WEBVTT 00:07.740 --> 00:12.000 Hello, I'm Harshad Sathaye from Northeastern University, Boston. 00:12.000 --> 00:14.920 Today we are going to look at some basic attacks on GPS. 00:15.880 --> 00:26.780 This talk is adopted from a wireless security course taught by Professor Anjan Randhanathan at Northeastern University and similar courses taught at ETH Zurich and EPFL. 00:26.940 --> 00:36.300 In 2011, Iran became the first country officially to announce GPS spoofing capability as they hijacked a US drone operating along the borders. 00:36.300 --> 00:41.500 Soon after that, Professor Humphries from University of Texas, Austin demonstrated a similar attack. 00:41.500 --> 00:47.740 There are several reports of GPS spoofing, including an incident where two naval ships were being steered off course. 00:48.120 --> 00:53.200 There have been instances of appearance of intriguing crop circles and ghost ships in Shanghai. 00:53.600 --> 00:59.480 GPS is used not only for navigation and positioning, but also for precise timing and synchronization. 00:59.480 --> 01:08.140 A paper published in 2012 evaluated the effects of GPS spoofing on power grids and concluded that they are extremely vulnerable to timing attacks. 01:08.760 --> 01:17.900 In today's world, the use of GPS can be encountered everywhere, including critical cyber-physical systems like power grids, autonomous vehicles, and avionics. 01:17.960 --> 01:24.560 Widespread availability of open source tools and cheap off-the-shelf equipment has made GPS attacks quite trivial. 01:27.280 --> 01:33.060 GPS is a satellite-based navigation system which contains about 31 satellites orbiting the Earth. 01:33.060 --> 01:38.800 Each satellite transmits navigation messages which contain its location and precise timing information. 01:38.880 --> 01:43.460 Each satellite uses a unique pseudo-random code for encoding the messages. 01:43.520 --> 01:49.780 The receiver on ground measures the time of arrival of these messages and estimates the distance to the respective satellite. 01:50.000 --> 01:54.140 These estimates, are used for computing the location. 01:55.620 --> 01:58.020 GPS is made up of three segments. 01:58.020 --> 01:59.700 First is the space segment. 01:59.700 --> 02:14.160 It consists of satellites that transmit the essential information required to calculate the location, the user segment, which uses the information transmitted by the satellites to compute its location, and the control segment, which is used for making time and ephemeris corrections. 02:16.120 --> 02:24.260 The orbits of the satellites are programmed such that at any time, at least four satellites are visible and can provide location services. 02:24.260 --> 02:27.900 These orbits are controlled by the control segment on ground. 02:28.660 --> 02:32.900 There are primarily four signals available for civilian use. 02:32.900 --> 02:36.840 L1CA, L2C, L5, and L1C. 02:36.880 --> 02:41.340 L1CA is a legacy signal which is broadcasted by every satellite. 02:41.340 --> 02:43.200 The rest are modernized signals. 02:43.200 --> 02:47.920 There are also some special restricted and encrypted signals which offer better precision. 02:47.920 --> 02:51.100 However, these are reserved for military and its interests. 02:51.540 --> 02:55.620 Here we will be mainly focusing on civilian GPS L1CA signal. 02:55.620 --> 03:00.220 The carrier frequency is set at 1.57542 gigahertz. 03:00.220 --> 03:04.380 Data is modulated on the carrier using binary phase shifting technique. 03:04.400 --> 03:10.180 In DPSK, carrier's phase is switched by 180 degrees to present a one and a zero. 03:10.180 --> 03:13.400 Bandwidth of civilian GPS is about two megahertz. 03:13.400 --> 03:21.040 Civilian GPS uses 1023 bits coarse acquisition spreading codes sampled at 1.023 megahertz. 03:21.600 --> 03:25.360 Each satellite transmits at about 43.4 dbm. 03:25.360 --> 03:33.840 As a result of spreading and long distance, signal strength at the receiver can be as low as minus 130 dbm, which is fairly below the nice floor. 03:33.840 --> 03:39.860 However, the implementation offers a 43 db processing gain after the signal is processed by the receiver. 03:39.860 --> 03:43.800 This can be increased by use of directional and smart antennas. 03:45.120 --> 03:53.080 The transmitter first generates a baseband signal sampled at 50 bps, which is combined with the CA code sampled at 1 mbps. 03:53.080 --> 03:57.300 This spreaded message is then modulated on the carrier before transmitting. 04:00.400 --> 04:03.440 Let's take a look at the navigation message. 04:03.440 --> 04:06.140 Each navigation message has 25 frames. 04:06.140 --> 04:10.380 It takes 12.5 minutes for transmission of entire message. 04:10.600 --> 04:14.500 A frame has 1500 bits and takes about 30 seconds. 04:14.560 --> 04:18.080 It is divided into five subframes, each with 300 bits. 04:18.920 --> 04:28.540 Start of a subframe is marked by a telemetry word, which has an 8-bit preamble, which marks the beginning of the subframe and handover word each of 30 bits. 04:28.540 --> 04:33.820 Time of week marks the week number since the epoch and is used for timing information. 04:36.870 --> 04:39.410 Now let's look at the receiver design. 04:39.730 --> 04:46.390 RF frontend converts analog signal to discrete samples, which can then be processed by the subsequent modules. 04:46.450 --> 04:52.870 In a software implementation, each satellite is assigned a channel, which can also be considered as hardware pipeline. 04:53.070 --> 04:55.590 Each channel performs similar operations. 04:57.230 --> 05:06.070 Acquisition block performs a two-dimensional search for a valid satellite signal by correlating the received signal with a local replica of each satellite's CA code. 05:06.310 --> 05:10.590 This search is performed in time domain as well as frequency domain. 05:10.610 --> 05:15.210 It is essential to search for the signal in frequency domain to account for Doppler shifts. 05:15.210 --> 05:22.090 If this search results in a correlation peak above a certain threshold, the receiver then switches to tracking and demodulating the signal. 05:22.990 --> 05:31.790 Tracking module is responsible for following the Doppler shift and code phase supplied by the acquisition module so that it can demodulate the signal. 05:31.790 --> 05:35.270 Obtained raw navigation bits are passed over to the PVT module. 05:35.270 --> 05:40.390 If at any given point the tracking loop loses a lock, the whole process is repeated. 05:41.290 --> 05:46.910 The PVT module is responsible for calculating position, velocity, and timing information. 05:47.470 --> 05:54.850 Common reception time technique provides pseudo range to the satellite, which is a rough estimate of the distance between the receiver and the satellite. 05:54.850 --> 05:59.950 A common reception time is set across all the channels for calculating the pseudo ranges. 06:00.070 --> 06:04.510 This time is maintained by sample counters implemented in the receiver. 06:04.730 --> 06:13.650 As the distance of the satellites from the receiver varies, the difference in time of arrival of messages from each satellite is used to calculate the relative range from the receiver to that satellite. 06:14.250 --> 06:21.150 Propagation time for the closest satellite is considered to be roughly 68 milliseconds, which is the approximate propagation time. 06:21.150 --> 06:28.090 In this case, message from satellite 3 arrives first and it is considered as a reference time, which is set across all the channels. 06:28.130 --> 06:35.110 Thus, propagation time for other satellites is calculated as TRX, which is the reference time, plus delta TN. 06:35.170 --> 06:38.210 This is a very elegant way of determining pseudo range. 06:38.210 --> 06:41.430 However, this gives rise to a major security concern. 06:41.430 --> 06:45.250 An attacker can fabricate signals with delayed messages as required. 06:45.410 --> 06:51.090 These measurements and the contents of the received messages are used to calculate the receiver's location. 06:53.090 --> 06:59.010 GPS position is determined by solving these equations for X, Y, and Z. 06:59.330 --> 07:04.830 Pseudo ranges determined using the common reception technique are the key in location determination. 07:04.950 --> 07:10.810 Given the speed of light, a delay of 1 nanosecond can lead to errors of up to 30 centimeters. 07:12.970 --> 07:15.810 There are two primary types of GPS attacks. 07:15.810 --> 07:25.850 Jamming attacks, where the attacker transmits high-powered noise, which causes a denial-of-service attack, and spoofing attacks, where the attacker transmits a signal such that the receiver calculates a false location. 07:26.090 --> 07:31.210 In this demonstration, we are going to take a deeper look at GPS spoofing attacks. 07:32.230 --> 07:47.610 An attacker transmits specially crafted signals, which are identical to the legitimate signals, except they are transmitted at a higher power and result in calculation of a false PVD solution or calculation of false time, as GPS is also used for precise timing and synchronization. 07:48.310 --> 07:55.550 Attackers can fake locations by either modifying the navigation messages or by manipulating the time of arrival of these messages. 07:56.030 --> 07:58.030 GPS is a simplex system. 07:58.030 --> 08:05.750 Hence, conventional security techniques, which require a handshake, do not work here, as the receiver has no way of interacting with the satellites. 08:06.050 --> 08:14.370 This makes it trivial for an attacker to generate fake signals or replay previously recorded signals to fool a receiver. 08:15.910 --> 08:24.230 An attacker modifies the navigation message content such that the receiver uses altered satellite positions for calculation of the PVD solution. 08:24.230 --> 08:31.990 Such an attack can be easily detected using external sources, as it is trivial to verify the validity of the received navigation messages. 08:32.510 --> 08:42.450 In the second method, the attacker keeps the message contents identical and instead manipulates the time of arrival of the messages, such that the pseudo-range calculations are altered. 08:42.470 --> 08:44.370 Such an attack is hard to detect. 08:44.370 --> 08:48.250 However, it requires access to real-time satellite ephemeris data. 08:50.090 --> 08:54.010 Let's take a look at one of the most sophisticated GPS attacks. 08:54.030 --> 09:00.770 In a seamless takeover attack, the attacker starts transmitting with lower power than the legitimate signal. 09:00.770 --> 09:08.070 It is important to note that the adversarial signals are tightly synchronized with the legitimate signals in time domain as well as frequency domain. 09:08.190 --> 09:15.810 Later, the attacker slowly starts increasing the power and overshadows the legitimate signal while maintaining synchronization. 09:15.890 --> 09:20.810 As a result, the receiver starts tracking the adversarial signals instead of the legitimate signals. 09:20.870 --> 09:25.710 Since the attacker's signal is stronger, the noise floor rises and the tracking loops are thrown off. 09:25.750 --> 09:27.450 Thus, the receiver breaks a lock . 09:27.450 --> 09:30.930 However, if the signals are synchronized, the lock is simply transferred. 09:30.930 --> 09:33.750 As for the receiver, the two signals are identical. 09:33.970 --> 09:39.470 Thus, the switch-off lock is near seamless and the receiver doesn't experience any kind of loss of lock. 09:39.670 --> 09:43.430 By nature, every receiver will lock on to the stronger signal. 09:43.430 --> 09:50.890 Once the lock is transferred, which happens instantaneously, the attacker starts introducing offsets, which takes the target off course. 09:53.520 --> 10:01.000 Increasing popularity of inexpensive software-defined radios has made executing GPS spoofing attacks quite straightforward. 10:01.180 --> 10:09.900 To execute a GPS spoofing attack, we need a baseband signal generator, which can generate GPS messages, perform spread spectrum operations, and modulation. 10:09.920 --> 10:16.040 It relies on broadcast fMRIS data of satellites and a set of coordinates to generate spoofing signals. 10:16.100 --> 10:24.320 Finally, we need a software-defined radio front-end, which can transmit data on 1.57542 GHz, which is the L1 carrier frequency. 10:25.420 --> 10:31.740 The demonstration setup includes a control unit, which runs the GPS baseband generator software. 10:31.820 --> 10:36.480 A USRP B210 is used to simulate legitimate and malicious satellites. 10:37.000 --> 10:41.580 This particular USRP supports simultaneous transmissions on two channels. 10:42.000 --> 10:45.340 The spoofer has power advantage of about 10 dB. 10:45.420 --> 10:49.940 This is achieved by setting appropriate RF gain on the spoofer transmission channel. 10:50.040 --> 10:58.120 The signals from these channels are combined using a signal combiner and are fed to a MuBlock GPS receiver, which is connected to a Raspberry Pi. 10:58.260 --> 11:04.440 Foxtrot GPS with OpenStreetMaps is used as a mapping and navigation software on the Raspberry Pi. 11:04.440 --> 11:08.000 Make sure that all the RF instruments are hardwired. 11:08.020 --> 11:11.380 USRP B210 is a fairly powerful transmitter. 11:11.380 --> 11:17.940 Since legitimate GPS signals are very weak, it can affect GPS services over quite a wide area. 11:17.940 --> 11:21.720 Hence, it is essential to ensure that there are no signal leakages. 11:24.160 --> 11:30.920 The first step is to generate a set of GPS coordinates, which will be used to generate GPS baseband signal. 11:30.920 --> 11:33.120 This can be achieved in multiple ways. 11:33.120 --> 11:42.700 In this case, we will plot the path using Google Earth and then use SatGen trajectory generation application to generate the trajectory, which will be interpreted by the GPS simulator. 11:42.760 --> 11:46.440 Let's mark the path by using the add path tool. 11:48.420 --> 11:54.180 In this scenario, let's just take the receiver around the block and bring it back to its original location. 11:55.420 --> 12:05.020 Once you are done adding the path, just save it, give it some name, and now we need to convert the path and store it as a KML file. 12:06.380 --> 12:08.460 All right, there we go. 12:10.520 --> 12:14.700 Now, in the second part, we have to generate NMEA data. 12:15.020 --> 12:18.120 For this, load this path. 12:18.120 --> 12:23.940 As you can see, it shows the displacement in terms of latitude and longitude in meters. 12:23.940 --> 12:28.200 Now, you can keep these dynamic setting parameters as default. 12:28.200 --> 12:31.330 Just make sure that you have a suitable stationary period. 12:32.080 --> 12:38.310 And once you are done, just click on generate NMEA and you can store your data as .NMEA file. 12:40.480 --> 12:42.200 All right, that's it. 12:42.200 --> 12:43.740 Now, over to step two. 12:47.890 --> 12:53.690 In the second step, we'll be using GPS SDR sim for generating GPS baseband data. 12:53.690 --> 13:12.490 We need to provide the simulator with the dynamic motion file, which is sampled at 10 hertz, a GPS broadcast FMRIS data, the sampling rate, which is 2 megahertz in this case, as this is the lowest that can be used for GPS, and then we have to provide the name of the output file. 13:16.930 --> 13:20.490 Now, it will take some time to generate the baseband data. 13:20.610 --> 13:30.670 As you can see, this shows the list of satellites that are visible from this location, their azimuth and the pseudo range to that particular satellite. 13:40.560 --> 13:43.540 All right, now we have our GPS baseband data. 13:43.540 --> 13:45.080 Now, over to step three. 13:48.500 --> 13:52.540 In step two, we generated a GPS baseband signal. 13:52.600 --> 13:57.320 In step three, we will be using a software-defined radio to transmit this signal. 13:57.480 --> 14:00.940 We have a simple GNU radio flow graph for transmission. 14:01.060 --> 14:07.540 This flow graph reads samples from a file source, converts it into GR complex, and sends the samples to a USRP sink. 14:07.540 --> 14:11.300 In this case, I'm using a USRP B210 for transmission. 14:11.880 --> 14:14.600 It supports transmission on two channels. 14:14.600 --> 14:19.320 The first channel transmits the legitimate signal, and second channel transmits a spoofing signal. 14:19.800 --> 14:23.900 This sink can be replaced by a software-defined radio of your choice. 14:23.900 --> 14:30.560 The only requirement is that it should be able to transmit at 2 mega samples on 1.57 gigahertz. 14:31.240 --> 14:34.580 Now, let's turn on the spoofer and observe what happens. 14:37.360 --> 14:41.840 Now, as soon as the spoofer is turned on, we will observe two things. 14:41.840 --> 14:52.120 First, the receiver will show some random motion as the signals interfere unpredictably, which results in a fake or garbage location. 14:52.120 --> 14:55.120 And second, there's a total loss of lock. 14:55.380 --> 15:05.920 One of the reasons being, whenever a receiver loses or isn't able to track a signal, it loses a lock and it takes some time for it to reacquire signals. 15:05.960 --> 15:13.940 Now, as soon as the signals are reacquired, you can see that the receiver starts following the spoof path that we generated in step one. 15:16.940 --> 15:22.600 GPS is a broadcast system, which means that it is unidirectional. 15:22.600 --> 15:24.120 It's a simplex system. 15:24.320 --> 15:29.580 There is no way for a receiver to interact or talk back to the satellites. 15:29.720 --> 15:36.900 Secure positioning and communication requires bidirectional communication for a secure handshake and for secure exchange of information. 15:36.900 --> 15:43.220 And it's also important to protect time of arrival of messages, which in this case is very challenging. 15:43.540 --> 15:48.140 Now, there are two types of spoofing detection and mitigation techniques for GPS. 15:48.140 --> 15:55.060 First is infrastructure countermeasures, where you need to change the entire infrastructure, which includes cryptographic solutions. 15:55.060 --> 16:01.560 And there are receiver-end countermeasures where it's enough just to modify the receiver. 16:01.860 --> 16:03.780 Let's look at these one by one. 16:04.240 --> 16:09.800 A secure GPS proposed by Marcus Kuhn uses asymmetric keys and hidden markers. 16:10.260 --> 16:13.420 Public keys of satellites are stored on the devices. 16:13.440 --> 16:16.840 The broadband receivers receive the entire band of signals. 16:16.840 --> 16:22.080 It is important to do so because the receiver isn't aware of the de-spreading codes just yet. 16:22.080 --> 16:27.860 The transmitter discloses the spreading code at a later time, which is signed by its private key. 16:27.860 --> 16:33.540 The receiver then verifies the signature and uses the received code to de-spread the previous signal. 16:33.620 --> 16:37.280 Such a solution prevents generation of fake signals. 16:37.280 --> 16:40.840 However, there are issues with efficiency and precise timing. 16:40.840 --> 16:50.140 Moreover, it is a logistical nightmare to deploy such a solution, as such a solution will require a complete overhaul of the entire GPS ecosystem. 16:51.980 --> 16:56.960 Researchers have proposed the use of multiple receivers for collective detection of spoofing. 16:56.960 --> 17:00.540 In this scheme, a constellation of receivers is observed. 17:00.540 --> 17:06.440 For successful spoofing, the attacker will have to spoof such that the constellation of receivers is maintained. 17:06.440 --> 17:09.340 This includes spoofing the receivers individually. 17:09.380 --> 17:28.240 Group spoofing is a known challenge associated with GPS spoofing, because let's say a spoofer starts transmitting and as a result of a single point of transmission, all the receivers will collapse into one point and thus it will be very easy for the receivers to detect that there's something malicious going on. 17:29.480 --> 17:41.280 Moreover, even though this solution is quite reliable and is efficient in detecting spoofing, there's a major drawback is that such a solution is not feasible for smaller vehicles. 17:42.860 --> 17:52.020 Signal characteristics can also be leveraged to efficiently detect spoofing, which are considered to be unique to a transmitter given the geographical placement of the transmitter. 17:52.020 --> 17:59.480 This can be used to distinguish between signals from a point transmitter like a spoofer and a satellite which is 20,000 kilometers away. 17:59.720 --> 18:03.160 A high power transmission increases the noise floor substantially. 18:03.240 --> 18:07.300 A sensitive receiver can easily detect sudden changes in noise floors. 18:07.460 --> 18:11.960 These variations can be attributed to a spoofing or a jamming attack. 18:13.840 --> 18:16.940 Recall the function of acquisition module. 18:16.940 --> 18:22.540 A correlation peak is formed for every occurrence of the CA code in the received signal. 18:22.540 --> 18:29.940 A receiver proposed in SPRE looks out for such peaks and based on separation between these peaks, it can detect spoofing. 18:29.940 --> 18:36.380 Even though it can detect a strong seamless takeover attack, it can only do so if the auxiliary peaks are visible. 18:36.380 --> 18:49.380 For example, if the attacker is very powerful, then the legitimate signals are buried under noise floor introduced by the adversarial signals, as is in this case where the second peak marked in green is barely visible. 18:49.380 --> 18:52.900 Here, the attacker has about 10 dB of power advantage. 18:54.300 --> 18:57.660 Here are some other spoofing detection techniques. 18:57.820 --> 19:01.520 Inertial sensors can track physical movements of a vehicle. 19:01.520 --> 19:06.580 However, they are notorious for drifts and biases which can introduce significant errors. 19:06.640 --> 19:15.640 Researchers have proposed various implementations involving extended Kalman filters where IMU sensors are combined with GPS. 19:16.000 --> 19:21.340 Inertial measurements are used to track and validate the derived PVD solutions. 19:21.620 --> 19:31.360 Cross correlation between unknown encrypted GPS signals on L1 carrier and known open source GPS signals can lead to effective spoofing detection strategy. 19:32.100 --> 19:44.940 Another simple spoofing detection strategy involves comparison of PVD solution obtained from GPS with PVD solution obtained from other satellite navigation systems like GLONASS, Galileo, or Baidu. 19:44.940 --> 19:52.260 However, an attacker can simply spoof other systems as well as these systems are also vulnerable to similar attacks. 19:52.500 --> 19:59.760 Receiver Autonomous Integrity Monitoring or RAIM is a spoofing detection technique that is very popular in aviation. 19:59.760 --> 20:03.660 Almost every commercial aviation GPS receiver implements RAIM. 20:03.660 --> 20:06.460 It works on detecting outlier satellites. 20:06.460 --> 20:09.820 These satellites are excluded from PVD calculation. 20:09.820 --> 20:12.760 Thus, it requires six or more visible satellites. 20:15.040 --> 20:18.540 Several of the countermeasures that we discussed are effective. 20:18.540 --> 20:20.320 However, they aren't perfect. 20:20.320 --> 20:24.420 We all know that a perfect security solution just doesn't exist. 20:24.880 --> 20:29.760 In case of crypto solutions, they are vulnerable to replay attacks. 20:29.760 --> 20:36.380 Consider a scenario where a spoofer has a receiver in location 1 and a transmitter in location 2. 20:36.380 --> 20:43.980 There is a medium available such that the receiver can transmit raw RF samples to the transmitter. 20:43.980 --> 20:49.260 Here, the transmitter simply transmits or replays the received samples in location 2. 20:49.260 --> 20:58.960 Now, any receiver in location 2, if starts receiving GPS signals, then the calculated solution will reflect location 1 instead of location 2. 21:00.040 --> 21:07.660 Since GPS is a simplex and a unidirectional system, such attacks cannot be prevented by crypto. 21:07.720 --> 21:16.000 Moreover, it's virtually impossible to protect a physical characteristic of a signal like the time of arrival. 21:19.450 --> 21:25.830 There are solutions which couple INS or inertial navigation systems with GPS. 21:25.830 --> 21:33.070 However, recently, two years ago, there was work which involved integrated GNS and INS spoofing. 21:33.070 --> 21:40.350 In this work, the authors were able to spoof and take the vehicle, of course, by about 10 kilometers. 21:40.350 --> 21:48.270 In our experimentations, we found that throttling GPS spoofing offsets can also lead to pooling extended Kalman filters. 21:48.710 --> 21:52.210 The inertial sensors are prone to errors and biases. 21:52.210 --> 22:00.110 We exploit these errors and we throttle our attacks such that the extended Kalman filter adapts to our spoofing coordinates. 22:00.110 --> 22:07.310 And thus, such attacks can go undetected, even in a tightly coupled INS and GPS system. 22:08.430 --> 22:28.750 Now, as you have seen the countermeasures and how trivial it is to spoof GPS, it's important to note that GPS being a unidirectional system, it is not trivial to come up with solutions which can secure or safeguard GPS against a plethora of these spoofing attacks. 22:29.110 --> 22:30.230 Thank you.