time-nuts@lists.febo.com

Discussion of precise time and frequency measurement

View all threads

Ships fooled in GPS spoofing attack suggest Russian cyberweapon

MB
Martin Burnicki
Mon, Aug 14, 2017 11:07 AM

Clint Jay wrote:

No, this was not the software hack, it was done with some rather nice
Rohde&Schwarz test equipment.

Ah, OK, of course that's also possible.

However, what I found was much simpler:
https://devs-lab.com/how-to-play-pokemon-go-without-moving-no-root-required.html

Clint Jay wrote: > No, this was not the software hack, it was done with some rather nice > Rohde&Schwarz test equipment. Ah, OK, of course that's also possible. However, what I found was much simpler: https://devs-lab.com/how-to-play-pokemon-go-without-moving-no-root-required.html
CJ
Clint Jay
Mon, Aug 14, 2017 11:11 AM

Oh definitely and if I was going to cheat at Pokémon then that'd be the
most cost effective method (yes, I play, my 9 year old son insists) but I'd
rather have the "fun" of actually catching them the proper way

On 14 Aug 2017 12:08 pm, "Martin Burnicki" martin.burnicki@burnicki.net
wrote:

Clint Jay wrote:

No, this was not the software hack, it was done with some rather nice
Rohde&Schwarz test equipment.

Ah, OK, of course that's also possible.

However, what I found was much simpler:
https://devs-lab.com/how-to-play-pokemon-go-without-
moving-no-root-required.html


time-nuts mailing list -- time-nuts@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/
mailman/listinfo/time-nuts
and follow the instructions there.

Oh definitely and if I was going to cheat at Pokémon then that'd be the most cost effective method (yes, I play, my 9 year old son insists) but I'd rather have the "fun" of actually catching them the proper way On 14 Aug 2017 12:08 pm, "Martin Burnicki" <martin.burnicki@burnicki.net> wrote: > Clint Jay wrote: > > No, this was not the software hack, it was done with some rather nice > > Rohde&Schwarz test equipment. > > Ah, OK, of course that's also possible. > > However, what I found was much simpler: > https://devs-lab.com/how-to-play-pokemon-go-without- > moving-no-root-required.html > > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to https://www.febo.com/cgi-bin/ > mailman/listinfo/time-nuts > and follow the instructions there. >
AK
Attila Kinali
Mon, Aug 14, 2017 3:24 PM

On Mon, 14 Aug 2017 10:26:13 +0100
Clint Jay cjaysharp@gmail.com wrote:

That it can "so easily" be spoofed (it's not a trivial hack to spoof and
would, as far as I can see, take good knowledge of how GPS works and skill
to implement) is worrying and it could have disastrous consequences if
anyone decided to use it for malicious means but I'd be surprised if there
wasn't a turnkey solution available to anyone who has the funds.

You don't need a turnkey solution. If you start from zero and are working
alone, it probably will take you a month or two to write the code to spoof
GPS L1 C/A. If you start from one of the GnuRadio based GPS simulators,
you can do it in a weekend.

If you want to spoof L2C and L5 as well and also Galileo OS E1/E5,
it will take a bit longer, but not that much, as 90% of the code shared.

Not only is this very simple. All the documentation you need is readily
available and packaged such, that you don't need to know anything about
GNSS systems before you start and it will not slow you down significantly.
(e.g. Pick up the book from Hegarty and Kaplan and you can just write
the code as you read it).

The most difficult part of this is not creating the signals, but figuring
out a way what PRN's and fake position to choose, such that the tracking
loop of the target doesn't go completely bonkers and needs to do a
re-aquisition on all signals. But even that is not that difficult, if
you have some estimate of the target's location. Or you can simply not
care about it, if you have a slow moving target, like a car or a ship,
as the re-aquisition will take less than a minute.

There have been discussions on adding authentication to GNSS services
for quite some time (at least 10 years, probably longer). And it
culminated in the CS and PRS services of Galileo. I.e. they are a
restricted and/or paid-for service. I am pretty sure that this will
change at some point and the OS serivces (including the free services
of GPS) will provide some basic authentication system as well.

In the meantime, people who rely on GNSS heavily have monitoring
facilites that check the on air signals for degradation or spoofing.
As this requires multiple monitoring stations over the whole area
covered, to ensure that no spoofing or jamming attempt goes unnoticed,
this is rather expensive. The only use of this kind of system, that I
am aware of, are airports. And yes, this is not fool-proof. A narrow
beam spoofer pointed at some airplane will go unoticed, as all the
monitoring stations are on the ground.

			Attila Kinali

--
It is upon moral qualities that a society is ultimately founded. All
the prosperity and technological sophistication in the world is of no
use without that foundation.
-- Miss Matheson, The Diamond Age, Neil Stephenson

On Mon, 14 Aug 2017 10:26:13 +0100 Clint Jay <cjaysharp@gmail.com> wrote: > That it can "so easily" be spoofed (it's not a trivial hack to spoof and > would, as far as I can see, take good knowledge of how GPS works and skill > to implement) is worrying and it could have disastrous consequences if > anyone decided to use it for malicious means but I'd be surprised if there > wasn't a turnkey solution available to anyone who has the funds. You don't need a turnkey solution. If you start from zero and are working alone, it probably will take you a month or two to write the code to spoof GPS L1 C/A. If you start from one of the GnuRadio based GPS simulators, you can do it in a weekend. If you want to spoof L2C and L5 as well and also Galileo OS E1/E5, it will take a bit longer, but not that much, as 90% of the code shared. Not only is this very simple. All the documentation you need is readily available and packaged such, that you don't need to know anything about GNSS systems before you start and it will not slow you down significantly. (e.g. Pick up the book from Hegarty and Kaplan and you can just write the code as you read it). The most difficult part of this is not creating the signals, but figuring out a way what PRN's and fake position to choose, such that the tracking loop of the target doesn't go completely bonkers and needs to do a re-aquisition on all signals. But even that is not that difficult, if you have some estimate of the target's location. Or you can simply not care about it, if you have a slow moving target, like a car or a ship, as the re-aquisition will take less than a minute. There have been discussions on adding authentication to GNSS services for quite some time (at least 10 years, probably longer). And it culminated in the CS and PRS services of Galileo. I.e. they are a restricted and/or paid-for service. I am pretty sure that this will change at some point and the OS serivces (including the free services of GPS) will provide some basic authentication system as well. In the meantime, people who rely on GNSS heavily have monitoring facilites that check the on air signals for degradation or spoofing. As this requires multiple monitoring stations over the whole area covered, to ensure that no spoofing or jamming attempt goes unnoticed, this is rather expensive. The only use of this kind of system, that I am aware of, are airports. And yes, this is not fool-proof. A narrow beam spoofer pointed at some airplane will go unoticed, as all the monitoring stations are on the ground. Attila Kinali -- It is upon moral qualities that a society is ultimately founded. All the prosperity and technological sophistication in the world is of no use without that foundation. -- Miss Matheson, The Diamond Age, Neil Stephenson
CJ
Clint Jay
Mon, Aug 14, 2017 3:38 PM

All very true and yes, for a capable programmer and hardware tech it's not
going to be an impossible task.

I would still expect a turnkey solution to exist though as I can see many
applications for not just state actors.

On 14 Aug 2017 4:32 pm, "Attila Kinali" attila@kinali.ch wrote:

On Mon, 14 Aug 2017 10:26:13 +0100
Clint Jay cjaysharp@gmail.com wrote:

That it can "so easily" be spoofed (it's not a trivial hack to spoof and
would, as far as I can see, take good knowledge of how GPS works and

skill

to implement) is worrying and it could have disastrous consequences if
anyone decided to use it for malicious means but I'd be surprised if

there

wasn't a turnkey solution available to anyone who has the funds.

You don't need a turnkey solution. If you start from zero and are working
alone, it probably will take you a month or two to write the code to spoof
GPS L1 C/A. If you start from one of the GnuRadio based GPS simulators,
you can do it in a weekend.

If you want to spoof L2C and L5 as well and also Galileo OS E1/E5,
it will take a bit longer, but not that much, as 90% of the code shared.

Not only is this very simple. All the documentation you need is readily
available and packaged such, that you don't need to know anything about
GNSS systems before you start and it will not slow you down significantly.
(e.g. Pick up the book from Hegarty and Kaplan and you can just write
the code as you read it).

The most difficult part of this is not creating the signals, but figuring
out a way what PRN's and fake position to choose, such that the tracking
loop of the target doesn't go completely bonkers and needs to do a
re-aquisition on all signals. But even that is not that difficult, if
you have some estimate of the target's location. Or you can simply not
care about it, if you have a slow moving target, like a car or a ship,
as the re-aquisition will take less than a minute.

There have been discussions on adding authentication to GNSS services
for quite some time (at least 10 years, probably longer). And it
culminated in the CS and PRS services of Galileo. I.e. they are a
restricted and/or paid-for service. I am pretty sure that this will
change at some point and the OS serivces (including the free services
of GPS) will provide some basic authentication system as well.

In the meantime, people who rely on GNSS heavily have monitoring
facilites that check the on air signals for degradation or spoofing.
As this requires multiple monitoring stations over the whole area
covered, to ensure that no spoofing or jamming attempt goes unnoticed,
this is rather expensive. The only use of this kind of system, that I
am aware of, are airports. And yes, this is not fool-proof. A narrow
beam spoofer pointed at some airplane will go unoticed, as all the
monitoring stations are on the ground.

                             Attila Kinali

--
It is upon moral qualities that a society is ultimately founded. All
the prosperity and technological sophistication in the world is of no
use without that foundation.
-- Miss Matheson, The Diamond Age, Neil Stephenson


time-nuts mailing list -- time-nuts@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/
mailman/listinfo/time-nuts
and follow the instructions there.

All very true and yes, for a capable programmer and hardware tech it's not going to be an impossible task. I would still expect a turnkey solution to exist though as I can see many applications for not just state actors. On 14 Aug 2017 4:32 pm, "Attila Kinali" <attila@kinali.ch> wrote: > On Mon, 14 Aug 2017 10:26:13 +0100 > Clint Jay <cjaysharp@gmail.com> wrote: > > > That it can "so easily" be spoofed (it's not a trivial hack to spoof and > > would, as far as I can see, take good knowledge of how GPS works and > skill > > to implement) is worrying and it could have disastrous consequences if > > anyone decided to use it for malicious means but I'd be surprised if > there > > wasn't a turnkey solution available to anyone who has the funds. > > You don't need a turnkey solution. If you start from zero and are working > alone, it probably will take you a month or two to write the code to spoof > GPS L1 C/A. If you start from one of the GnuRadio based GPS simulators, > you can do it in a weekend. > > If you want to spoof L2C and L5 as well and also Galileo OS E1/E5, > it will take a bit longer, but not that much, as 90% of the code shared. > > Not only is this very simple. All the documentation you need is readily > available and packaged such, that you don't need to know anything about > GNSS systems before you start and it will not slow you down significantly. > (e.g. Pick up the book from Hegarty and Kaplan and you can just write > the code as you read it). > > The most difficult part of this is not creating the signals, but figuring > out a way what PRN's and fake position to choose, such that the tracking > loop of the target doesn't go completely bonkers and needs to do a > re-aquisition on all signals. But even that is not that difficult, if > you have some estimate of the target's location. Or you can simply not > care about it, if you have a slow moving target, like a car or a ship, > as the re-aquisition will take less than a minute. > > > There have been discussions on adding authentication to GNSS services > for quite some time (at least 10 years, probably longer). And it > culminated in the CS and PRS services of Galileo. I.e. they are a > restricted and/or paid-for service. I am pretty sure that this will > change at some point and the OS serivces (including the free services > of GPS) will provide some basic authentication system as well. > > In the meantime, people who rely on GNSS heavily have monitoring > facilites that check the on air signals for degradation or spoofing. > As this requires multiple monitoring stations over the whole area > covered, to ensure that no spoofing or jamming attempt goes unnoticed, > this is rather expensive. The only use of this kind of system, that I > am aware of, are airports. And yes, this is not fool-proof. A narrow > beam spoofer pointed at some airplane will go unoticed, as all the > monitoring stations are on the ground. > > > Attila Kinali > > -- > It is upon moral qualities that a society is ultimately founded. All > the prosperity and technological sophistication in the world is of no > use without that foundation. > -- Miss Matheson, The Diamond Age, Neil Stephenson > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to https://www.febo.com/cgi-bin/ > mailman/listinfo/time-nuts > and follow the instructions there. >
JH
John Hawkinson
Mon, Aug 14, 2017 3:54 PM

So, what I wonder: to what extent (if any) are GPS, GLONASS, and Galileo sufficiently different that it is challenging to spoof all three in the same way? Is there any reason why it is more than 3 times the work to spoof all 3?

Is there something clever receivers can do, with awareness of all three services, that makes them harder to spoof (beyond checking the services against each other)?

--jhawk@mit.edu
John Hawkinson

So, what I wonder: to what extent (if any) are GPS, GLONASS, and Galileo sufficiently different that it is challenging to spoof all three in the same way? Is there any reason why it is more than 3 times the work to spoof all 3? Is there something clever receivers can do, with awareness of all three services, that makes them harder to spoof (beyond checking the services against each other)? --jhawk@mit.edu John Hawkinson
J
jimlux
Mon, Aug 14, 2017 4:03 PM

On 8/14/17 8:24 AM, Attila Kinali wrote:

On Mon, 14 Aug 2017 10:26:13 +0100
Clint Jay cjaysharp@gmail.com wrote:

That it can "so easily" be spoofed (it's not a trivial hack to spoof and
would, as far as I can see, take good knowledge of how GPS works and skill
to implement) is worrying and it could have disastrous consequences if
anyone decided to use it for malicious means but I'd be surprised if there
wasn't a turnkey solution available to anyone who has the funds.

You don't need a turnkey solution. If you start from zero and are working
alone, it probably will take you a month or two to write the code to spoof
GPS L1 C/A. If you start from one of the GnuRadio based GPS simulators,
you can do it in a weekend.

If you want to spoof L2C and L5 as well and also Galileo OS E1/E5,
it will take a bit longer, but not that much, as 90% of the code shared.

Not only is this very simple. All the documentation you need is readily
available and packaged such, that you don't need to know anything about
GNSS systems before you start and it will not slow you down significantly.
(e.g. Pick up the book from Hegarty and Kaplan and you can just write
the code as you read it).

The most difficult part of this is not creating the signals, but figuring
out a way what PRN's and fake position to choose, such that the tracking
loop of the target doesn't go completely bonkers and needs to do a
re-aquisition on all signals. But even that is not that difficult, if
you have some estimate of the target's location. Or you can simply not
care about it, if you have a slow moving target, like a car or a ship,
as the re-aquisition will take less than a minute.

There have been discussions on adding authentication to GNSS services
for quite some time (at least 10 years, probably longer). And it
culminated in the CS and PRS services of Galileo. I.e. they are a
restricted and/or paid-for service. I am pretty sure that this will
change at some point and the OS serivces (including the free services
of GPS) will provide some basic authentication system as well.

In the meantime, people who rely on GNSS heavily have monitoring
facilites that check the on air signals for degradation or spoofing.
As this requires multiple monitoring stations over the whole area
covered, to ensure that no spoofing or jamming attempt goes unnoticed,
this is rather expensive. The only use of this kind of system, that I
am aware of, are airports. And yes, this is not fool-proof. A narrow
beam spoofer pointed at some airplane will go unoticed, as all the
monitoring stations are on the ground.

And GPS users who care about spoofing tend to use antenna systems that
will reject signals coming from the "wrong" direction.  It's pretty easy
to set up 3 antenna separated by 30 cm or so and tell what direction the
signal from each S/V is coming from.

I would expect that as spoofing/jamming becomes more of a problem (e.g.
all those Amazon delivery drones operating in a RF dense environment)
this will become sort of standard practice.

So now your spoofing becomes much more complex, because the sources have
to appear to come from the right place in the sky.  (fleets of UAVs?)

			Attila Kinali
On 8/14/17 8:24 AM, Attila Kinali wrote: > On Mon, 14 Aug 2017 10:26:13 +0100 > Clint Jay <cjaysharp@gmail.com> wrote: > >> That it can "so easily" be spoofed (it's not a trivial hack to spoof and >> would, as far as I can see, take good knowledge of how GPS works and skill >> to implement) is worrying and it could have disastrous consequences if >> anyone decided to use it for malicious means but I'd be surprised if there >> wasn't a turnkey solution available to anyone who has the funds. > > You don't need a turnkey solution. If you start from zero and are working > alone, it probably will take you a month or two to write the code to spoof > GPS L1 C/A. If you start from one of the GnuRadio based GPS simulators, > you can do it in a weekend. > > If you want to spoof L2C and L5 as well and also Galileo OS E1/E5, > it will take a bit longer, but not that much, as 90% of the code shared. > > Not only is this very simple. All the documentation you need is readily > available and packaged such, that you don't need to know anything about > GNSS systems before you start and it will not slow you down significantly. > (e.g. Pick up the book from Hegarty and Kaplan and you can just write > the code as you read it). > > The most difficult part of this is not creating the signals, but figuring > out a way what PRN's and fake position to choose, such that the tracking > loop of the target doesn't go completely bonkers and needs to do a > re-aquisition on all signals. But even that is not that difficult, if > you have some estimate of the target's location. Or you can simply not > care about it, if you have a slow moving target, like a car or a ship, > as the re-aquisition will take less than a minute. > > > There have been discussions on adding authentication to GNSS services > for quite some time (at least 10 years, probably longer). And it > culminated in the CS and PRS services of Galileo. I.e. they are a > restricted and/or paid-for service. I am pretty sure that this will > change at some point and the OS serivces (including the free services > of GPS) will provide some basic authentication system as well. > > In the meantime, people who rely on GNSS heavily have monitoring > facilites that check the on air signals for degradation or spoofing. > As this requires multiple monitoring stations over the whole area > covered, to ensure that no spoofing or jamming attempt goes unnoticed, > this is rather expensive. The only use of this kind of system, that I > am aware of, are airports. And yes, this is not fool-proof. A narrow > beam spoofer pointed at some airplane will go unoticed, as all the > monitoring stations are on the ground. And GPS users who care about spoofing tend to use antenna systems that will reject signals coming from the "wrong" direction. It's pretty easy to set up 3 antenna separated by 30 cm or so and tell what direction the signal from each S/V is coming from. I would expect that as spoofing/jamming becomes more of a problem (e.g. all those Amazon delivery drones operating in a RF dense environment) this will become sort of standard practice. So now your spoofing becomes much more complex, because the sources have to appear to come from the right place in the sky. (fleets of UAVs?) > > > Attila Kinali >
TS
Tim Shoppa
Mon, Aug 14, 2017 4:09 PM

Bringing this back around to time-nuts - wouldn't the timescale
discontinuity at the receiver, be a powerful clue that spoofing was going
on? But these being navigation receivers they aren't looking so critically
at the time.

Presumably this was a single-transmitter jammer that pretended it was a
whole GPS constellation.

A 32 kilometer jump in position would've been a 10 to 100 microsecond time
jump for at least some of the receivers in that section of the Black Sea.
And 10 microseconds sticks out like a sore thumb to a time nut.

I think if you are only trying to spoof a single receiver it would be
possible to walk a spoofed time/space code in a way that time moved without
so obvious of a discontinuity. I'm sure there would be effects a time-nut
could notice still.

Tim N3QE

On Sat, Aug 12, 2017 at 5:23 PM, John Allen john@pcsupportsolutions.com
wrote:

FYI, John K1AE

-----Original Message-----
From: YCCC [mailto:yccc-bounces@contesting.com] On Behalf Of ROBERT
DOHERTY
Sent: Saturday, August 12, 2017 9:26 AM
To: YCCC Reflector
Subject: [YCCC] Fwd: Re: [Radio Officers, &c] Ships fooled in GPS spoofing
attack suggest Russian cyberweapon

As if there were not enough problems in the world .....

Whitey  K1VV

 Date: August 12, 2017 at 7:37 AM
 Subject: Re: [Radio Officers, &c] Ships fooled in GPS spoofing

attack suggest Russian cyberweapon

 Ships fooled in GPS spoofing attack suggest Russian cyberweapon

 News from: New Scientis (article reported by R/O Luca Milone –

IZ7GEG)

 https://www.newscientist.com/article/2143499-ships-fooled-

in-gps-spoofing-attack-suggest-russian-cyberweapon/#.
WY6zNfZq1VA.google_plusone_share https://www.newscientist.com/
article/2143499-ships-fooled-in-gps-spoofing-attack-
suggest-russian-cyberweapon/#.WY6zNfZq1VA.google_plusone_share

 On date: 10 August 2017

 By David Hambling


 Reports of satellite navigation problems in the Black Sea suggest

that Russia may be testing a new system for spoofing GPS, New Scientist has
learned. This could be the first hint of a new form of electronic warfare
available to everyone from rogue nation states to petty criminals.

 On 22 June, the US Maritime Administration filed a seemingly bland

incident report. The master of a ship off the Russian port of Novorossiysk
had discovered his GPS put him in the wrong spot – more than 32 kilometres
inland, at Gelendzhik Airport.

 After checking the navigation equipment was working properly, the

captain contacted other nearby ships. Their AIS traces – signals from the
automatic identification system used to track vessels – placed them all at
the same airport. At least 20 ships were affected
http://maritime-executive.com/editorials/mass-gps-spoofing-
attack-in-black-sea .

 While the incident is not yet confirmed, experts think this is the

first documented use of GPS misdirection – https://www.marad.dot.gov/
msci/alert/2017/2017-005a-gps-interference-black-sea/  a spoofing attack
that has long been warned of but never been seen in the wild.

 Until now, the biggest worry for GPS has been it can be jammed

https://www.newscientist.com/article/dn20202-gps-chaos-how-
a-30-box-can-jam-your-life/  by masking the GPS satellite signal with
noise. While this can cause chaos, it is also easy to detect. GPS receivers
sound an alarm when they lose the signal due to jamming. Spoofing is more
insidious: a false signal from a ground station simply confuses a satellite
receiver. “Jamming just causes the receiver to die, spoofing causes the
receiver to lie,” says consultant David Last
http://www.professordavidlast.co.uk/ , former president of the UK’s Royal
Institute of Navigation.

 Todd Humphreys http://www.ae.utexas.edu/faculty/faculty-directory/

humphreys , of the University of Texas at Austin, has been warning of the
coming danger of GPS spoofing for many years. In 2013, he showed how a
superyacht with state-of-the-art navigation could be lured off-course by
GPS spoofing. “The receiver’s behaviour in the Black Sea incident was much
like during the controlled attacks http://onlinelibrary.wiley.
com/doi/10.1002/navi.183/full  my team conducted,” says Humphreys.

 Humphreys thinks this is Russia experimenting with a new form of

electronic warfare. Over the past year, GPS spoofing has been causing chaos
for the receivers on phone apps in central Moscow to misbehave
https://themoscowtimes.com/articles/the-kremlin-eats-gps-
for-breakfast-55823 . The scale of the problem did not become apparent
until people began trying to play Pokemon Go. The fake signal, which seems
to centre on the Kremlin, relocates anyone nearby to Vnukovo Airport
http://www.thetruthaboutcars.com/2017/01/bizarre-gps-
spoofing-means-drivers-near-kremlin-always-airport/ , 32 km away. This is
probably for defensive reasons; many NATO guided bombs, missiles and drones
rely on GPS navigation, and successful spoofing would make it impossible
for them to hit their targets.

 But now the geolocation interference is being used far away from the

Kremlin. Some worry that this means that spoofing is getting easier. GPS
spoofing previously required considerable technical expertise. Humphreys
had to build his first spoofer from scratch in 2008, but notes that it can
now be done with commercial hardware and software downloaded from the
Internet.

 Nor does it require much power. Satellite signals are very weak –

about 20 watts from 20,000 miles away – so a one-watt transmitter on a
hilltop, plane or drone is enough to spoof everything out to the horizon.

 If the hardware and software are becoming more accessible, nation

states soon won’t be the only ones using the technology. This is within the
scope of any competent hacker http://www.comsoc.org/ctn/
lost-space-how-secure-future-mobile-positioning . There have not yet been
any authenticated reports of criminal spoofing, but it should not be
difficult for criminals to use it to divert a driverless vehicle
https://www.newscientist.com/article/2142059-sneaky-
attacks-trick-ais-into-seeing-or-hearing-whats-not-there/  or drone
delivery, or to hijack an autonomous ship. Spoofing will give everyone
affected the same location, so a hijacker would just need a short-ranged
system to affect one vehicle.

 But Humphreys believes that spoofing by a state operator is the more

serious threat. “It affects safety-of-life operations over a large area,”
he says. “In congested waters with poor weather, such as the English
Channel, it would likely cause great confusion, and probably collisions.”

 Last says that the Black Sea incident suggests a new device capable

of causing widespread disruption, for example, if used in the ongoing
dispute with Ukraine. “My gut feeling is that this is a test of a system
which will be used in anger at some other time.”

 73’s
 webmaster

YCCC Reflector mailto:yccc@contesting.com
Yankee Clipper Contest Club  http://www.yccc.org
Reflector Info: http://lists.contesting.com/mailman/listinfo/yccc


This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus


time-nuts mailing list -- time-nuts@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/
mailman/listinfo/time-nuts
and follow the instructions there.

Bringing this back around to time-nuts - wouldn't the timescale discontinuity at the receiver, be a powerful clue that spoofing was going on? But these being navigation receivers they aren't looking so critically at the time. Presumably this was a single-transmitter jammer that pretended it was a whole GPS constellation. A 32 kilometer jump in position would've been a 10 to 100 microsecond time jump for at least some of the receivers in that section of the Black Sea. And 10 microseconds sticks out like a sore thumb to a time nut. I think if you are only trying to spoof a single receiver it would be possible to walk a spoofed time/space code in a way that time moved without so obvious of a discontinuity. I'm sure there would be effects a time-nut could notice still. Tim N3QE On Sat, Aug 12, 2017 at 5:23 PM, John Allen <john@pcsupportsolutions.com> wrote: > FYI, John K1AE > > -----Original Message----- > From: YCCC [mailto:yccc-bounces@contesting.com] On Behalf Of ROBERT > DOHERTY > Sent: Saturday, August 12, 2017 9:26 AM > To: YCCC Reflector > Subject: [YCCC] Fwd: Re: [Radio Officers, &c] Ships fooled in GPS spoofing > attack suggest Russian cyberweapon > > As if there were not enough problems in the world ..... > > Whitey K1VV > > > Date: August 12, 2017 at 7:37 AM > > Subject: Re: [Radio Officers, &c] Ships fooled in GPS spoofing > attack suggest Russian cyberweapon > > > > Ships fooled in GPS spoofing attack suggest Russian cyberweapon > > > > News from: New Scientis (article reported by R/O Luca Milone – > IZ7GEG) > > > > https://www.newscientist.com/article/2143499-ships-fooled- > in-gps-spoofing-attack-suggest-russian-cyberweapon/#. > WY6zNfZq1VA.google_plusone_share https://www.newscientist.com/ > article/2143499-ships-fooled-in-gps-spoofing-attack- > suggest-russian-cyberweapon/#.WY6zNfZq1VA.google_plusone_share > > > > > > On date: 10 August 2017 > > > > By David Hambling > > > > > > Reports of satellite navigation problems in the Black Sea suggest > that Russia may be testing a new system for spoofing GPS, New Scientist has > learned. This could be the first hint of a new form of electronic warfare > available to everyone from rogue nation states to petty criminals. > > > > > > On 22 June, the US Maritime Administration filed a seemingly bland > incident report. The master of a ship off the Russian port of Novorossiysk > had discovered his GPS put him in the wrong spot – more than 32 kilometres > inland, at Gelendzhik Airport. > > > > > > After checking the navigation equipment was working properly, the > captain contacted other nearby ships. Their AIS traces – signals from the > automatic identification system used to track vessels – placed them all at > the same airport. At least 20 ships were affected > http://maritime-executive.com/editorials/mass-gps-spoofing- > attack-in-black-sea . > > > > > > While the incident is not yet confirmed, experts think this is the > first documented use of GPS misdirection – https://www.marad.dot.gov/ > msci/alert/2017/2017-005a-gps-interference-black-sea/ a spoofing attack > that has long been warned of but never been seen in the wild. > > > > > > Until now, the biggest worry for GPS has been it can be jammed > https://www.newscientist.com/article/dn20202-gps-chaos-how- > a-30-box-can-jam-your-life/ by masking the GPS satellite signal with > noise. While this can cause chaos, it is also easy to detect. GPS receivers > sound an alarm when they lose the signal due to jamming. Spoofing is more > insidious: a false signal from a ground station simply confuses a satellite > receiver. “Jamming just causes the receiver to die, spoofing causes the > receiver to lie,” says consultant David Last > http://www.professordavidlast.co.uk/ , former president of the UK’s Royal > Institute of Navigation. > > > > > > Todd Humphreys http://www.ae.utexas.edu/faculty/faculty-directory/ > humphreys , of the University of Texas at Austin, has been warning of the > coming danger of GPS spoofing for many years. In 2013, he showed how a > superyacht with state-of-the-art navigation could be lured off-course by > GPS spoofing. “The receiver’s behaviour in the Black Sea incident was much > like during the controlled attacks http://onlinelibrary.wiley. > com/doi/10.1002/navi.183/full my team conducted,” says Humphreys. > > > > > > Humphreys thinks this is Russia experimenting with a new form of > electronic warfare. Over the past year, GPS spoofing has been causing chaos > for the receivers on phone apps in central Moscow to misbehave > https://themoscowtimes.com/articles/the-kremlin-eats-gps- > for-breakfast-55823 . The scale of the problem did not become apparent > until people began trying to play Pokemon Go. The fake signal, which seems > to centre on the Kremlin, relocates anyone nearby to Vnukovo Airport > http://www.thetruthaboutcars.com/2017/01/bizarre-gps- > spoofing-means-drivers-near-kremlin-always-airport/ , 32 km away. This is > probably for defensive reasons; many NATO guided bombs, missiles and drones > rely on GPS navigation, and successful spoofing would make it impossible > for them to hit their targets. > > > > > > But now the geolocation interference is being used far away from the > Kremlin. Some worry that this means that spoofing is getting easier. GPS > spoofing previously required considerable technical expertise. Humphreys > had to build his first spoofer from scratch in 2008, but notes that it can > now be done with commercial hardware and software downloaded from the > Internet. > > > > > > Nor does it require much power. Satellite signals are very weak – > about 20 watts from 20,000 miles away – so a one-watt transmitter on a > hilltop, plane or drone is enough to spoof everything out to the horizon. > > > > > > If the hardware and software are becoming more accessible, nation > states soon won’t be the only ones using the technology. This is within the > scope of any competent hacker http://www.comsoc.org/ctn/ > lost-space-how-secure-future-mobile-positioning . There have not yet been > any authenticated reports of criminal spoofing, but it should not be > difficult for criminals to use it to divert a driverless vehicle > https://www.newscientist.com/article/2142059-sneaky- > attacks-trick-ais-into-seeing-or-hearing-whats-not-there/ or drone > delivery, or to hijack an autonomous ship. Spoofing will give everyone > affected the same location, so a hijacker would just need a short-ranged > system to affect one vehicle. > > > > > > But Humphreys believes that spoofing by a state operator is the more > serious threat. “It affects safety-of-life operations over a large area,” > he says. “In congested waters with poor weather, such as the English > Channel, it would likely cause great confusion, and probably collisions.” > > > > > > Last says that the Black Sea incident suggests a new device capable > of causing widespread disruption, for example, if used in the ongoing > dispute with Ukraine. “My gut feeling is that this is a test of a system > which will be used in anger at some other time.” > > > > > > 73’s > > webmaster > _______________________________________________ > YCCC Reflector mailto:yccc@contesting.com > Yankee Clipper Contest Club http://www.yccc.org > Reflector Info: http://lists.contesting.com/mailman/listinfo/yccc > > > > --- > This email has been checked for viruses by Avast antivirus software. > https://www.avast.com/antivirus > > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to https://www.febo.com/cgi-bin/ > mailman/listinfo/time-nuts > and follow the instructions there. >
BK
Bob kb8tq
Mon, Aug 14, 2017 4:17 PM

Hi

The big(er) deal with some systems is that they offer encrypted services. If you happen to have
access to the crypto version, that’s going to help you. As long as you are using “public” (and thus
fully documented) modes … not a lot of difference. The same info that lets anybody design a
receiver lets people design a spoofing system.

Bob

On Aug 14, 2017, at 11:54 AM, John Hawkinson jhawk@MIT.EDU wrote:

So, what I wonder: to what extent (if any) are GPS, GLONASS, and Galileo sufficiently different that it is challenging to spoof all three in the same way? Is there any reason why it is more than 3 times the work to spoof all 3?

Is there something clever receivers can do, with awareness of all three services, that makes them harder to spoof (beyond checking the services against each other)?

--jhawk@mit.edu
John Hawkinson


time-nuts mailing list -- time-nuts@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.

Hi The big(er) deal with some systems is that they offer encrypted services. If you happen to have access to the crypto version, that’s going to help you. As long as you are using “public” (and thus fully documented) modes … not a lot of difference. The same info that lets anybody design a receiver lets people design a spoofing system. Bob > On Aug 14, 2017, at 11:54 AM, John Hawkinson <jhawk@MIT.EDU> wrote: > > So, what I wonder: to what extent (if any) are GPS, GLONASS, and Galileo sufficiently different that it is challenging to spoof all three in the same way? Is there any reason why it is more than 3 times the work to spoof all 3? > > Is there something clever receivers can do, with awareness of all three services, that makes them harder to spoof (beyond checking the services against each other)? > > --jhawk@mit.edu > John Hawkinson > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts > and follow the instructions there.
BK
Bob kb8tq
Mon, Aug 14, 2017 4:19 PM

Hi

Time is one more thing the spoofer needs to consider. It does not eliminate the
ability to spoof, it just adds one more factor to his setup. If he’s got a “clear” GPS
signal to base his spoof on, that gives him a timebase to use.

Bob

On Aug 14, 2017, at 12:09 PM, Tim Shoppa tshoppa@gmail.com wrote:

Bringing this back around to time-nuts - wouldn't the timescale
discontinuity at the receiver, be a powerful clue that spoofing was going
on? But these being navigation receivers they aren't looking so critically
at the time.

Presumably this was a single-transmitter jammer that pretended it was a
whole GPS constellation.

A 32 kilometer jump in position would've been a 10 to 100 microsecond time
jump for at least some of the receivers in that section of the Black Sea.
And 10 microseconds sticks out like a sore thumb to a time nut.

I think if you are only trying to spoof a single receiver it would be
possible to walk a spoofed time/space code in a way that time moved without
so obvious of a discontinuity. I'm sure there would be effects a time-nut
could notice still.

Tim N3QE

On Sat, Aug 12, 2017 at 5:23 PM, John Allen john@pcsupportsolutions.com
wrote:

FYI, John K1AE

-----Original Message-----
From: YCCC [mailto:yccc-bounces@contesting.com] On Behalf Of ROBERT
DOHERTY
Sent: Saturday, August 12, 2017 9:26 AM
To: YCCC Reflector
Subject: [YCCC] Fwd: Re: [Radio Officers, &c] Ships fooled in GPS spoofing
attack suggest Russian cyberweapon

As if there were not enough problems in the world .....

Whitey  K1VV

Date: August 12, 2017 at 7:37 AM
Subject: Re: [Radio Officers, &c] Ships fooled in GPS spoofing

attack suggest Russian cyberweapon

Ships fooled in GPS spoofing attack suggest Russian cyberweapon

News from: New Scientis (article reported by R/O Luca Milone –

IZ7GEG)

https://www.newscientist.com/article/2143499-ships-fooled-

in-gps-spoofing-attack-suggest-russian-cyberweapon/#.
WY6zNfZq1VA.google_plusone_share https://www.newscientist.com/
article/2143499-ships-fooled-in-gps-spoofing-attack-
suggest-russian-cyberweapon/#.WY6zNfZq1VA.google_plusone_share

On date: 10 August 2017

By David Hambling


Reports of satellite navigation problems in the Black Sea suggest

that Russia may be testing a new system for spoofing GPS, New Scientist has
learned. This could be the first hint of a new form of electronic warfare
available to everyone from rogue nation states to petty criminals.

On 22 June, the US Maritime Administration filed a seemingly bland

incident report. The master of a ship off the Russian port of Novorossiysk
had discovered his GPS put him in the wrong spot – more than 32 kilometres
inland, at Gelendzhik Airport.

After checking the navigation equipment was working properly, the

captain contacted other nearby ships. Their AIS traces – signals from the
automatic identification system used to track vessels – placed them all at
the same airport. At least 20 ships were affected
http://maritime-executive.com/editorials/mass-gps-spoofing-
attack-in-black-sea .

While the incident is not yet confirmed, experts think this is the

first documented use of GPS misdirection – https://www.marad.dot.gov/
msci/alert/2017/2017-005a-gps-interference-black-sea/  a spoofing attack
that has long been warned of but never been seen in the wild.

Until now, the biggest worry for GPS has been it can be jammed

https://www.newscientist.com/article/dn20202-gps-chaos-how-
a-30-box-can-jam-your-life/  by masking the GPS satellite signal with
noise. While this can cause chaos, it is also easy to detect. GPS receivers
sound an alarm when they lose the signal due to jamming. Spoofing is more
insidious: a false signal from a ground station simply confuses a satellite
receiver. “Jamming just causes the receiver to die, spoofing causes the
receiver to lie,” says consultant David Last
http://www.professordavidlast.co.uk/ , former president of the UK’s Royal
Institute of Navigation.

Todd Humphreys http://www.ae.utexas.edu/faculty/faculty-directory/

humphreys , of the University of Texas at Austin, has been warning of the
coming danger of GPS spoofing for many years. In 2013, he showed how a
superyacht with state-of-the-art navigation could be lured off-course by
GPS spoofing. “The receiver’s behaviour in the Black Sea incident was much
like during the controlled attacks http://onlinelibrary.wiley.
com/doi/10.1002/navi.183/full  my team conducted,” says Humphreys.

Humphreys thinks this is Russia experimenting with a new form of

electronic warfare. Over the past year, GPS spoofing has been causing chaos
for the receivers on phone apps in central Moscow to misbehave
https://themoscowtimes.com/articles/the-kremlin-eats-gps-
for-breakfast-55823 . The scale of the problem did not become apparent
until people began trying to play Pokemon Go. The fake signal, which seems
to centre on the Kremlin, relocates anyone nearby to Vnukovo Airport
http://www.thetruthaboutcars.com/2017/01/bizarre-gps-
spoofing-means-drivers-near-kremlin-always-airport/ , 32 km away. This is
probably for defensive reasons; many NATO guided bombs, missiles and drones
rely on GPS navigation, and successful spoofing would make it impossible
for them to hit their targets.

But now the geolocation interference is being used far away from the

Kremlin. Some worry that this means that spoofing is getting easier. GPS
spoofing previously required considerable technical expertise. Humphreys
had to build his first spoofer from scratch in 2008, but notes that it can
now be done with commercial hardware and software downloaded from the
Internet.

Nor does it require much power. Satellite signals are very weak –

about 20 watts from 20,000 miles away – so a one-watt transmitter on a
hilltop, plane or drone is enough to spoof everything out to the horizon.

If the hardware and software are becoming more accessible, nation

states soon won’t be the only ones using the technology. This is within the
scope of any competent hacker http://www.comsoc.org/ctn/
lost-space-how-secure-future-mobile-positioning . There have not yet been
any authenticated reports of criminal spoofing, but it should not be
difficult for criminals to use it to divert a driverless vehicle
https://www.newscientist.com/article/2142059-sneaky-
attacks-trick-ais-into-seeing-or-hearing-whats-not-there/  or drone
delivery, or to hijack an autonomous ship. Spoofing will give everyone
affected the same location, so a hijacker would just need a short-ranged
system to affect one vehicle.

But Humphreys believes that spoofing by a state operator is the more

serious threat. “It affects safety-of-life operations over a large area,”
he says. “In congested waters with poor weather, such as the English
Channel, it would likely cause great confusion, and probably collisions.”

Last says that the Black Sea incident suggests a new device capable

of causing widespread disruption, for example, if used in the ongoing
dispute with Ukraine. “My gut feeling is that this is a test of a system
which will be used in anger at some other time.”

73’s
webmaster

YCCC Reflector mailto:yccc@contesting.com
Yankee Clipper Contest Club  http://www.yccc.org
Reflector Info: http://lists.contesting.com/mailman/listinfo/yccc


This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus


time-nuts mailing list -- time-nuts@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/
mailman/listinfo/time-nuts
and follow the instructions there.


time-nuts mailing list -- time-nuts@febo.com
To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
and follow the instructions there.

Hi Time is one more thing the spoofer needs to consider. It does not eliminate the ability to spoof, it just adds one more factor to his setup. If he’s got a “clear” GPS signal to base his spoof on, that gives him a timebase to use. Bob > On Aug 14, 2017, at 12:09 PM, Tim Shoppa <tshoppa@gmail.com> wrote: > > Bringing this back around to time-nuts - wouldn't the timescale > discontinuity at the receiver, be a powerful clue that spoofing was going > on? But these being navigation receivers they aren't looking so critically > at the time. > > Presumably this was a single-transmitter jammer that pretended it was a > whole GPS constellation. > > A 32 kilometer jump in position would've been a 10 to 100 microsecond time > jump for at least some of the receivers in that section of the Black Sea. > And 10 microseconds sticks out like a sore thumb to a time nut. > > I think if you are only trying to spoof a single receiver it would be > possible to walk a spoofed time/space code in a way that time moved without > so obvious of a discontinuity. I'm sure there would be effects a time-nut > could notice still. > > Tim N3QE > > > On Sat, Aug 12, 2017 at 5:23 PM, John Allen <john@pcsupportsolutions.com> > wrote: > >> FYI, John K1AE >> >> -----Original Message----- >> From: YCCC [mailto:yccc-bounces@contesting.com] On Behalf Of ROBERT >> DOHERTY >> Sent: Saturday, August 12, 2017 9:26 AM >> To: YCCC Reflector >> Subject: [YCCC] Fwd: Re: [Radio Officers, &c] Ships fooled in GPS spoofing >> attack suggest Russian cyberweapon >> >> As if there were not enough problems in the world ..... >> >> Whitey K1VV >> >>> Date: August 12, 2017 at 7:37 AM >>> Subject: Re: [Radio Officers, &c] Ships fooled in GPS spoofing >> attack suggest Russian cyberweapon >>> >>> Ships fooled in GPS spoofing attack suggest Russian cyberweapon >>> >>> News from: New Scientis (article reported by R/O Luca Milone – >> IZ7GEG) >>> >>> https://www.newscientist.com/article/2143499-ships-fooled- >> in-gps-spoofing-attack-suggest-russian-cyberweapon/#. >> WY6zNfZq1VA.google_plusone_share https://www.newscientist.com/ >> article/2143499-ships-fooled-in-gps-spoofing-attack- >> suggest-russian-cyberweapon/#.WY6zNfZq1VA.google_plusone_share >>> >>> >>> On date: 10 August 2017 >>> >>> By David Hambling >>> >>> >>> Reports of satellite navigation problems in the Black Sea suggest >> that Russia may be testing a new system for spoofing GPS, New Scientist has >> learned. This could be the first hint of a new form of electronic warfare >> available to everyone from rogue nation states to petty criminals. >>> >>> >>> On 22 June, the US Maritime Administration filed a seemingly bland >> incident report. The master of a ship off the Russian port of Novorossiysk >> had discovered his GPS put him in the wrong spot – more than 32 kilometres >> inland, at Gelendzhik Airport. >>> >>> >>> After checking the navigation equipment was working properly, the >> captain contacted other nearby ships. Their AIS traces – signals from the >> automatic identification system used to track vessels – placed them all at >> the same airport. At least 20 ships were affected >> http://maritime-executive.com/editorials/mass-gps-spoofing- >> attack-in-black-sea . >>> >>> >>> While the incident is not yet confirmed, experts think this is the >> first documented use of GPS misdirection – https://www.marad.dot.gov/ >> msci/alert/2017/2017-005a-gps-interference-black-sea/ a spoofing attack >> that has long been warned of but never been seen in the wild. >>> >>> >>> Until now, the biggest worry for GPS has been it can be jammed >> https://www.newscientist.com/article/dn20202-gps-chaos-how- >> a-30-box-can-jam-your-life/ by masking the GPS satellite signal with >> noise. While this can cause chaos, it is also easy to detect. GPS receivers >> sound an alarm when they lose the signal due to jamming. Spoofing is more >> insidious: a false signal from a ground station simply confuses a satellite >> receiver. “Jamming just causes the receiver to die, spoofing causes the >> receiver to lie,” says consultant David Last >> http://www.professordavidlast.co.uk/ , former president of the UK’s Royal >> Institute of Navigation. >>> >>> >>> Todd Humphreys http://www.ae.utexas.edu/faculty/faculty-directory/ >> humphreys , of the University of Texas at Austin, has been warning of the >> coming danger of GPS spoofing for many years. In 2013, he showed how a >> superyacht with state-of-the-art navigation could be lured off-course by >> GPS spoofing. “The receiver’s behaviour in the Black Sea incident was much >> like during the controlled attacks http://onlinelibrary.wiley. >> com/doi/10.1002/navi.183/full my team conducted,” says Humphreys. >>> >>> >>> Humphreys thinks this is Russia experimenting with a new form of >> electronic warfare. Over the past year, GPS spoofing has been causing chaos >> for the receivers on phone apps in central Moscow to misbehave >> https://themoscowtimes.com/articles/the-kremlin-eats-gps- >> for-breakfast-55823 . The scale of the problem did not become apparent >> until people began trying to play Pokemon Go. The fake signal, which seems >> to centre on the Kremlin, relocates anyone nearby to Vnukovo Airport >> http://www.thetruthaboutcars.com/2017/01/bizarre-gps- >> spoofing-means-drivers-near-kremlin-always-airport/ , 32 km away. This is >> probably for defensive reasons; many NATO guided bombs, missiles and drones >> rely on GPS navigation, and successful spoofing would make it impossible >> for them to hit their targets. >>> >>> >>> But now the geolocation interference is being used far away from the >> Kremlin. Some worry that this means that spoofing is getting easier. GPS >> spoofing previously required considerable technical expertise. Humphreys >> had to build his first spoofer from scratch in 2008, but notes that it can >> now be done with commercial hardware and software downloaded from the >> Internet. >>> >>> >>> Nor does it require much power. Satellite signals are very weak – >> about 20 watts from 20,000 miles away – so a one-watt transmitter on a >> hilltop, plane or drone is enough to spoof everything out to the horizon. >>> >>> >>> If the hardware and software are becoming more accessible, nation >> states soon won’t be the only ones using the technology. This is within the >> scope of any competent hacker http://www.comsoc.org/ctn/ >> lost-space-how-secure-future-mobile-positioning . There have not yet been >> any authenticated reports of criminal spoofing, but it should not be >> difficult for criminals to use it to divert a driverless vehicle >> https://www.newscientist.com/article/2142059-sneaky- >> attacks-trick-ais-into-seeing-or-hearing-whats-not-there/ or drone >> delivery, or to hijack an autonomous ship. Spoofing will give everyone >> affected the same location, so a hijacker would just need a short-ranged >> system to affect one vehicle. >>> >>> >>> But Humphreys believes that spoofing by a state operator is the more >> serious threat. “It affects safety-of-life operations over a large area,” >> he says. “In congested waters with poor weather, such as the English >> Channel, it would likely cause great confusion, and probably collisions.” >>> >>> >>> Last says that the Black Sea incident suggests a new device capable >> of causing widespread disruption, for example, if used in the ongoing >> dispute with Ukraine. “My gut feeling is that this is a test of a system >> which will be used in anger at some other time.” >>> >>> >>> 73’s >>> webmaster >> _______________________________________________ >> YCCC Reflector mailto:yccc@contesting.com >> Yankee Clipper Contest Club http://www.yccc.org >> Reflector Info: http://lists.contesting.com/mailman/listinfo/yccc >> >> >> >> --- >> This email has been checked for viruses by Avast antivirus software. >> https://www.avast.com/antivirus >> >> _______________________________________________ >> time-nuts mailing list -- time-nuts@febo.com >> To unsubscribe, go to https://www.febo.com/cgi-bin/ >> mailman/listinfo/time-nuts >> and follow the instructions there. >> > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts > and follow the instructions there.
AK
Attila Kinali
Mon, Aug 14, 2017 4:51 PM

On Mon, 14 Aug 2017 12:09:43 -0400
Tim Shoppa tshoppa@gmail.com wrote:

I think if you are only trying to spoof a single receiver it would be
possible to walk a spoofed time/space code in a way that time moved without
so obvious of a discontinuity. I'm sure there would be effects a time-nut
could notice still.

Not really. Unless you have a multi-antenna setup (see jim's email),
you have nothing to compare the signal to. Even an ideal reference
clock in your GPS receiver does not help, as the attacker could be
tracking you in such a way that you will never see a discontinuity
in time or position and that all the other sanity checks you do
still don't show anything.

With a two antenna setup, you can already check whether the phases
add up to what you expect them to be, given your position relative
to the satellites position. You do not need 3 antennas as a potential
attacker can spoof the phase of some satellites correctly, but not
of all at the same time. This at least gives you a spoof/no-spoof signal.

With an antenna array you can do some masking of spoofers (ie placing
a null where the spoofer comes from). But this increases the cost and
complexity of the system super-linear with the number of antennas.
Maybe one way to do it, would be to use a single receiver with a stable
reference clock and switch between antennas in short succession. Ie similar
to how the early single channel GPS receivers worked, but for antennas
instead of SVs. But I have no idea how easy/difficult this would be
to do and how well it would work against spoofers.

			Attila Kinali

--
It is upon moral qualities that a society is ultimately founded. All
the prosperity and technological sophistication in the world is of no
use without that foundation.
-- Miss Matheson, The Diamond Age, Neil Stephenson

On Mon, 14 Aug 2017 12:09:43 -0400 Tim Shoppa <tshoppa@gmail.com> wrote: > I think if you are only trying to spoof a single receiver it would be > possible to walk a spoofed time/space code in a way that time moved without > so obvious of a discontinuity. I'm sure there would be effects a time-nut > could notice still. Not really. Unless you have a multi-antenna setup (see jim's email), you have nothing to compare the signal to. Even an ideal reference clock in your GPS receiver does not help, as the attacker could be tracking you in such a way that you will never see a discontinuity in time or position and that all the other sanity checks you do still don't show anything. With a two antenna setup, you can already check whether the phases add up to what you expect them to be, given your position relative to the satellites position. You do not need 3 antennas as a potential attacker can spoof the phase of some satellites correctly, but not of all at the same time. This at least gives you a spoof/no-spoof signal. With an antenna array you can do some masking of spoofers (ie placing a null where the spoofer comes from). But this increases the cost and complexity of the system super-linear with the number of antennas. Maybe one way to do it, would be to use a single receiver with a stable reference clock and switch between antennas in short succession. Ie similar to how the early single channel GPS receivers worked, but for antennas instead of SVs. But I have no idea how easy/difficult this would be to do and how well it would work against spoofers. Attila Kinali -- It is upon moral qualities that a society is ultimately founded. All the prosperity and technological sophistication in the world is of no use without that foundation. -- Miss Matheson, The Diamond Age, Neil Stephenson