GPS Spoofing, old threat and new problems

For several years are known vulnerabilities of GPS systems, but the wide use of these technology in today’s society need a continuous reassessment of the risks we are exposed.
The first report in which they were discussed threats to technology is known as the “Volpe Report” that describe which are the main reasons to consider the GPS system as an attractive target in the civil and military sectors.

The main threat to GPS systems is known as “GPS spoofing” whereby an interference in GPS receiver is fooled into tracking counterfeit GPS signals. Unlike in case of jamming of GPS signals in the case of spoofing the targeted receivers are deceived.

GPS “spoofers” are devices that create false GPS signals to fool receivers into thinking that they are at a different location or different time,this type of attacks can be really useful in a multitude of scenarios.
Let’s consider that this attacks aren’t simple to detect and can be conducted in aviation like in financial environments.
The Volpe report recommends studies to characterized the spoofing threat: “Information on the capabilities, limitations, and operational procedures [of spoofers] would help identify vulnerable areas and detection strategies.”

During the risk assessment have been studied several countermeasures classified for their implementation.
Countermeasures implemented in software on GPS receivers

• Amplitude discrimination
• Time-of-arrival discrimination

More sophisticated tecniques are:

• Consistency of navigation inertial measurement unit (IMU) cross-check
• Polarization discrimination
• Angle-of-arrival discrimination
• Cryptographic authentication

Some attacks are quite difficult to conduct because that need sophisticated hardware like multiple antennas or a high-grade inertial measurement unit (IMU) charaterized by high costs. The best prevention of this attacks could be made using cryptographic techniques, in other words receiver and transmitter use mutual authentication processes avoiding interferences of external sources. Unfortunately this tecniques, while compatible with a classic gps, require more powerful hardware and systems able to manage the overhead introduced by authentication procedures, for this reason it is largely used in military sector and not in civil one  because it require modification of the systems used.

In our imagination the use of GPS systems is related to the concepts of position and route, the use of these tools in aviation, marine and transportation to indicate the way forward in the absence of other references. This view is profoundly mistaken. The GPS are also used in other areas, from environmental control to the financial sector.  A possible attacks to GPS system would impact many sector with serious consequences. Since December 2003 the Department of Homeland Security alerted on the risk of possible attack providing some countermeasures including monitoring the absolute and relative GPS signal strength, monitoring the satellite identification codes and the number of signals received and checking the time intervals between the received signals to guard against spoofs.

Extremely interesting is the impact that a GPS system can have on the financial world. In these areas it is vital the accuracy of measuring time on a global scale and the synchronization between the various zones. To do this it used the GPS technology. The main trading systems use GPS to synchronize each other and an attack could even cause the trading block.

A typical attack can be addressed with the intent to sabotage the times on one of the global stock exchanges, it could cause the block of the activities once the automated trading systems notice the anomaly. It’s happened in 2010 during the Flash Crash of 2.45, on May 6th when the United States stock market crashed.

Imagine what could cause a misalignment of a few milliseconds between the various trading systems. Criminals could exploit this mismatch to have advance knowledge of the value of some trade. In this way it is possible to make fraud with worrying consequences.

Todd Humphreys Assistant Professor of the University of Texas with him team have created the world’s most powerful GPS spoofer and has tested it on GPS-based timing devices used in mobile phone transmitters.

Fortunately so far no serious attack has been recorded but we are seeing evidence of basic spoofing, likely carried out by rogue individuals or small groups of criminals. Evidence of this attack have been collected in several countries monitoring jamming and spoofing activities for a long period.
It is necessary to take in serious consideration this kind of threat due their sensible impact on our ordinary activities.

Pierluigi Paganini

References

http://www.gpsworld.com/defense/security-surveillance/assessing-spoofing-threat-3171?page_id=1