Hacker News Reader

Is this really possible? I don't know much technical details about GPS, but I thought a large component was time-based. If my understanding is correct, wouldn't rebroadcasting fail because the times didn't match correctly?

The question is: match with what?

Part of the GPS calculation is to figure out what time it is. There is no reference needed other than what the satellites broadcast. If you are rebroadcasting the entire GPS signal it includes all of the satellites, and will be self-consistent.

Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so.

If the receiver has some sort of out-of-channel time reference that is accurate to nanosecond levels I suppose that could be used as a check, but that sort of thing takes an atomic clock and doesn't fit in a wristwatch.

Also, in the case of a rebroadcast it need not be delayed by more than something on the order of a microsecond or so.

That only works if the spoofer is very close by.

One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there.

If the receiver has some sort of out-of-channel time reference that is accurate to nanosecond levels I suppose that could be used as a check, but that sort of thing takes an atomic clock and doesn't fit in a wristwatch.

You're way off in your accuracy estimate.

Oven controlled crystal oscillators have been around for at least 50 years. Probably a lot more. And they're dirt cheap. All they are is some temperature stabilization around an ordinary crystal oscillator. Quoting from the (always highly accurate) :) Wikipedia:

The short term frequency stability of OCXOs is typically 1x10−12 over a few seconds, while the long term stability is limited to around 1x10−8 (10 ppb) per year by aging of the crystal https://en.wikipedia.org/wiki/Crystal_oven#Accuracy

An OCXO isn't practical in a tiny drone or a wristwatch, but it's highly practical in any military instrument that weighs more than a few pounds.

> That only works if the spoofer is very close by. One microsecond is 1000 feet. (Recall the "Grace Hopper nanosecond" as a start.) So, if the spoofing signal rebroadcast originates 5 miles away, that's 26 microseconds of delay right there.

I made a mistake in ambiguously referring to two things: processing delay at the spoofer, and speed-of-light based time difference between spoof signal and direct broadcast at the receiver.

However, I'm not aware of any crystal based clocks that are suitable for high dynamic range G environments that would be easy to use as an independent reference for any reasonable amount of time. They all suffer in shock/vibration conditions, and need external conditioning to maintain longer term stability. Maybe the military has 'em, but I guarantee they cost a lot more than a GPS rec.eiver

They all suffer in shock/vibration conditions

Interesting. I didn't know that.

There's a comment on another thread that someone just made: https://news.ycombinator.com/item?id=15007006

And now you can buy a genuine atomic wristwatch.

Here's a few sentences from the linked website: In each atomic physics unit is a small vessel of Caesium 133, an oven to heat it to 130°C, a laser to excite the atoms and a microwave resonator that resonates at the hyperfine transition frequency of the atoms, 16,546,737,186,000 vibrations per hour, with an accuracy of one 5 parts in 10-11. https://www.hoptroff.com/pages/about-us

The same shock/vibration limitation probably applies to it. Still, it exists! I think. I wouldn't spend that much money to find out if it was real.

Some links you might find interesting:

https://www.microsemi.com/products/timing-synchronization-sy...

http://www.oewaves.com/media-events/item/50-oewaves-to-devel...

http://www.gps.gov/governance/advisory/meetings/2016-05/lutw...

https://www.darpa.mil/program/micro-technology-for-positioni...

I haven't seen much (haven't been looking either tho) since the Micro-PNT program which was in 2008. Sometimes that means that things are getting interesting, other times it's a dry hole. I'm interested in any later developments if you know of them.

>Is this really possible? I don't know much technical details about GPS, but I thought a large component was time-based.

Yes, it's possible mostly because you can drown out the weak signals coming from satellites with much stronger terrestrial ones.

There is also a new generation of GPS planned that will help mitigate future attacks, but it's getting delayed like crazy: https://en.wikipedia.org/wiki/GPS_Block_IIIA

Also, see this article on how it's technically feasible: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20pre...

At its core, GPS works by having each satellite continually broadcast the current time. By observing the time-of-flight differences from multiple satellites (at least 4), the receiver can then compute its position and the current time.

There's a lot more to it, of course, in terms of how it's encoded and how you know where the satellites are and such, but that's the basic principle.

Note that the receiver itself doesn't know what time it is until it gets a position lock from the satellites. Receivers can have onboard clocks, which helps them calculate their position and the time more quickly than starting up with no idea of the time at all, but it's just a helper, not a requirement. Even if you have one, the onboard clock will necessarily be much less accurate than the ones on the GPS satellites, so any (reasonable) delta will be assumed to be clock drift, not spoofing.

So, if I set up a receiver at point A, then rebroadcast the signals I receive to your receiver at point B, and your receiver is blocked from getting the true signals at B, your receiver will think it's at point A. It will also think that the current time is behind, by whatever the rebroadcasting delay is, but it won't have any way of knowing that's wrong.

As far as mitigation goes, if your receiver was running before the spoof signal started to arrive then you could easily notice that things had suddenly gone crazy. I think military equipment that depends on GPS also has backup inertial navigation systems which would quickly show any divergence, and allow it to continue without GPS input (albeit at reduced accuracy).

>there's no real reason why a spoofer can't set up a receiver at one location and rebroadcast the encrypted signal as received there

I can't really see this working if you have an inertial navigation backup system. It would be easy to detect the large error in GPS position and just ignore the GPS.

You'll need two alternatives to GPS to be able to tell whether it's a malfunction in GPS, or the inertial nav. e-loran is such a third alternative.

Only if you assume they're equally likely to fail. Since INS is much less susceptible to spoofing and ought to have a fairly low nominal failure rate, in wartime it might be reasonable to assume disagreements are due to spoofing.

Also, I believe most airliners have 2 or 3 INS systems, so it would be easy to see (or detect) if one of them has failed.

It seems unlikely that all the gyros would silently fail...that would only happen if the gyros tumbled, or power failure to the gyros, but there would presumably be an error indication in either of those situations. (Also, these days they use ring laser gyros, which don't tumble or stop spinning).

Speaking of which, are RLGs actually difficult to manufacture or is the military intentionally stopping them from getting into civilian hands? Even the best cell phone sensor fusion seems to result in an obnoxiously shitty map experience.

The power requirements for even the most miniature RLGs is still pretty large relative to cell phone peripherals, and they are still physically pretty large. DARPA has had focus efforts in the MEMs arena for more than a decade now, including atomic clocks and optical systems but its not stuff you can put in a square mm of silicon and feed with a couple of microamps.

Huh, I'd have guessed the opposite: that a laser, optics, and a piezo vibrator would be easy to integrate, while a MEMS gyroscope would be much harder. I ask anyone who gives the slightest hint of familiarity with the field because I suspect that my surface-level understanding is just missing the juicy photonics challenge that's roadblocking integration.

The alternative hypothesis of military heel-dragging (similar to the case of bolometers) is much less exciting, but verifying it would at least allow me to stop poking around :)

Phones use MEMS sensors, which are much cheaper than laser gyros. I'm not sure if google maps uses the accelerometer, or just the GPS and compass.

In my experience, phone maps work well if the device has a good GPS signal. It's just the compass that gives a shitty experience. I wish google would ignore the compass and just use GPS direction when you're moving. They used to do this, but now they seem to rely in the inherently crappy compass for direction.

> Phones use MEMS sensors, which are much cheaper than laser gyros

Yes, but why? To my surface-level understanding, RLGs sound like they would be easier to integrate.

> It's just the compass that gives a shitty experience.

Yep, that's my experience too, and that's why I'd be ecstatic to hear that the compass was being replaced by a RLG (which could be re-locked to true North every time GPS got a decent movement vector).

Then again, I half suspect that something is FUBAR'din the current compass stack. I have one of those fluxgate-magnetometer current probes at work and can report that everywhere I've used it I have seen magnetic field vary as a high-SNR continuous function of direction, yet my phone's maps app has a ton of lag, hysteresis, and jankiness when rotating in the same damn field. Maybe we just need to wait for the cheap compasses to get better.

This is kind of fun, so to play some more: suppose the spoofing platform is mobile; say, a UAV that starts out very very near the target of the spoofing, and gradually moves away at a rate designed to confuse such a check.

You can see why military stuff gets expensive. The world gets complicated when folks are actively trying to screw with you.

Large commercial ships already have INS backups and it can be spoofed just fine using carry-off attack. Spoofed signal gradually diverges from the correct signal and inertial navigation can't spot the difference.

Detection 1: Constantly run HFDF on all GPS frequencies. You know where your own transmitters live. Process of elimination.

Detection 2: Compare GPS velocity vector to INS velocity vector. For fixed installations, have two receivers spaced some distance apart and compare GPS location.

Detection 3: Measure the time delay between GPS and your RTC. With a GPS disciplined RTC, drift should be low enough to make this viable.

Detection 4: Look for jumps in GPS location or time.

Mitigation 1: Send black vans, soldiers, or missiles as appropriate to rogue transmission locations determined by HFDF or the encoded position of spoofed signal.

Mitigation 2: Frequency-agile and mobile GPS substitutes almost certainly have a prominent role in EW strategy. Of course, as you note, the details have to be classified, but it's pretty easy to speculate what form the overall strategy will take.

You're talking about a GPS repeater. Such systems are commercially available to rebroadcast a GPS signal within a building where the signal wouldn't penetrate, but require a license to operate, IIRC.

As for countermeasures, well, whoever's holding the receiver is bound to get suspicious if they move and the reported position doesn't. :) Jokes aside, there is work being done integrating other sensors (inertial, compass, gyro, etc.) to do dead reckoning to detect errors in the position and motion reported by the GNSS receiver.

As an aside, "GPS" technically refers only to the positioning system operated by the United States. The generic term is "GNSS" (global navigation satellite system) and encompasses GPS, GLONASS, Galileo, Beidou, etc.)

> there is work being done integrating other sensors

Integrated navigation systems GPS/INS are already default in many critical civilian systems. They sell these systems as a single package.

These systems are still vulnerable against satellite-lock takeover where the spoofer who starts with repeating the correct signal and diverges from it gradually.