort of described kind of how some auth systems work around MITM by having a bidirectional conversation with salt while sharing a the same clock and talking about timestamps during their bidirectional conversations. That doesn't work very well in a broadcast environment where your only source of timestamps is the MITM and technology exists such that the MITM sounds just as good, but louder, than the genuine other guy.

You'd be surprised how many people think GPS is a bidirectional protocol like DME/TACAN or an aircraft radar transponder. Its actually a heck of a lot more like the old fashioned TRANSIT sats or VOR or LORAN or OMEGA, with a thin smear of spread spectrum on top to reduce the impact of simplistic jamming and it sends more metadata on top of the nav data than pretty much anything ever invented.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#66

Post by VLM »

fnordfnordfnord wrote: post #41
jug6ernaut wrote: post #11

Earlier quoted context omitted.

How can they fake the gps signal, the military uses encrypted GPS?

GPS signals are very weak. Simply broadcast your own fake signals at the target.

It helps if the opposition is dumb enough to use a predictable route each day such that you've got a known plaintext attack. Then it amounts to playing yesterday's path, very loudly, today, and it'll fly in a straight line thinking its right on course.

Technically you need multiple recordings so you can switch between them to trick it to climb, descend, etc on command.

Also it helps if the opposition insists on not only flying the same exact "known plaintext" route over and over, but using a predictable precise number like 3000.000 meters on that route.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#67

Post by iliis »

bargl wrote: post #38
blhack wrote: post #6

Earlier quoted context omitted.

No they don't, they land with something called ILS https://en.wikipedia.org/wiki/Instrument_landing_system

>Limitations Glide slope station for runway 09R at Hannover Airport in Germany >Due to the complexity of ILS localizer and glide slope systems, there are some limitations. Localizer systems are sensitive to obstructions in the signal broadcast area like large buildings or hangars. Glide slope systems are also limited by the terrain in front of the glide slope antennas. If terrain is sloping or uneven, reflections can…

As always when this comes up: https://en.wikipedia.org/wiki/Battle_of_the_Beams

Yes, you can indeed hijack an ILS system. At least during WW2.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#68

Post by rjsw »

mrt0mat0 wrote: post #18
forgottenpass wrote: post #10

Earlier quoted context omitted.

>where are all the security guys at when this stuff is implemented? It doesn't matter where they are, because where they're not is in management. During development, if attacks like this are even considered at all, its a very low probability incident, isolated to a very small number of targeted units and requires people doing things that can be dismissed by rhetorically asking "why would anyone ever do X?" Computer s…

that's sad. I wonder if anyone has done a case study on companies that listen to their IT and implement as much as possible compared to the "let's just make it pass inspection" guys. I know in every cartoon I've seen, the first group wins, but in reality it may truly be worth it to skimp

You would first have to find a company that listened to the IT people.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#69

Post by jevinskie »

VLM wrote: post #61
makomk wrote: post #34

Earlier quoted context omitted.

Traditionally, I believe receivers had to lock onto the civilian GPS signal before even trying to lock the encrypted military GPS. Besides, encryption doesn't stop you from receiving the existing signal and repeating it with a well-tuned delay, which is all you really need to do to fake GPS...

"I believe receivers had to lock onto the civilian GPS signal before even trying to lock the encrypted military GPS." That's the old fashioned P(Y) code that they dumped because it sucked and went to the M code that doesn't need P(C) first. P(Y) code sucked because aside from needing to sync to P(C) first, they fed in the encryption stream at a varying, yet slow enough rate that you essentially got dozens of "known p…

I wanted to make a GPS simulator for testing my high altitude balloon's receiver to make sure it works over 15km altitude, or whatever the limit usually is. I think I gave up when I couldn't figure out how I would build the RF side. I think I got the CA PRNG code working. =)

https://github.com/jevinskie/jevps/blob/master/ca.py

Edit: I think I remember the issue. I started out thinking I just had to create a signal at 1.023 MHz, easy to do with an FPGA right? But then I realized that I would need to generate a much higher frequency signal so I could phase shift the different satellite's CA codes before adding them together. Am I correct in my thinking?

Re: Texas students fake GPS signals and take control of an $80 million yacht

#70

Post by mrb »

jug6ernaut wrote: post #11
patrickas wrote: post #7

That's cool! Reminds me of the way the Iranian most likely got control over a US drone a couple of years back. They jammed communication signals and faked GPS data when automatic "go back to home base" landing procedure kicked in. http://www.informationweek.com/security/attacks/iran-hacked-...

How can they fake the gps signal, the military uses encrypted GPS?

Why do you, non-cryptographer people, think that encrypted GPS is perfectly secure? Pretty much all crypto implementations have flaws (numerous SSL/TLS discovered and fixed over the years, Android package signing, Xbox game code signing, etc.)

GPS encryption was designed 20+ years ago. It is almost guaranteed it has (known and unknown) flaws.

Post reply on HN