Hacker News Reader

Even with a key you can drown out the signal by blasting enough RF waves at the receiver or area. I’ve heard a Growler pilot describe what they do as shining a spot light in your face to blind you.

Yes but you would have to do that from top down. You can't shine a spot light on the back of a person's head to blind them. Not to mention the tricks they use to make RF signals directional to both send and receive.

> You can't shine a spot light on the back of a person's head to blind them.

You can, if the spot light is strong enough, and the person in question isn't floating in deep space. Just keep adding power until the light reflected by the person's surroundings is strong enough to blind them.

> Not to mention the tricks they use to make RF signals directional to both send and receive.

Makes me wonder if there's an RF equivalent of getting permanently blinded by laser light scattering off random objects in your line of sight.

that's called jamming and was addressed by the comment. if you wear very narrow blinders and point your face right at where you want to look, then the enemy needs to install their spotlight right ahead of you instead of just anywhere in front.

It is a mitigation that may help, but not foolproof: someone can jam or spoof from the sky.

Current areas where jamming is being detecting.

* https://gpsjam.org

This jamming isn’t from the sky though.

Incidentally, there has been a recent escalation in this: over Iraq commercial airline pilots have been reporting increasingly successful GPS spoofing, with GPS positions being shifted by tens or hundreds of nm, the clock being shifted, etc. In some cases this has exposed bugs in aircraft software where it has not successfully recovered the GPS position even after leaving the affected area, leaving them with degraded navigation all the way to the destination.

This is not as dire as it might sound, as there are plenty of other ways for an aircraft to determine its position, though it certainly reduces the margins for error in some cases. But it’s interesting because such spoofing should be extremely difficult to carry out successfully, especially on a moving target like an airliner.

> This jamming isn’t from the sky though.

In that particular instance, but:

* https://en.wikipedia.org/wiki/Electronic-warfare_aircraft

Waiting for drones:

* https://apps.dtic.mil/sti/citations/ADA508909

Encryption still won’t stop it. You will need many blinders to get a fix on enough satellites.

Or make a stronger spotlight and point it at whatever is directly in front of you, to blind you with reflected light.

Continuing that analogy, in the case where a sky facing directional antenna is being used: the pilot is crouched under a sewer grate, shining a light at the soles of your feet, as you stare up into the night sky. If you are pumping enough power to overcome a directional antenna, than you are more in the realm of a directed energy weapon - which requires an insane amount of power (see inverse-square law).

How feasible would you estimate passive positioning systems?

For example consider solar radio noise at frequencies that are partially reflected, partially transmitted by the ionosphere.

Do you consider it possible for an SDR to geolocate by comparing multiple antenna signals say:

1: "direct signal" : sun -DOWN-> partial transmitted through ionosphere -DOWN-> antenna 1 aimed at sun

2: "geography / terrain fingerprinted signal" : sun -DOWN-> partially transmitted through ionosphere -DOWN-> reflection on Earth -UP-> partial reflection from ionosphere -DOWN-> antenna 2

Or any suggested variations? (reflection from moon for example).

https://commons.wikimedia.org/wiki/File:Ionospheric_layers_f...

i.e. can Western citizens prepare to still have geopositioning in case of an adversarial (successful) first strike against GPS and Galileo where the citizen refuses to rely on adversary positioning systems.

With a clock and a telescope, you can get super precise positioning the same as the 16th century way... Atomic clocks are now good enough to make those positions really good.

You can do the same with radio frequencies and a phased array antenna if you like.

I'm not sure if other approaches would perform better.

I mean without a clock, the reference being the direct path of noise from the sun.

Telescopes are impeded by clouds.

During night there is no line of sight to the sun, so I concede my rudimentary idea or question has similar drawbacks.

It would be interesting if precise time could be derived from imaging the night sky, so that the synchronized clock becomes unnecessary.

I've actually heard of research into putting celestial navigation in guided missiles (from people who've worked on it -- so the idea that this is possible seems to not be a secret). Cameras and optics have become good enough to make this plausible with those kind of constraints.

I don't know if it's been deployed, but I would not be surprised.

Some ballistic missiles have already been using celestial navigation operationally for decades. That is used primarily during the mid-course phase, and then they switch over to inertial (or maybe radar in a few cases) for the terminal phase.

https://en.wikipedia.org/wiki/UGM-133_Trident_II

check this out: https://en.wikipedia.org/wiki/Pulsar-based_navigation

this is interesting, thanks for the reference, but it doesn't seem affordable for average citizens:

"The main error sources that impact the instrument design are the number of collected photons (related to the detector size and the integration time) and the timing accuracy."

Detecting and filtering for appropriate X-rays would seem to require a large and thus expensive detector.

Being able to self-locate during aerobraking (as described in following URL) is a very neat application though...

https://web.archive.org/web/20170316044511/http://gsp.esa.in...

I wonder what materials withstand the heat and plasma during aerobraking, yet are transparent enough for X-rays?

> How feasible would you estimate passive positioning systems?

Totally feasible. DECCA and LORAN-C basically work on the same principle. have a number of transmitters at known locations and measure the phase/interference to get location.

However, there are other ways. Visual navigation is totally possible (think SLAM, but with a pre-computed map)

DECCA and LORAN-C are not passive but rely on second parties maintaining transmitters.

I may be wrong, but I would hazard SLAM would require an enormous amount of data

> rely on second parties maintaining transmitters.

yeah, this is true. Passive radar does the same thing. its passive because the system isn't transmitting, something else is.

SLAM data can be pretty sparse. The keypoints for a city the size of london is under 100gigs. (although that depends on your algorithm)

but if you think about the amount of effort required to make GPS work, keeping an active visual map of a country isn't actually that much in comparison.

I was reading the specs for the GPS satellites vs. the GLONASS ones a while back, and it seemed like they transmit on a similar frequency but with a different modulation scheme and protocol. Pure speculation, but you could imagine a Tom-Clancy-esque scenario where their secondary role is to jam GPS when they need to.

To jam something, you ideally jam the same frequency, PRN code, and direction.

If you don't know frequency, you need to jam a wide range of frequencies. Defences like frequency hopping make use of this. Bluetooth uses this for example, to prevent inadvertent jamming. In GPS, frequencies aren't secret.

If you don't know the code, you need to jam with as much power as the benefit of the code. For GPS, thats a 10x 1024 bit code, which provides 43 dB of processing gain. This can be increased almost without limit, as long as you don't plan to move much during the code period. There are clever methods to make encryption keys double-up as PRN codes that the enemy doesn't know.

For direction, it depends on the receiver. Your phone has an omnidirectional receiver, so the attacker is 'on par with' the real signal. A military directional phased array system might have 200 elements, and therefore 30db of gain.

Add that up, and the enemy needs to use far far more signal power than the real signal to 'outshine' it. Turns out that's pretty much impossible - and if they get near to doing that, your biggest problem is probably being cooked by their jammer.

> To fully block a military unit receiving GPS, the enemy would need to have ~30 planes in the sky over the unit, between the unit and each GPS satellite, broadcasting the jamming signal. Pretty infeasible for them.

How did you arrive at this number?

It's approximately the number of GPS satellites in the sky from a given location on the ground. One plane per satellite. Of course this varies due to geography, orbits, etc. but is a good rule of thumb.

Number is a bit high but may be counting GPS, and EU GPS satellites you would have to block. You can "see" 4-12 GPS satellites at a time for one system. Assuming the EU system has the same style layout.

You don't need to block line-of-sight to the GPS satellites to create a GPS jamming attack. You just need a more powerful emitter near enough your intended target. No need for 30 planes trying to interpose themselves between the target and satellites.

Such a powerful jamming emitter is also a wonderful automatic target for loitering munitions

If it's within a region that can be attacked and the opponent has those capabilities, yes.

If you ask "the internet", the answer is drones. Regardless of the question being asked...

Recently huge drone swarms have been launched recently to increase the chance of mission success.

And to hope your enemy doesn't just launch a couple of anti-radiation missiles at your most powerful radiation source nearby.

Assuming they possess that capability, that is a risk, yes.

"home on jam" capability is being rolled out into smaller drone systems right now (it's not complicated per se, just somewhat risky since it could target friendlies).

You do if the victim uses a phased array antenna.

And any decent military receiver will do that, precisely to prevent jamming.

> Number is a bit high but may be counting GPS, and EU GPS satellites you would have to block.

All of which transmit on the same 3-4 frequencies:

* https://gssc.esa.int/navipedia/index.php?title=GNSS_signal

so you'd only have to have high-power transmitters on those and you can block things.

* https://gpsjam.org

Do it from a plane, or drone, and directional antennas become less effective as the jamming is coming from the same direction as the real signal (the sky).

Phased arrays can have a beamwidth of 1 degree... Which means the enemy has to get their jamming signal within 1 degree of the victim and the satellite.

And now you need to do that 30 times when there are 30 visible satellites.

A phased array can transmit to with-in a small angle, but how does that help the receiver? It is still coming from "the sky", so if you have an airborne jammer (EW fighter, drone), how will the receiver what's signal and what's noise?

I am aware of the spot beam functionality, which has higher power, which could help with overcoming noise:

* https://en.wikipedia.org/wiki/GPS_Block_III#Military_(M-code...

The biggest recent help against jamming was the introduction of the L2C signal on a different frequency with the Block IIR-M satellites, and then the more powerful L5 signal on Block IIF.

A phased array antenna can both transmit and receive within a small beam angle.

> Jamming can be pretty much eliminated by using phased array antennas.

citation needed there. GPS typical signal strength is -125dBm.

For ground based stuff, its pretty simple to overpower the band so that nothing can hear it.

This has been a solved problem for a very long time. The nice thing about GPS satellites is that you know where they should be, and where they shouldn't, so long as your RTC is properly set and you've got a compass.

A GPS Digital Phased Array Antenna and Receiver (2000): https://apps.dtic.mil/sti/tr/pdf/ADA452307.pdf

yes, phased arrays, especially if you have a tight beam, can give you an extra 40db of SNR (see figure 9 https://www.analog.com/en/analog-dialogue/articles/phased-ar..., also in the charts on your link)

but thats still like -70dbm at best. That's about the level of being a few meters away from a wifi AP level of power.

a 1 watt(RF) jammer is going to cast a large cone of non-GPS even with a phased array antenna.

You are forgetting about the phased nulling. Military GPS has been including jammer detection in the firmware for a long time. I remember my handheld unit constantly annoying me anytime the IED jammer (which was waaaay more than 1 watt of rf) went active... 2005ish - it would simply mask the signal coming from that direction and continue to provide positioning data.

Add in coding gain over 1 second (a code 10 million chips long), and that gives you an extra 70dB. Now it's getting hard to jam.

Downside: This only works if your movement over the 1 second period is predictable, to a small part of a wavelength. If you're moving unpredictably, you'll have to give up a few db's of coding gain.

> There are plenty of techniques the military could use to make jamming or spoofing almost impossible.

The US DOD is not as confident as you are, as they looking at backups/alternatives:

> DOD primarily relies on GPS for accurate PNT data, which is essential to effective military operations. However, multiple threats can render GPS data unavailable or inaccurate. DOD recognizes the threats to GPS and is taking steps to address them by developing more robust GPS capabilities and alternative PNT technologies. GAO was asked to review DOD's acquisition of alternative PNT technologies.

* https://www.gao.gov/products/gao-22-106010

> To fully block a military unit receiving GPS, the enemy would need to have ~30 planes in the sky over the unit, between the unit and each GPS satellite, broadcasting the jamming signal. Pretty infeasible for them.

All GNSS signals live on a finite number of frequency bands: L5/E5, L2, E6, L1/E1:

* https://gssc.esa.int/navipedia/index.php?title=GNSS_signal

* https://www.geospatialworld.net/blogs/gnss-frequency-bands-f...

* https://www.tallysman.com/gnss-constellations-radio-frequenc...

* https://en.wikipedia.org/wiki/Satellite_navigation#Frequency...

> The ITU have allocated the following L-band frequencies to GNSS (bold are aeronautically used):

> *GPS, the centre frequencies are 1575.42 MHz (L1), 1227.6 MHz (L2) and 1176.45 MHz (L5).

> *GLONASS operates as frequency divisional multiple access (FDMA) and there are two operational centre frequencies 1602 MHz (L1) and 1246 MHz (L2) and at 1207.14 MHz (L3). GLONASS over this decade will also introduce Code Divisional Multiple Access (CDMA) similar to GPS.

> *GALILEO has a range of frequencies assigned in the L-band as follows:

> ** E2 – L1 – E1 – Centre frequency 1575.42 MHz (band from 1559MHz – 1591MHz).

> ** E5A – Centre frequency 1176.45 MHz (band from 1164 MHz – 1188 MHz).

> ** E5B - Centre frequency 1207.14 MHz (band from 1188 MHz – 1215 MHz).

> ** E6 – Centre frequency 1278,75 MHz (band from 1260 MHz – 1300 MHz).

* https://pbnportal.eu/epbn/main/Overview-of-PBN/PBN-Concept--...

A handful of planes (or drones) focussing on those few frequency ranges can do a lot of mischief.

And this is not theoretical, but observed events:

> Russia has been thwarting US-made mobile rocket systems in Ukraine more frequently in recent months, using electronic jammers to throw off its GPS guided targeting system to cause rockets to miss their targets, multiple people briefed on the matter told CNN.

* https://www.cnn.com/2023/05/05/politics/russia-jamming-himar...

GPS guided missiles are a unique case, because there is a good chance the enemy gets hold of the electronics. Therefore, you don't want to put your military GPS encryption keys in there, because if the enemy got hold of those keys, they could spoof your satellites.

> Therefore, you don't want to put your military GPS encryption keys in there, because if the enemy got hold of those keys, they could spoof your satellites.

IIRC, I remember reading that the NSA has cipher(s) where the decryption 'algorithm' is completely than the one for encryption, i.e., just because you have the decryption code doesn't mean you can encrypt.

So normal public key cryptography? ;-)

No, this is for symmetrical encryption.

So think something like AES, but where the 'distributor' encrypts something, gives you a key and an algorithm, and you can decrypt it. But you cannot use the same algorithm to encrypt to send back anything.

For the life of me I can't remember where I read it (which book), so have never been able to dig into it more.

PFS

"The sky" covers 180°x180°, or more if you're in a plane. A jammer that can block out half of that can result in a significant reduction in accuracy