Live data from Hacker News

Texas students fake GPS signals and take control of an $80 million yacht

blog.chron.com

91–100 of 102 posts

Re: Texas students fake GPS signals and take control of an $80 million yacht

#91
post #77
post #64

Earlier quoted context omitted.

You've sort of described kind of how some auth systems work around MITM by having a bidirectional conversation with salt while sharing a the same clock and talking about timestamps during their bidirectional conversations. That doesn't work very well in a broadcast environment where your only source of timestamps is the MITM and technology exists such that the MITM sounds just as good, but louder, than the genuine ot…

Speaking of OMEGA, there's a Navy training film from 1969 on Youtube[1] which explains some of the theory and is helpful in understanding where GPS came from. [1] https://www.youtube.com/watch?v=7mFAemn1pSw

Wow, that is a really elegant, quite low-tech way of positioning!

Re: Texas students fake GPS signals and take control of an $80 million yacht

#92
post #38
post #6

Earlier quoted context omitted.

No they don't, they land with something called ILS https://en.wikipedia.org/wiki/Instrument_landing_system

>Limitations Glide slope station for runway 09R at Hannover Airport in Germany >Due to the complexity of ILS localizer and glide slope systems, there are some limitations. Localizer systems are sensitive to obstructions in the signal broadcast area like large buildings or hangars. Glide slope systems are also limited by the terrain in front of the glide slope antennas. If terrain is sloping or uneven, reflections can…

While ILS is generally considered to be the second most reliable instrument (after the windsock) it has its own problems... For example false glidescope, see http://www.ukfsc.co.uk/files/Safety%20Briefings%20_%20Presen...

Re: Texas students fake GPS signals and take control of an $80 million yacht

#93

That's cool! Reminds me of the way the Iranian most likely got control over a US drone a couple of years back. They jammed communication signals and faked GPS data when automatic "go back to home base" landing procedure kicked in. http://www.informationweek.com/security/attacks/iran-hacked-...

How can they fake the gps signal, the military uses encrypted GPS?

You don't need to fake it. You just need to know the location of the satellites and delay the signals appropriately.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#94
post #67
post #38

Earlier quoted context omitted.

>Limitations Glide slope station for runway 09R at Hannover Airport in Germany >Due to the complexity of ILS localizer and glide slope systems, there are some limitations. Localizer systems are sensitive to obstructions in the signal broadcast area like large buildings or hangars. Glide slope systems are also limited by the terrain in front of the glide slope antennas. If terrain is sloping or uneven, reflections can…

As always when this comes up: https://en.wikipedia.org/wiki/Battle_of_the_Beams Yes, you can indeed hijack an ILS system. At least during WW2.

You can hijack it, but there are monitoring systems in place to detect if something is out of place. Also, ATC will usually notice flight path deviations quite quickly, at least on manned airports with radar coverage.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#95
post #89
post #40

Earlier quoted context omitted.

That "someone" could simply be the computer.

True, it could be. If they went to the trouble to integrate the two and develop the solution. But that begs the question: why use GPS? Use the same map information with the non-GPS location calculations that could be automated. GPS is just too convenient...

GPS is convenient, but it has other advantages as well. It's almost always available, it's highly accurate, has a quick time-to-fix, etc.

Inertial navigation systems require finicky setup and drift over time. (Ask the passengers of KAL 007 about that one.) However, the setup can easily be automated using GPS inputs, and the drift can also be corrected that way. This way, you have two systems which help keep tabs on each other. The INS can't be spoofed, and so can tell you when your GPS goes out of whack. The GPS won't drift, and so can keep your INS up to date when it's not being spoofed. Cost aside, two systems are better than one.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#96
post #78

Earlier quoted context omitted.

So.. if you can squirt out that C/A stream from your python code at 1.023 megabits/sec all you really are asking for is a COTS BPSK modulator (minicircuits ZFAS-2000?) and a COTS L1 signal around 1.5 GHz to drive the mod. I have built N5AC microwave synth kits and I did not find it hard, but I've been doing this stuff since the 80s, so... I believe you can buy a COTS ApolLO-I board for your L1 signal. I donno if 1575…

Wow, awesome post! I like COTS but I also like soldering and being cheap. =) I think my main confusion is how do I add the 4 channels together before I spit the signal out to the RF side? If they are all in phase, would it weird out the receiver because you're not going to see that in the real world? Would I have to have 4 output levels corresponding to how many channels are outputting a high level (1) during that ch…

They're not going to be in phase. Note that if phase relationship is important, at those frequencies cable length being identical is rather important. But its not relevant to this problem.

One big confusion in the electrical world is people use the same noun for audio "mixers" which are as linear as possible, and RF "mixers" which are as non-linear as possible. They do different things. linear mixers you could say superimpose signals without changing them. Much like pumping up the gain on a CD should not distort the sound on a mic at a "DJ" mixer. nonlinear mixers add and subtract signal frequencies from each other and what came in shouldn't come out at all. in fact a BPSK mod is a kind of balanced mixer, with peculiar TTL compatible (or 3.3v or whatever) levels of course.

You want a 4-port combiner. Most passives have a reciprocal path, a 4-port splitter usually makes a decent 4-port combiner. Think of the gadget that probably splits you cable TV signal in your house. They're electrically and mechanically simple. And relatively cheap. Also they are somewhat lossy. Good luck passively splitting a signal 4 ways with less than 6 dB of loss. And something is warming the resistors in there, so its going to be worse. Conversely yes you combine multiple signals there will be internal loss but the aggregate output will be higher. This is kind of the whole point of a class B or class AB amplifier... what if you took two perfectly good signals, 180 degrees out of phase, and (sorta) mixed them (using baluns), well you get very near twice the power out. Think of putting the whole works in a calorimeter... 4 zero dBm sources will heat it up just as fast combined or separate.

Aviation GPS "around 1.5 GHz" works pretty well despite being feet/inches away from a couple watt radar transponder around 1090 MHz or whatever it is exactly for ADS-B. Physically zorching it sounds unlikely. Distortion to the point of un demod ability is however possible. If you generate enough signal to overload it, attenuators are cheap. High power is expensive. If you're screwing around at "workbench range" you're not going to pay $XXX to generate multiple watts of power so you're not going to need multiple watt rated attenuators to reduce the sig level to something reasonable. Cost scales WAY beyond quadratically, like exponential at microwave freqs for a given tech type. Stuff working around a hundredth of a watt aka 10 dBm is going to be very cheap compared to stuff rated for old fashioned weather radars at kilowatts.

My suggestion is make what amounts to exactly one working satellite. Then make three more.

I don't think you can feed all four digital signals into the same BPSK mod by doing weird things with the clock rate, modulation does not work that way.

What you're building is vaguely reminiscent of a cable TV headend. Both in block diagram and actual wiring. Of course its been a long time since BPSK was cutting edge in CATV. If you think of BPSK as no amplitude modulation and either 180 or 0 degree phase modulation depending on 0 or 1 being input, well, a 256QAM signal is just 16 equally spaced levels of amplitude modulation and 16 equally spaced levels of phase modulation, sorta kinda a grown up cousin of the BPSK modulation in GPS signals. And 256QAM is sort of cutting edge for CATV. Anyway you could do worse than looking at a wiring diagram of a CATV headend WRT mods and digital sources and combiners and such.

Find your local ham radio VHF/UHF microwave club / community. Don't bother with the 160meter low band guys (well, not for this particular individual project, I mean) By the time you're done you'll know quite a bit about RF and might gain a new interesting hobby. Reading several "microwave handbook/project" ham radio books at the library would probably be as good a place to start as any. You could do worse than some chapters of the ARRL handbook to start.

Analog is fun. People will tell you the world is digital, but even their digital ckts are fundamentally analog. And if analog is fun, RF is just magic. A craft not a science at the higher levels.

Re: Texas students fake GPS signals and take control of an $80 million yacht

#97
post #14

Click bait title(same as the article, for what its worth). $80mil yacht uses same GPS as a $80 sell phone, the 6 zeros dont change that. To the actual issue, i wonder how practical this is? In that i mean what level of power output is required to override the correct signal and at what distance? Is this something that could be a real issue, impractical? What?

I disagree, on two counts. First, the fact that expensive machines can be brought down by cheap components is still interesting. Nobody will really care if your $80 cell phone can be spoofed. Second, GPS receivers are not all the same. There are many different techniques you can use to make your receiver more resilient against spoofing, from cheap and easy things like adding Galileo and GLONASS support to crazy expen…

On the topic of not being aware of the "spoofability" of GPS, it is interesting to note that many of the older Inertial Navigation Systems (GPS + IMU) use GPS to check against the accelerometers and gyroscopes in the IMU. Effectively, they would throw out the results from the internal dead-reckoning system if it didn't agree with GPS, instead of the other way around!

I guess it has more to do with the fact that unless you have a great Kalmann filter design, your IMU will likely drift off course rather rapidly, whereas GPS spoofing wasn't as easy or as popular as it is today (and I would say it really isn't that popular outside of major areas today, as it stands). Either way, you're right, the GPS coordinates should definitely be checked against the internal dead-reckoning. However, then you have to ask yourself how you know the internal dead-reckoning is still on course. It's a tricky problem, and hopefully the solution doesn't just tend towards "add more sensors."

EDIT: changed an "isn't" to "wasn't"

Re: Texas students fake GPS signals and take control of an $80 million yacht

#98

Click bait title(same as the article, for what its worth). $80mil yacht uses same GPS as a $80 sell phone, the 6 zeros dont change that. To the actual issue, i wonder how practical this is? In that i mean what level of power output is required to override the correct signal and at what distance? Is this something that could be a real issue, impractical? What?

The difference between the boat and a cell phone is that the boat is automatically steering a course based on the GPS. It's also relevant that it's a boat because the open ocean provides 2-dimensional movement without obstacles.

Let's say a captain enters a course to stay 500nm offshore of a pirate-infested coast (btw, after Somalia, West Africa is now a pirate hotspot[1]). By interfering with the GPS, the ship could be turned imperceptibly towards shore, and after a day be within range of pirate boats. The GPS display on the electronic charts would still show the intended course, because the GPS thinks it's on the right track. And without any land for reference, the captain or crew might not notice. If GPS is the sole position-finder, the fake coordinates would also endanger the reliability of ship-to-ship collision detection such as AIS[2].

With a cell phone or any consumer device, the user has to constantly read the GPS output and then react to it based on the roads or other physical landmarks. You couldn't just "steer" a person to the wrong place by making the GPS believe it's in a different location. And then I can't think of any other "exploit" that you could do with the GPS on a phone.

As mentioned elsewhere in this thread, the solution to the boat navigation problem is to have alternate sources of position info (Loran, GLONASS, etc.). Alternatively, the error introduced by the fake GPS could also be detected by weather info. Any deviation from the dead-reckoning course (heading and speed) can only be accounted for by wind and current. I believe wind and current forecasts are fairly common for all areas of the globe now, so the calculated values could be compared to the expected values and raise an alarm if they are far off.

[1] http://gcaptain.com/tag/piracy/ [2] http://en.wikipedia.org/wiki/Automatic_Identification_System

Re: Texas students fake GPS signals and take control of an $80 million yacht

#99

Earlier quoted context omitted.

What do you suppose a drone does if the command channel and the encrypted GPS signal are both unavailable/jammed but the unencrypted GPS signal is available? In any case, you don't have to be able to decrypt a GPS signal to be able to replay it - you fly a plane 200m above the drone, record whatever's coming over the air from the satellites and you know precisely what would be at the drone's antenna if it were 200m h…

What your suggesting is going to be tricky to implement. First you can only add delay, not subtract delay, so your specific example will not work: you can not "rebroadcast at the drone's antenna" before the original signal reach the drone. To overcome this, could record all the gps signals, and rebroadcast them with carefully timed delays. But than gps time as determined by the drone will be different from what a clo…

There are commercial products for less than $100 that do this for the L1 C/A signal - such as [1].

You can rebroadcast at substantially higher power than the signal coming directly from the satellite, so the direct signal gets drowned out. After all, the satellite has to broadcast to cover half the world, while you only have to cover a few square meters.

Now, I'll grant the receiver may see a change in signal strength, some cycle slips, and an increase in clock skew. But you get those in normal GPS operation anyway. If you're going to detect GPS attacks and self-destruct your drone you'll want a very low false-positive rate, and I'm not sure that's feasible.

[1] http://www.diplomat.co.uk/products/hardware-products/active-...

Re: Texas students fake GPS signals and take control of an $80 million yacht

#100
post #14

Earlier quoted context omitted.

I disagree, on two counts. First, the fact that expensive machines can be brought down by cheap components is still interesting. Nobody will really care if your $80 cell phone can be spoofed. Second, GPS receivers are not all the same. There are many different techniques you can use to make your receiver more resilient against spoofing, from cheap and easy things like adding Galileo and GLONASS support to crazy expen…

On the topic of not being aware of the "spoofability" of GPS, it is interesting to note that many of the older Inertial Navigation Systems (GPS + IMU) use GPS to check against the accelerometers and gyroscopes in the IMU. Effectively, they would throw out the results from the internal dead-reckoning system if it didn't agree with GPS, instead of the other way around! I guess it has more to do with the fact that unles…

In such a system, what's the point of having the IMU at all? Is it just for the case when GPS becomes completely unavailable?

If I were designing such a system (and I'm sure I've overlooked about a million subtleties), I imagine I would make it so that the GPS corrects the IMU for small perturbations that lie roughly within the IMU's predicted error budget, and that the IMU causes the GPS to be ignored if the GPS coordinates suddenly diverge greatly.

In other words, the IMU is going to be saying something like, "our position is X, to within 5km". If the GPS disagrees with X by 1km or perhaps even 10km, correct the IMU's current state using the GPS. If the GPS disagrees with X by 100km, ignore the GPS until it gets its act together.

Seems like a decent first pass, at least.

Post reply on HN