Live data from Hacker News

Texas students fake GPS signals and take control of an $80 million yacht

blog.chron.com

71–80 of 102 posts

Re: Texas students fake GPS signals and take control of an $80 million yacht

#71
post #49

Earlier quoted context omitted.

How can they fake the gps signal, the military uses encrypted GPS?

The military possesses control over encrypted GPS. The military doesn't actually use it, though, for the most part - the keys are sensitive state secrets, and distributing them apparently requires the proverbial man chained to a suitcase level of paperwork. The encrypted channels are sufficiently underused that drones whose very design is secret that we fly down the Iran-Afghanistan border aren't equipped with them,…

Sounds like a really solid argument for mission-specific or date-specific encryption keys.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#72
post #8
post #6

Earlier quoted context omitted.

No they don't, they land with something called ILS https://en.wikipedia.org/wiki/Instrument_landing_system

There is more airports in US that have GPS only approaches than airports that have ILS approaches. For example: http://155.178.201.160/d-tpp/1308/05879R25.PDF 500 ft altitude with GPS only (without vertical guidance). LPV minimum is 300 ft. Category III ILS minimum is 200 ft, Cat II -- 100 ft. But there are a lot of airports where ILS is not available.

You've got it backwards: CAT I is 200ft Decision Height (btw, not Minimum Descent) Cat II is 100ft Cat III is 0ft (with differing horizontal visibilities for IIIa/IIIb/IIIc

Re: Texas students fake GPS signals and take control of an $80 million yacht

#73
post #27

Earlier quoted context omitted.

"$80mil yacht uses same GPS as a $80 sell phone, the 6 zeros dont change that." When gauging the newsworthy-ness of a problem, the scope of its impact is always one of the first factors that journalists consider.

Or the appearance of scope. An $80M yacht sounds impressive, but widespread hacking of a million $80 phones would be far more potentially awful.

That's true. But I think a big reason this story is newsworthy is because the author connects it to what might be a much broader threat:

The scientists who conducted the experiment — done with permission of the yacht’s owners — say their ability to broadcast counterfeit GPS signals that triggered no alarms within the ship’s navigation system highlights a serious flaw in transportation networks on land and sea. Some 90 percent of the world’s freight moves by sea.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#75
post #4

Yeah if they just used their paper charts, logged the position and compared GPS with the dead reckoning (or depth lines, radar shore returns,..) the attackers would have a much harder time... My sailing instructor always stressed that GPS is unreliable and especially when close to danger one should cross check what it says with other methods. Came in handy when my plotter failed.

There is more to it than that though. Aircraft often fly instrument approaches using GPS alone, getting to within 500 feet of the ground while still in clouds. If someone could make the aircraft think it was just a couple extra miles in the wrong direction it could be disastrous.

> using GPS alone

Yes, I'm sure that pilots routinely ignore the altimeter, air speed indicator, climb rate indicator, compass ....

GPS is useful, but no competent pilot ignores all of the other sensors and uses GPS alone.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#76
post #61
post #34

Earlier quoted context omitted.

Traditionally, I believe receivers had to lock onto the civilian GPS signal before even trying to lock the encrypted military GPS. Besides, encryption doesn't stop you from receiving the existing signal and repeating it with a well-tuned delay, which is all you really need to do to fake GPS...

"I believe receivers had to lock onto the civilian GPS signal before even trying to lock the encrypted military GPS." That's the old fashioned P(Y) code that they dumped because it sucked and went to the M code that doesn't need P(C) first. P(Y) code sucked because aside from needing to sync to P(C) first, they fed in the encryption stream at a varying, yet slow enough rate that you essentially got dozens of "known p…

Have you seen the "Homemade GPS Receiver" project?[1]

I imagine it'd be a whole lot easier if you already have gear to receive and sample the RF side, but still an interesting challenge.

Don't forget to implement CoCom restrictions :)

[1] http://www.holmea.demon.co.uk/GPS/Main.htm

Re: Texas students fake GPS signals and take control of an $80 million yacht

#77
post #64

Earlier quoted context omitted.

Well that would only work if they are using the most simplistic encryption on the planet (i.e an XOR cipher or something like that). In general replaying the same data through an encryption algorithm should not result in the same encrypted result being generated. Thus if you were to replay the existing signal it should decrypt to nonsense.

You've sort of described kind of how some auth systems work around MITM by having a bidirectional conversation with salt while sharing a the same clock and talking about timestamps during their bidirectional conversations. That doesn't work very well in a broadcast environment where your only source of timestamps is the MITM and technology exists such that the MITM sounds just as good, but louder, than the genuine ot…

Speaking of OMEGA, there's a Navy training film from 1969 on Youtube[1] which explains some of the theory and is helpful in understanding where GPS came from.

[1] https://www.youtube.com/watch?v=7mFAemn1pSw

Re: Texas students fake GPS signals and take control of an $80 million yacht

#78
post #61

Earlier quoted context omitted.

"I believe receivers had to lock onto the civilian GPS signal before even trying to lock the encrypted military GPS." That's the old fashioned P(Y) code that they dumped because it sucked and went to the M code that doesn't need P(C) first. P(Y) code sucked because aside from needing to sync to P(C) first, they fed in the encryption stream at a varying, yet slow enough rate that you essentially got dozens of "known p…

I wanted to make a GPS simulator for testing my high altitude balloon's receiver to make sure it works over 15km altitude, or whatever the limit usually is. I think I gave up when I couldn't figure out how I would build the RF side. I think I got the CA PRNG code working. =) https://github.com/jevinskie/jevps/blob/master/ca.py Edit: I think I remember the issue. I started out thinking I just had to create a signal at…

So.. if you can squirt out that C/A stream from your python code at 1.023 megabits/sec all you really are asking for is a COTS BPSK modulator (minicircuits ZFAS-2000?) and a COTS L1 signal around 1.5 GHz to drive the mod.

I have built N5AC microwave synth kits and I did not find it hard, but I've been doing this stuff since the 80s, so... I believe you can buy a COTS ApolLO-I board for your L1 signal. I donno if 1575.50 would be close enough. The smaller the .. forget the name but it boils down to the "tuning step" ... the worse the phase noise. So generating an exact 1575.42 will have MUCH ickier phase noise possibly impacting the PSK data itself. So is it better to have a noisy signal or be somewhat off frequency? I donno. COTS it'll probably have the VFO tuned to be "ideal" for ham radio guys around 1152 MHz but you'll want it a little higher, which it can do with a different smd 0204 sized inductor, but its going to take some soldering not just literally COTS.

There's more than one way to skin a cat and there's certainly a zillion ways to generate a stable-ish microwave signal. For that matter a BPSK mod is not exactly exotic material, but if there's a containerized COTS model for $65 its hard to find the motivation to hack up my own. Maybe you could trade time for money and build one out of 10 cents of junk parts, but it'll take time and gear to align and tune just right.

Note signal levels... You probably can't feed any ole LO directly into any ole modulator and expect the power levels to magically match up. And the levels the mod wants are probably not the levels of "whatever" your P/N code generator is outputing.

Do testing in a shielded cage to avoid an unfortunate appearance on the TV news.

Don't forget that you've just built a C/A generator but without a nav code (at like all of 50 bps, so slow even an arduino could do it...) all you're going to do is confuse the heck out of a RX.... I think... Which might be interesting to watch all in itself. The wikipedia article is hilarious because its kinda disinfo. As if you need to wander around asking weird questions like where to buy a "modulo 2 adder"... umm hint thats a pretty basic logic gate but if you can't figure that out, well... as if an actual devoted adversary would be slowed down by kinda intentionally weird terminology.

I think a harder problem that generating "a" more or less valid C/A stream and "a" more or less valid nav message, is generating them with actual reasonable real world data to simulate being over 15 km altitude or whatever, and them scale it up to do at least 4 of those signals at once.

Probably an interesting noob-level RX countermeasure would be you need at least 4 to get a fix, so lazy people are just going to generate 4, probably in idea geometry with weird unlikely visibility (like the four you hear are all over the sky but just bad luck you can't see another eight, yeah right) Another one would be watching signal strengths, which will vary "twinkle like stars" for real satellites but lazy synthesizers will not vary. Finally unless you go GPSDO (OH the IRONY) synth route, the homemade clocks the RX hears will probably be driftier than the real satellites.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#79

Sounds like the plot to this 1997 Bond movie. http://en.wikipedia.org/wiki/Tomorrow_never_dies

Except that the "bad guys" had to put serious effort/money into acquiring a stolen private key to do that.

Even with the mil spec transmissions (which by my understanding have un-broken encryption) you could theoretically somehow block 100% data to a receiver, and forward data with timings you want. So long as you are controlling all of the information you don't need to truly understand the cypher text, you are just interfering with the latency.

However this is based on what I can remember from 12 years ago, before I'd had any formal electronics/signals education so I might have some massive miss-conceptions.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#80
post #49

Earlier quoted context omitted.

How can they fake the gps signal, the military uses encrypted GPS?

The military possesses control over encrypted GPS. The military doesn't actually use it, though, for the most part - the keys are sensitive state secrets, and distributing them apparently requires the proverbial man chained to a suitcase level of paperwork. The encrypted channels are sufficiently underused that drones whose very design is secret that we fly down the Iran-Afghanistan border aren't equipped with them,…

Is this symmetric or asymmetric? Seems the keys would only be sensitive if it's the former, given that there (AFAIK) isn't much difference in accuracy between the encrypted and civilian signals anymore. Although, given the very old hardware in the GPS sattelites maybe asymmetric would require too much processing power.
Post reply on HN