Today we're going to be discussing GNSS vulnerabilities, also known as GPS system, that we all come to rely on every single day.
There's a few different classes of vulnerabilities.
The most common one that you typically see in the news is GPS spoofing.
That's essentially locating somebody in a location or a time other than where they actually are.
Typically, the news articles and news headlines cover changing location, but changing time is actually a lot more common than attacks that you typically see and can actually lead to a lot more issues in the real world.
Then we obviously have GPS jamming.
It's a much simpler attack, and simply what it means is the denial of the ability to receive accurate and consistent GPS signal.
And, of course, we actually see cyber attacks against the infrastructure.
It actually broadcasts and retransmits the GNSS signal.
And the rebroadcast of GNSS signal is something that we're going to touch upon in the next few slides.
So a quick breakdown.
Typically, when you talk about GPS, you just talk about the birds, the satellites.
But the ground control tower is a very important element.
Without the constant ground correction to the GPS satellites, the accuracy would start to degrade.
First, the first.
And then, of course, the first week or so, you might not even notice the difference.
Within two to three weeks, the accuracy could be down to a few hundred feet.
Then it would drift to miles, and, eventually, you would lose the ability to accurately calculate your GPS position.
We've seen electronic attacks against the actual ground control systems.
We've seen attempts at people actually trying to control the birds, which are typically controlled by the U.S. Air Force.
In the next few slides, you're going to see some data.
We do run a worldwide monitoring network.
The data that we're going to show you is highly sanitized.
We did scrub the data from the most sensitive sensors.
I actually pulled it out of my data set.
So if you happen to be one of our clients in a confidential facility, your data is not going to be in here.
So this is a rough breakdown of where our sensors are.
They're grayed out areas.
Either it does not have sensors.
Or it doesn't have sensors.
We're going to disclose.
The dark areas, we do have sensors.
And we do have attacks that were detected.
And the red areas is where we have the largest number of attacks.
As you can see, when the slides were taken, we had 799 attacks that were detected within the time window within the United States.
Moving over to South Korea, we saw 1,200 active attacks happening in that region.
That's primarily because of some of their neighbors.
Not to point fingers, but North Korea and China.
So what is an attack?
What does it look like?
The most typical jamming attack is what we call the sawtooth signal.
This is what a low-end jammer would generate.
Either this or that.
So you could actually see that this has...
This is a clock-controlled radio, where this was just oscillator-controlled.
These are the low-end jammers, fairly unsophisticated.
Now, this is actually one of my favorite ones.
That's actually a duty cycle radio.
What it does is, it actually waits for the GPS broadcast from the satellite.
And it syncs its transmit with the same time as the broadcast.
So it actually allows its own radio to cool down.
And perfectly jam the GPS signal.
So it's actually using the GPS signal to sync its own clock to conduct a jamming attack.
Which is pretty funny.
Because you have a GPS-controlled GPS jammer.
So the source for some of our captures.
So that's a GSS-200.
The one that was actually hijacked by my company.
The GSS-100.
And it's a GPS jamming detector.
As I mentioned, we have a worldwide network of them.
What it does is, it has an antenna that measures the time of arrival of the signal,
the angle of arrival, and the direction of arrival of the signal.
They're placed in stationary locations.
They have a network uplink.
And what we do is, by us knowing where the GPS satellites are located,
and the signal that we expect to receive at any given time,
we compare it with the signal we're actually receiving.
So we're able to measure RF interference.
And we're able to detect spoofing events.
Because we know where the signal should be coming from and what it should look like.
And we measure the differential between that.
Now, why is this important?
Because when the GPS signal gets hijacked, that kind of stuff happens.
And that's a US QR-107.
One of our most advanced spy drones at the time.
That was hijacked by Iran.
So the spy electronics on board that plane are very advanced.
However, it had a fairly effective...
Is that an issue?
Thank you.
It has a fairly advanced navigation system.
However, if the command control system was jammed, it would fall back to the GPS system.
So what Iran did is they jammed the command control signal from our bunkers in Nevada.
And then they broadcast a fake GPS signal telling the drone that it was actually located...
Over its base where it was launched from.
And the drone went into auto-land mode.
The reason the bottom is covered up is because they actually got the elevation for the area wrong.
And when it landed, it tore off the landing gear.
So, getting back to jamming.
We have the RF jamming.
Which is simple denial of the signal.
That's the signal that you saw.
You have the L1 signal.
L2.
And as I mentioned, I love the area research of...
That can touch upon mass casualty events.
You have the L5.
Which is the safety of life.
If a civilian aircraft was to go in for a landing and is using GPS assist, L5 is the signal it would trust.
It broadcasts at roughly three times the power of the L1, L2 signal.
It has more reach.
It is a more accurate signal.
When you're talking about RF jamming...
Well, this is simple radio jamming.
It's also possible to RF protocol jamming.
You could actually broadcast a signal that looks a lot like the GPS signal.
But it actually sends characters of the wrong length, wrong type.
You could broadcast a signal to make one of the signals appear to be less accurate.
So, for example, if a GPS broadcast is claiming to have 14 for the accuracy.
You could actually broadcast a signal that would make the accuracy appear to be 50 feet, 200 feet.
And obviously more data for aircraft.
You could actually give the aircraft...
More confidence in the signal.
You could take a signal that claims to be 30 feet accurate or 10 meter accurate.
And actually tell it that it has 2 centimeter resolution.
Which is not realistic.
But you as a human is not the one that's interpreting the signal.
Your onboard system is what's interpreting it.
And obviously you could place it to be somewhere else.
So, a quick breakdown.
That's what the GPS satellite would look like.
Satellite...
A GPS satellite network would look like at any given time.
The green dots going down would be updates from the ground control stations.
Sending a ledger update to the birds in the sky.
And the GPS works by triliteration.
Meaning your device gets at least 3 signals from at least 3 birds or any ground station assists.
The more signal...
The more data points you're receiving.
The more accurately you're able to look at yourself on the ground.
This is what your ground reception unit would see.
You have the signal strength from a number of birds.
And you have your exact date and time.
Altitude.
Signal quality indicator.
And the indication of how accurately it can position yourself.
So as you see it's a 2D fix.
Meaning it's actually a vehicle GPS and not an airborne unit.
This gets really fun.
Because people will do anything that JRGPS tells them.
People will drive down boat ramps.
People will actually drive right off the docks.
People will drive deep into the desert over unpaved roads.
Because their GPS tells them in a nice soothing voice.
Make a left.
Continue 20 miles.
Autonomous airborne platforms will do the same thing.
By spoofing the signal you can actually locate them in a different grid.
There was an event last year.
Where the military was conducting GPS jamming tests.
There was a 500 mile radius.
No go zone.
Well it wasn't a no go zone.
But it was an area where civilian aircraft and civilian users were advised that GPS would be unavailable.
The notam advisories went out over three weeks in advance.
Everyone knew the GPS jamming event was going to be in progress.
A civilian airliner was still relying on the GPS.
For some reason the pilot wasn't paying attention.
He ended up 20 miles off course.
And there was actually an FAA near collision warning that went out.
Because he didn't have GPS signal.
It was just not an accurate GPS signal.
We do see GPS spoofing happening with ships.
The most common occurrence we've actually seen is off the coast of Africa.
Where we do see a lot of pirate activity.
We do see pirates conducting GPS jamming attacks.
GPS spoofing attacks.
And AIS ship hijacks.
So ships have a system that's built in with their radio.
It's supposed to prevent collisions.
A ship constantly broadcasts using a protocol called APRS.
Automatic Position Reporting System.
It's the ship's name, direction, speed of travel.
And pirates actually jam those broadcasts.
So when they attack the ships, the nearby ships don't have an accurate fix on that ship.
They have the last known location before jamming occurred.
They also hijack the AIS radios of the ships they captured.
They pretend to be a legitimate vessel.
So they can get close to the ship before they start their attack.
Now if you're a pirate, you could simply cause a vessel to run into a hazard.
And then you could steal the crew, steal the cargo.
And if you're a malicious government, you can even steal U.S. sailors.
Again, another real unfortunate incident.
The culprit was once again Iran.
The U.S. crew claims the GPS puts them safely into international waters.
Iran claims that the U.S. vessel was within Iran's territorial waters.
There's a good chance that Iran was lying, as usual.
However, there is a distinct possibility that there was GPS spoofing happening.
And that, in fact, both sides are claiming that they were where they were.
And they actually do believe that.
We did quite a bit of research.
You saw my black hat presentation.
We actually went as far as hunting down some of the sources of GPS jamming.
So these are some of the...
stats that we gathered.
This was for the United States.
Northeast region.
California area.
As well as an area of England around London.
One of my...
One of the interesting areas is assholes.
We've seen civilians with high-powered GPS jammers.
Some of those jammers are actually not just GPS jammers.
But they're also cell phone jammers.
They're wideband radios.
It's very common for them to actually have four radios built in onboard.
So they're typically jamming cell phone, GPS, and Wi-Fi.
In the United States, we do have a number of laws that make it a federal felony to conduct this kind of jamming.
And they do carry consequences, including actually a fairly lengthy prison term and very high fines.
I'm not going to bore you with reading through all of that.
But you definitely shouldn't do it.
If you do capture U.S. government attention, you're going to win a date with this gentleman.
He is a federal agent.
He does investigate the source stuff.
I do get to work with him closely, unfortunately.
How easy are they to obtain?
Well, very easy.
It does ship to the United States.
And it costs less than a lot of company launches.
Now this bad boy.
This is the kind of stuff that you see military units deploying.
These can actually be mounted as recon pods in helicopters and aircraft.
They can be dropped in somewhere before an assault.
That is a 320 watt unit from what I recall.
Just one problem.
That one is actually also a Chinese jammer that's for sale.
A little bit more expensive.
But still fairly affordable.
The price code I got for it was I believe either $1800 in bulk or $2200 a single unit sample.
This is car hacking village talk.
So going back to cars.
The GPS that you have in your vehicle shows you it's traveling down a road.
It shows you a nice neat little line.
What it is is actually a sweet little line.
There's a concept called GPS drift.
If you have a proper GPS that actually maps you on the grid, you'll see that there's a lot of jitter.
If you're getting an actual GPS signal, I mentioned accuracy.
What you see is a line moving back and forth and actually drawing almost a circle.
And that circle is the accuracy of your current GPS position.
Which means if you have a GPS that is plotting you accurately, even though you're traveling in one direction,
you're going to see some jitter.
So for example in that case, we had 270 meter accuracy.
But if you're traveling in an open ocean, that's perfectly acceptable.
As long as you know that the yoke of the yacht was not moving.
Any questions?
What about defense?
Do you have recommendations on...
What should the government do to...
...GPS externalities of the government?
The best defense is not blindly trusting the system, not blindly trusting the GPS,
and actually thinking about where your GPS is showing you.
If you know that you're supposed to be driving 287, getting onto northbound ramp,
and your GPS is telling you to get onto southbound ramp, don't blindly trust your GPS.
There's a few things that the government can actually do.
To track down the sources of jamming.
So there is, as I mentioned, there are several worldwide networks that do detect GPS jamming.
But not a lot happens to actually track down the offenders.
And it is fairly trivial to do.
On an earlier slide you mentioned protocol attacks and buffer overflows.
Can you go into that in any more detail?
Yeah, so we actually have seen attacks against the satellite network and against the ground stations.
Before actually trying to attack the connected infrastructure.
That controls the satellite network.
We do see some fairly advanced attacks against the car head units.
Where people are actually creating malicious GPS file updates for vehicles.
We've seen a number of attacks against Subarus about two months ago.
Where there were buffer overflows in the head units.
People could load it up through USB drive.
We've seen a number of attacks against some of their competitors as well.
Can you see any ways to use...
consumer level hardware to either detect GPS abnormalities.
Or detect and report GPS abnormalities.
Say for example a cell phone app or something like that.
Is that a possibility?
Great question.
So by actually having more than one GPS receiver.
And synchronizing the antennas.
Or using a hacker app.
Sorry, not a hacker app.
A blader app within the right.
If you place it at a known location.
At a known angle.
You can actually monitor the GPS signals in an area.
And as I mentioned there's a GPS drift.
Once the drift either changes significantly.
Or you start getting a perfect signal.
That could be a pretty good indicator of an attack.
Also on the ground level.
If you're working with software defined radio.
GPS looks like background noise.
You actually need to use the time signal to go back.
And pick GPS out of the line noise.
Once you start getting a GPS signal.
That actually comes out.
Outside the range of ambient noise.
That's a pretty good indicator of actually.
A malicious transmitter being nearby.
Yes.
Can you say anything about jamming and spoofing.
Of GNSS signals other than GPS.
Like low mass and stuff like that.
I have not done a ton of research about that.
Primarily because I'm in the United States.
And I care about the US GPS network.
But if you are looking at Neptune systems.
Etc.
Primarily I'm going to be looking at attacks against the Russian systems.
Primarily because, well, they're an enemy.
So you've shown equipment that contributes to jammed GPS.
How about spoofing GPS?
What would it mean to actually put across GPS?
So there's a number of solutions for that.
And I do mean solutions.
So there are blade RF setups that I've seen.
That are pretty good at it.
You do need a fairly beefy computer to be able to do that.
A simple Raspberry Pi is not really going to be enough.
But with a small nook.
You can make remote nodes that are sufficiently powerful.
The organization I work for actually creates GPS simulators.
That you could use in your lab for legitimate testing.
They crank out roughly double the power of what you would typically see of a GPS cell in the bottom.
If somebody were to get their hands on one.
And a decent RF amp.
And the correct antenna.
You could definitely create your own little macro environment.
Hypothetically.
Yes, in the back.
For the map you showed at the beginning.
With the jamming attacks.
What was the time period for that?
That was one week.
One week.
And that was taken two weeks before my blackout slides were due.
Yes.
I was just wondering.
So you don't do PSA with the Galileo.
The ClonidX section.
Because I mean.
According to one side.
You can actually start seeing the difference.
Because I'm not aware of any simulator software.
But ClonidX and the Galileo.
Why don't you use the GPS simulator.
So yeah.
So we have GPS simulators.
And GPS emulators.
Even.
So our simulators.
What we could do is.
We typically.
We'll drive around an area.
And we'll record the GPS data.
And what we could do.
Is we could sync it up with a real time clock.
And play it back.
With the current time stamp.
I don't know if you could do it with the Galileo.
But we could definitely do a playback.
Just as a raw RF.
So I'm familiar with the news articles.
Our network is.
Needs a stationary position.
If you don't have anything on board the ships.
However.
Some governments.
Well.
Many governments.
Have the hardware.
To do GPS spoofing.
And GPS jamming.
And there are legitimate reasons for doing it.
So.
I have no data at all.
About that event.
So.
I have.
Exactly the same news articles.
That you do.
Yes.
That's an excellent question.
Yes.
I did forget to.
Touch those points.
You've seen attacks.
Against data centers.
Data centers.
That process.
Financial transactions.
Data centers.
That are known.
To deal with.
Bitcoin.
And crypto ledger.
They typically.
Have GPS antennas.
On the roof.
And they're using it.
For log.
Consistency.
And you see people.
Conducting.
Data.
Spoofing.
Jamming.
And spoofing.
Attacks.
To try.
And effect.
Financial transactions.
Of stocks.
Bonds.
And as I mentioned.
Ledger transactions.
People actually.
Set up hardware.
Or.
Bring vehicles.
Onto the parking lots.
Of those data centers.
Any more questions?
Yes.
How redundant.
Are the.
The ground control stations.
Particularly.
On location.
Multiple locations?
There are multiple locations.
But primary one.
Is at Cheyenne Mountain.
Where.
The home.
Of U.S.
Space Command.
So.
If.
Everything.
Is working.
Correctly.
Typically.
That.
Actual.
Space.
Command.
Is based.
There.
And we have.
A number.
Of stations.
To.
Broadcast.
The signal.
And.
Some.
Of the.
Attacks.
We've.
Seen.
Are.
Obviously.
More.
To.
Broadcast.
A.
Stronger.
Signal.
Where.
They.
Try.
And.
Play.
Timing.
Games.
Where.
They're.
They'll.
Point.
The.
Azimuth.
And.
Try.
To.
Track.
The.
Satellite.
First.
Before.
The.
Station.
Yes.
So.
There's.
Been.
Talk.
About.
In.
The.
Non.
Crypto.
Bus.
Signed.
A.
GPS.
Signal.
Something.
Similar.
To.
M.
Code.
Like.
What.
The.
Military.
Is.
Doing.
There.
Supposed.
To.
Be.
Around.
2014.
And.
2016.
Now.
It's.
2018.
I.
Think.
Before.
We.
Have.
More.
UAVs.
In.
Civilian.
Space.
We.
Are.
We.
Need.
To.
Do.
Something.
To.
Help.
To.
Help.
Using.
A.
Number.
Of.
Networks.
Actually.
Would.
Help.
And.
The.
Systems.
You.
Describe.
Me.
I.
Do.
Believe.
They.
Have.
A.
Ground.
Element.
Just.
Actually.
Control.
It.
Gives.
You.
A.
More.
RF.
Output.
Than.
The.
Bird.
That's.
Hundreds.
Of.
Miles.
Up.
In.
The.
Sky.
So.
Actually.
Do.
Like.
That.
Idea.
Some.
Of.
Specs.
Do.
Call.
For.
Ground.
Stations.
Like.
Lauren.
But.
I'm.
Not.
Sure.
What.
They.
Actually.
Implement.
All.
Right.
I.
Believe.
I.
Know.
The.
Room.
To.
Next.
Speaker.
If.
Want.
To.
Catch.
Me.
Outside.
With.
Any.
More.
Questions.
And.
We're.
Going.
To.
Be.
In.
Our.
Hacking.
Village.
Table.