[00:07.740 --> 00:12.000] Hello, I'm Harshad Sathaye from Northeastern University, Boston. [00:12.000 --> 00:14.920] Today we are going to look at some basic attacks on GPS. [00:15.880 --> 00:21.100] This talk is adopted from a wireless security course taught by Professor Anjan Randhanathan [00:21.100 --> 00:26.780] at Northeastern University and similar courses taught at ETH Zurich and EPFL. [00:26.940 --> 00:33.120] In 2011, Iran became the first country officially to announce GPS spoofing capability as they [00:33.120 --> 00:38.020] hijacked a US drone operating along the borders. Soon after that, Professor Humphries from [00:38.020 --> 00:42.560] University of Texas, Austin demonstrated a similar attack. There are several reports [00:42.560 --> 00:47.740] of GPS spoofing, including an incident where two naval ships were being steered off course. [00:48.120 --> 00:52.280] There have been instances of appearance of intriguing crop circles and ghost ships in [00:52.280 --> 00:57.920] Shanghai. GPS is used not only for navigation and positioning, but also for precise timing [00:57.920 --> 01:03.560] and synchronization. A paper published in 2012 evaluated the effects of GPS spoofing [01:03.560 --> 01:08.140] on power grids and concluded that they are extremely vulnerable to timing attacks. [01:08.760 --> 01:13.440] In today's world, the use of GPS can be encountered everywhere, including critical [01:13.440 --> 01:18.380] cyber-physical systems like power grids, autonomous vehicles, and avionics. Widespread [01:18.380 --> 01:23.120] availability of open source tools and cheap off-the-shelf equipment has made GPS attacks [01:23.120 --> 01:31.260] quite trivial. GPS is a satellite-based navigation system which contains about 31 [01:31.260 --> 01:35.840] satellites orbiting the Earth. Each satellite transmits navigation messages which contain [01:35.840 --> 01:41.280] its location and precise timing information. Each satellite uses a unique pseudo-random [01:41.280 --> 01:46.120] code for encoding the messages. The receiver on ground measures the time of arrival of [01:46.120 --> 01:50.940] these messages and estimates the distance to the respective satellite. These estimates, [01:50.940 --> 01:58.860] are used for computing the location. GPS is made up of three segments. First is the space [01:58.860 --> 02:03.840] segment. It consists of satellites that transmit the essential information required to calculate [02:03.840 --> 02:08.660] the location, the user segment, which uses the information transmitted by the satellites to [02:08.660 --> 02:13.160] compute its location, and the control segment, which is used for making time and ephemeris [02:13.160 --> 02:20.580] corrections. The orbits of the satellites are programmed such that at any time, at least [02:20.580 --> 02:25.560] four satellites are visible and can provide location services. These orbits are controlled [02:25.560 --> 02:31.980] by the control segment on ground. There are primarily four signals available for civilian [02:31.980 --> 02:41.340] use. L1CA, L2C, L5, and L1C. L1CA is a legacy signal which is broadcasted by every satellite. [02:41.340 --> 02:46.120] The rest are modernized signals. There are also some special restricted and encrypted signals [02:46.120 --> 02:51.100] which offer better precision. However, these are reserved for military and its interests. [02:51.540 --> 02:59.120] Here we will be mainly focusing on civilian GPS L1CA signal. The carrier frequency is set at 1.57542 [02:59.120 --> 03:06.000] gigahertz. Data is modulated on the carrier using binary phase shifting technique. In DPSK, carrier's [03:06.000 --> 03:12.160] phase is switched by 180 degrees to present a one and a zero. Bandwidth of civilian GPS is about [03:12.160 --> 03:19.840] two megahertz. Civilian GPS uses 1023 bits coarse acquisition spreading codes sampled at 1.023 [03:19.840 --> 03:28.000] megahertz. Each satellite transmits at about 43.4 dbm. As a result of spreading and long distance, [03:28.000 --> 03:33.000] signal strength at the receiver can be as low as minus 130 dbm, which is fairly below the nice [03:33.000 --> 03:38.960] floor. However, the implementation offers a 43 db processing gain after the signal is processed by [03:38.960 --> 03:43.800] the receiver. This can be increased by use of directional and smart antennas. [03:45.120 --> 03:50.380] The transmitter first generates a baseband signal sampled at 50 bps, which is combined [03:50.380 --> 03:56.120] with the CA code sampled at 1 mbps. This spreaded message is then modulated on the carrier before [03:56.120 --> 04:06.140] transmitting. Let's take a look at the navigation message. Each navigation message has 25 frames. [04:06.140 --> 04:12.720] It takes 12.5 minutes for transmission of entire message. A frame has 1500 bits and [04:12.720 --> 04:18.080] takes about 30 seconds. It is divided into five subframes, each with 300 bits. [04:18.920 --> 04:24.180] Start of a subframe is marked by a telemetry word, which has an 8-bit preamble, which marks [04:24.180 --> 04:29.980] the beginning of the subframe and handover word each of 30 bits. Time of week marks the week [04:29.980 --> 04:38.330] number since the epoch and is used for timing information. Now let's look at the receiver [04:38.330 --> 04:43.890] design. RF frontend converts analog signal to discrete samples, which can then be processed [04:43.890 --> 04:49.290] by the subsequent modules. In a software implementation, each satellite is assigned [04:49.430 --> 04:53.970] a channel, which can also be considered as hardware pipeline. Each channel performs [04:53.970 --> 05:00.850] similar operations. Acquisition block performs a two-dimensional search for a valid satellite [05:00.850 --> 05:06.070] signal by correlating the received signal with a local replica of each satellite's CA code. [05:06.310 --> 05:11.830] This search is performed in time domain as well as frequency domain. It is essential to search [05:11.830 --> 05:16.410] for the signal in frequency domain to account for Doppler shifts. If this search results in [05:16.550 --> 05:21.030] a correlation peak above a certain threshold, the receiver then switches to tracking and demodulating [05:21.030 --> 05:27.730] the signal. Tracking module is responsible for following the Doppler shift and code phase supplied [05:27.730 --> 05:32.850] by the acquisition module so that it can demodulate the signal. Obtained raw navigation [05:32.850 --> 05:38.610] bits are passed over to the PVT module. If at any given point the tracking loop loses a lock, [05:38.610 --> 05:45.430] the whole process is repeated. The PVT module is responsible for calculating position, velocity, [05:45.430 --> 05:50.930] and timing information. Common reception time technique provides pseudo range to the satellite, [05:50.930 --> 05:54.850] which is a rough estimate of the distance between the receiver and the satellite. [05:54.850 --> 05:59.950] A common reception time is set across all the channels for calculating the pseudo ranges. [06:00.070 --> 06:05.470] This time is maintained by sample counters implemented in the receiver. As the distance [06:05.470 --> 06:08.990] of the satellites from the receiver varies, the difference in time of arrival of messages [06:08.990 --> 06:13.650] from each satellite is used to calculate the relative range from the receiver to that satellite. [06:14.250 --> 06:18.870] Propagation time for the closest satellite is considered to be roughly 68 milliseconds, [06:18.870 --> 06:23.790] which is the approximate propagation time. In this case, message from satellite 3 arrives first [06:23.790 --> 06:28.090] and it is considered as a reference time, which is set across all the channels. [06:28.130 --> 06:32.310] Thus, propagation time for other satellites is calculated as TRX, which is the [06:32.310 --> 06:38.750] reference time, plus delta TN. This is a very elegant way of determining pseudo range. However, [06:38.750 --> 06:43.610] this gives rise to a major security concern. An attacker can fabricate signals with delayed [06:43.610 --> 06:48.850] messages as required. These measurements and the contents of the received messages are used [06:48.850 --> 06:56.690] to calculate the receiver's location. GPS position is determined by solving these equations [06:56.690 --> 07:03.290] for X, Y, and Z. Pseudo ranges determined using the common reception technique are the key in [07:03.290 --> 07:09.310] location determination. Given the speed of light, a delay of 1 nanosecond can lead to errors of up [07:09.310 --> 07:17.290] to 30 centimeters. There are two primary types of GPS attacks. Jamming attacks, where the attacker [07:17.290 --> 07:21.590] transmits high-powered noise, which causes a denial-of-service attack, and spoofing attacks, [07:21.590 --> 07:25.850] where the attacker transmits a signal such that the receiver calculates a false location. [07:26.090 --> 07:31.210] In this demonstration, we are going to take a deeper look at GPS spoofing attacks. [07:32.230 --> 07:36.950] An attacker transmits specially crafted signals, which are identical to the legitimate signals, [07:36.950 --> 07:42.130] except they are transmitted at a higher power and result in calculation of a false PVD solution [07:42.130 --> 07:47.610] or calculation of false time, as GPS is also used for precise timing and synchronization. [07:48.310 --> 07:53.530] Attackers can fake locations by either modifying the navigation messages or by manipulating the [07:53.530 --> 07:59.270] time of arrival of these messages. GPS is a simplex system. Hence, conventional security [07:59.270 --> 08:04.470] techniques, which require a handshake, do not work here, as the receiver has no way of interacting [08:04.470 --> 08:11.670] with the satellites. This makes it trivial for an attacker to generate fake signals or replay [08:11.670 --> 08:18.190] previously recorded signals to fool a receiver. An attacker modifies the navigation message [08:18.190 --> 08:22.850] content such that the receiver uses altered satellite positions for calculation of the [08:22.850 --> 08:28.070] PVD solution. Such an attack can be easily detected using external sources, as it is [08:28.070 --> 08:34.030] trivial to verify the validity of the received navigation messages. In the second method, [08:34.030 --> 08:39.010] the attacker keeps the message contents identical and instead manipulates the time of arrival of [08:39.010 --> 08:43.290] the messages, such that the pseudo-range calculations are altered. Such an attack is [08:43.290 --> 08:48.250] hard to detect. However, it requires access to real-time satellite ephemeris data. [08:50.090 --> 08:55.350] Let's take a look at one of the most sophisticated GPS attacks. In a seamless takeover attack, [08:55.350 --> 09:01.730] the attacker starts transmitting with lower power than the legitimate signal. It is important to [09:01.730 --> 09:06.010] note that the adversarial signals are tightly synchronized with the legitimate signals in time [09:06.010 --> 09:11.570] domain as well as frequency domain. Later, the attacker slowly starts increasing the power and [09:11.570 --> 09:17.370] overshadows the legitimate signal while maintaining synchronization. As a result, the receiver starts [09:17.370 --> 09:21.990] tracking the adversarial signals instead of the legitimate signals. Since the attacker's signal [09:21.990 --> 09:26.970] is stronger, the noise floor rises and the tracking loops are thrown off. Thus, the receiver breaks a [09:26.970 --> 09:31.890] lock. However, if the signals are synchronized, the lock is simply transferred. As for the receiver, [09:31.890 --> 09:36.670] the two signals are identical. Thus, the switch-off lock is near seamless and the receiver [09:36.670 --> 09:42.490] doesn't experience any kind of loss of lock. By nature, every receiver will lock on to the stronger [09:42.490 --> 09:47.530] signal. Once the lock is transferred, which happens instantaneously, the attacker starts [09:47.530 --> 09:55.700] introducing offsets, which takes the target off course. Increasing popularity of inexpensive [09:55.700 --> 10:01.820] software-defined radios has made executing GPS spoofing attacks quite straightforward. To execute [10:01.980 --> 10:07.040] a GPS spoofing attack, we need a baseband signal generator, which can generate GPS messages, [10:07.040 --> 10:12.680] perform spread spectrum operations, and modulation. It relies on broadcast fMRIS data of satellites [10:12.680 --> 10:17.580] and a set of coordinates to generate spoofing signals. Finally, we need a software-defined [10:17.580 --> 10:24.320] radio front-end, which can transmit data on 1.57542 GHz, which is the L1 carrier frequency. [10:25.420 --> 10:31.740] The demonstration setup includes a control unit, which runs the GPS baseband generator software. [10:31.820 --> 10:36.480] A USRP B210 is used to simulate legitimate and malicious satellites. [10:37.000 --> 10:42.480] This particular USRP supports simultaneous transmissions on two channels. The spoofer [10:42.480 --> 10:48.240] has power advantage of about 10 dB. This is achieved by setting appropriate RF gain on the [10:48.240 --> 10:53.420] spoofer transmission channel. The signals from these channels are combined using a signal combiner [10:53.420 --> 10:58.960] and are fed to a MuBlock GPS receiver, which is connected to a Raspberry Pi. Foxtrot GPS [10:58.960 --> 11:04.440] with OpenStreetMaps is used as a mapping and navigation software on the Raspberry Pi. [11:04.440 --> 11:10.460] Make sure that all the RF instruments are hardwired. USRP B210 is a fairly powerful [11:10.460 --> 11:15.380] transmitter. Since legitimate GPS signals are very weak, it can affect GPS services [11:15.920 --> 11:21.720] over quite a wide area. Hence, it is essential to ensure that there are no signal leakages. [11:24.160 --> 11:29.340] The first step is to generate a set of GPS coordinates, which will be used to generate [11:29.340 --> 11:34.560] GPS baseband signal. This can be achieved in multiple ways. In this case, we will plot the [11:34.560 --> 11:39.220] path using Google Earth and then use SatGen trajectory generation application to generate [11:39.220 --> 11:44.060] the trajectory, which will be interpreted by the GPS simulator. Let's mark the path [11:44.060 --> 11:51.420] by using the add path tool. In this scenario, let's just take the receiver around the block [11:51.420 --> 11:59.080] and bring it back to its original location. Once you are done adding the path, just save it, [11:59.080 --> 12:05.020] give it some name, and now we need to convert the path and store it as a KML file. [12:06.380 --> 12:08.460] All right, there we go. [12:10.520 --> 12:18.980] Now, in the second part, we have to generate NMEA data. For this, load this path. As you can see, [12:18.980 --> 12:25.800] it shows the displacement in terms of latitude and longitude in meters. Now, you can keep these [12:25.800 --> 12:31.330] dynamic setting parameters as default. Just make sure that you have a suitable stationary period. [12:32.080 --> 12:38.310] And once you are done, just click on generate NMEA and you can store your data as .NMEA file. [12:40.480 --> 12:50.950] All right, that's it. Now, over to step two. In the second step, we'll be using GPS SDR sim [12:50.950 --> 12:57.030] for generating GPS baseband data. We need to provide the simulator with the dynamic motion [12:57.030 --> 13:04.290] file, which is sampled at 10 hertz, a GPS broadcast FMRIS data, the sampling rate, [13:04.290 --> 13:10.410] which is 2 megahertz in this case, as this is the lowest that can be used for GPS, and then we have [13:10.410 --> 13:20.490] to provide the name of the output file. Now, it will take some time to generate the baseband data. [13:20.610 --> 13:26.990] As you can see, this shows the list of satellites that are visible from this location, their azimuth [13:26.990 --> 13:30.670] and the pseudo range to that particular satellite. [13:40.560 --> 13:45.080] All right, now we have our GPS baseband data. Now, over to step three. [13:48.500 --> 13:55.160] In step two, we generated a GPS baseband signal. In step three, we will be using a software-defined [13:55.160 --> 14:01.440] radio to transmit this signal. We have a simple GNU radio flow graph for transmission. This flow [14:01.440 --> 14:06.480] graph reads samples from a file source, converts it into GR complex, and sends the samples to a [14:06.480 --> 14:13.920] USRP sink. In this case, I'm using a USRP B210 for transmission. It supports transmission on [14:13.920 --> 14:17.960] two channels. The first channel transmits the legitimate signal, and second channel transmits [14:18.160 --> 14:23.900] a spoofing signal. This sink can be replaced by a software-defined radio of your choice. [14:23.900 --> 14:30.560] The only requirement is that it should be able to transmit at 2 mega samples on 1.57 gigahertz. [14:31.240 --> 14:34.580] Now, let's turn on the spoofer and observe what happens. [14:37.360 --> 14:43.840] Now, as soon as the spoofer is turned on, we will observe two things. First, the receiver will show [14:43.840 --> 14:50.320] some random motion as the signals interfere unpredictably, which results in a fake or [14:50.320 --> 14:58.040] garbage location. And second, there's a total loss of lock. One of the reasons being, whenever a [14:58.040 --> 15:04.180] receiver loses or isn't able to track a signal, it loses a lock and it takes some time for it to [15:04.180 --> 15:09.520] reacquire signals. Now, as soon as the signals are reacquired, you can see that the receiver [15:09.520 --> 15:20.400] starts following the spoof path that we generated in step one. GPS is a broadcast system, which means [15:20.400 --> 15:27.120] that it is unidirectional. It's a simplex system. There is no way for a receiver to interact or talk [15:27.120 --> 15:33.300] back to the satellites. Secure positioning and communication requires bidirectional communication [15:33.300 --> 15:38.560] for a secure handshake and for secure exchange of information. And it's also important to protect [15:38.560 --> 15:45.200] time of arrival of messages, which in this case is very challenging. Now, there are two types of [15:45.200 --> 15:50.200] spoofing detection and mitigation techniques for GPS. First is infrastructure countermeasures, [15:50.200 --> 15:55.700] where you need to change the entire infrastructure, which includes cryptographic solutions. And there [15:55.700 --> 16:02.700] are receiver-end countermeasures where it's enough just to modify the receiver. Let's look at these [16:02.700 --> 16:09.800] one by one. A secure GPS proposed by Marcus Kuhn uses asymmetric keys and hidden markers. [16:10.260 --> 16:15.180] Public keys of satellites are stored on the devices. The broadband receivers receive the [16:15.180 --> 16:20.260] entire band of signals. It is important to do so because the receiver isn't aware of the [16:20.460 --> 16:25.800] de-spreading codes just yet. The transmitter discloses the spreading code at a later time, [16:25.800 --> 16:30.840] which is signed by its private key. The receiver then verifies the signature and uses the received [16:30.840 --> 16:37.280] code to de-spread the previous signal. Such a solution prevents generation of fake signals. [16:37.280 --> 16:42.440] However, there are issues with efficiency and precise timing. Moreover, it is a logistical [16:42.440 --> 16:47.780] nightmare to deploy such a solution, as such a solution will require a complete overhaul of [16:47.780 --> 16:55.300] the entire GPS ecosystem. Researchers have proposed the use of multiple receivers for [16:55.300 --> 17:00.540] collective detection of spoofing. In this scheme, a constellation of receivers is observed. [17:00.540 --> 17:05.680] For successful spoofing, the attacker will have to spoof such that the constellation of receivers is [17:05.680 --> 17:11.040] maintained. This includes spoofing the receivers individually. Group spoofing is a known challenge [17:11.040 --> 17:17.280] associated with GPS spoofing, because let's say a spoofer starts transmitting and as a result of [17:17.500 --> 17:23.360] a single point of transmission, all the receivers will collapse into one point and thus it will be [17:23.360 --> 17:31.140] very easy for the receivers to detect that there's something malicious going on. Moreover, even though [17:31.140 --> 17:36.580] this solution is quite reliable and is efficient in detecting spoofing, there's a major [17:36.580 --> 17:44.520] drawback is that such a solution is not feasible for smaller vehicles. Signal characteristics can [17:44.520 --> 17:49.140] also be leveraged to efficiently detect spoofing, which are considered to be unique to a transmitter [17:49.140 --> 17:53.500] given the geographical placement of the transmitter. This can be used to distinguish [17:53.500 --> 17:58.500] between signals from a point transmitter like a spoofer and a satellite which is 20,000 kilometers [17:58.500 --> 18:04.100] away. A high power transmission increases the noise floor substantially. A sensitive receiver [18:04.100 --> 18:10.400] can easily detect sudden changes in noise floors. These variations can be attributed to a spoofing [18:10.400 --> 18:18.720] or a jamming attack. Recall the function of acquisition module. A correlation peak is formed [18:18.720 --> 18:25.220] for every occurrence of the CA code in the received signal. A receiver proposed in SPRE looks out for [18:25.220 --> 18:30.920] such peaks and based on separation between these peaks, it can detect spoofing. Even though it can [18:30.920 --> 18:36.380] detect a strong seamless takeover attack, it can only do so if the auxiliary peaks are visible. [18:36.380 --> 18:41.360] For example, if the attacker is very powerful, then the legitimate signals are buried under [18:41.360 --> 18:47.280] noise floor introduced by the adversarial signals, as is in this case where the second peak marked [18:47.280 --> 18:52.900] in green is barely visible. Here, the attacker has about 10 dB of power advantage. [18:54.300 --> 19:00.560] Here are some other spoofing detection techniques. Inertial sensors can track physical movements of [19:00.700 --> 19:06.580] a vehicle. However, they are notorious for drifts and biases which can introduce significant errors. [19:06.640 --> 19:12.880] Researchers have proposed various implementations involving extended Kalman filters where IMU [19:12.880 --> 19:18.940] sensors are combined with GPS. Inertial measurements are used to track and validate [19:18.940 --> 19:25.400] the derived PVD solutions. Cross correlation between unknown encrypted GPS signals on L1 [19:25.400 --> 19:31.360] carrier and known open source GPS signals can lead to effective spoofing detection strategy. [19:32.100 --> 19:37.920] Another simple spoofing detection strategy involves comparison of PVD solution obtained [19:37.920 --> 19:42.220] from GPS with PVD solution obtained from other satellite navigation systems [19:42.220 --> 19:48.400] like GLONASS, Galileo, or Baidu. However, an attacker can simply spoof other systems as well [19:48.400 --> 19:54.500] as these systems are also vulnerable to similar attacks. Receiver Autonomous Integrity Monitoring [19:54.500 --> 20:00.960] or RAIM is a spoofing detection technique that is very popular in aviation. Almost every commercial [20:00.960 --> 20:07.100] aviation GPS receiver implements RAIM. It works on detecting outlier satellites. These satellites [20:07.100 --> 20:12.760] are excluded from PVD calculation. Thus, it requires six or more visible satellites. [20:15.040 --> 20:20.440] Several of the countermeasures that we discussed are effective. However, they aren't perfect. We [20:20.440 --> 20:27.100] all know that a perfect security solution just doesn't exist. In case of crypto solutions, [20:27.100 --> 20:33.060] they are vulnerable to replay attacks. Consider a scenario where a spoofer has a receiver in [20:33.060 --> 20:39.780] location 1 and a transmitter in location 2. There is a medium available such that the receiver [20:39.780 --> 20:46.340] can transmit raw RF samples to the transmitter. Here, the transmitter simply transmits or [20:46.340 --> 20:53.140] replays the received samples in location 2. Now, any receiver in location 2, if starts receiving [20:53.140 --> 20:58.960] GPS signals, then the calculated solution will reflect location 1 instead of location 2. [21:00.040 --> 21:07.660] Since GPS is a simplex and a unidirectional system, such attacks cannot be prevented by crypto. [21:07.720 --> 21:14.560] Moreover, it's virtually impossible to protect a physical characteristic of a signal like the [21:14.560 --> 21:25.830] time of arrival. There are solutions which couple INS or inertial navigation systems with GPS. [21:25.830 --> 21:33.070] However, recently, two years ago, there was work which involved integrated GNS and INS spoofing. [21:33.070 --> 21:38.470] In this work, the authors were able to spoof and take the vehicle, of course, [21:38.470 --> 21:44.610] by about 10 kilometers. In our experimentations, we found that throttling GPS spoofing offsets [21:44.610 --> 21:51.490] can also lead to pooling extended Kalman filters. The inertial sensors are prone to errors and [21:51.490 --> 21:57.530] biases. We exploit these errors and we throttle our attacks such that the extended Kalman filter [21:57.530 --> 22:04.410] adapts to our spoofing coordinates. And thus, such attacks can go undetected, even in a tightly [22:04.410 --> 22:12.590] coupled INS and GPS system. Now, as you have seen the countermeasures and how trivial it is [22:12.590 --> 22:19.690] to spoof GPS, it's important to note that GPS being a unidirectional system, it is not trivial [22:19.690 --> 22:26.530] to come up with solutions which can secure or safeguard GPS against a plethora of [22:26.530 --> 22:30.230] these spoofing attacks. Thank you.