GPS spoofing countermeasures: Your smartphone already has them There's suddenly a lot of panic about GPS satellite navigation spoofing, and BAE Systems among others would like to sell the military some tech to resist it. But in fact, most modern smartphones already have strong countermeasures against this sort of thing. UK-headquartered but largely US-based BAE's latest grab for …
Joint Direct Attack Munition (JDAM) is a guidance kits, which have been around for about 20 years already are GPS spoofing-proof. JDAM kits contain an integrated inertial guidance system coupled to a Global Positioning System (GPS) receiver. Inertial guidance systems cannot be jammed, although they do suffer from integration errors. Other military munition "GPS" systems are also inertial + GPS.
Thing is, I *can* and have killed food with hand-knapped obsidian blades. I have a log cabin (built by my Great Grandfather in 1890ish, added onto by me twenty years ago using the same techniques). The wife & I teach a "shearing to socks and shirts" class twice a year.
In reality, I use a humane killer on my livestock, the log cabin is our "get the fuck out of reality" space, and I purchase most of my clothing at Sears. I do grow nearly all the vegetables we use here at the Ranch, though.
The difference between you and me is that I not only know how it's done, but I can, and actually do it ... and teach how, for people interested. There is no "ap" that substitutes for getting your fingers dirty.
Only problem is paper maps have this annoying tendency to grow more inaccurate as time passes. Oh, because roads get built, demolished, resurfaced, restructured. Many a driver has gotten lost because the T-intersection they were supposed to find is now a four-way because the road got extended. Or because the map says take the first on-ramp, not realizing a new onramp was just added in front of that one--going THE OTHER WAY.
The desk phone at my elbow is an early 1950s Western Electric rotary-dial telephone. It was the first telephone my Father ever payed the lease on. It still makes and receives telephone calls, even during power failures, which is all I want a telephone to do. Hopefully $TELCO won't kill pulse-dialing on land-lines any time soon ...
But you seem to have an issue with single-tasking tools, AC. Care to explain why?
I'm not sure if you've actually read enough articles on here to realise Jake but The Register is a Tech Publication. That means they write about and attract people interested in technology. It is not an antiquated contraptions and ranching publication. Yet, almost every post you make has to reference one or the other.
Do you go on to the BMW owners forums and tell them how great your bicycle is and how rubbish their cars are?
The article in question isn't even about smart phones, except as a reference to the fact they the already perform a function which BAE is trying to lever into the military market. Yet still you jump on here "bragging" about owning an old nokia. Who cares? Its not even relevant to the discussion.
You don't think that producing food & clothing is technology? The mind boggles.
I'm not bragging about the old Nokia. I'm just pointing out that it does exactly what I expect a telephone to do, which is place and receive telephone calls.
As a side-note, mr/s techno-buff, I'm "jake", not "Jake". Computers tend to be literal.
So, AC 09:50 ... Which AC are you, exactly? Some AC or another mentioned food & clothing ... which are technology, regardless. You're not that AC? OK ... Maybe create a handle that the rest of us can actually get a grasp of who you are and reply to on a one on one basis?
Remember, I'm "jake", not "Jake" ... Might be hard to grok, but think about it.
My point is that you would probably have a boat-load more cash in your jeans if you had ever taken a simple "navigation 101" course.
The only time I use electronics for navigation is in the air, and on open water. On the road, it's hardly useful, much less necessary. I can't remember the last time I was more than a street or two off course.
They could have easily got it from you.
Have you ever had your wifi and GPS turned on at the same time?
Did you check the option to say you're willing to share the wifi positional data is acquires with google? (You can change your mind by going into location settings and unchecking the "use wireless networks" and then checking it again. It asks for confirmation each time).
Then again, even if you didn't, someone else walking past (doesn't have to be a streetview car) could easily have been.
It's actually a useful feature. It allows the device to locate your initial (vague) position very very quickly. A cold start on GPS can take half a minute or so without it, which is a damn long time when you're sat at the front of a queue of traffic trying to work out where you are.
In the hope of avoiding unnecessary concern, Apple and Google (and probably others) are taking the MAC address and the location details and associating the two. As a WLAN AP will always broadcast it's MAC address, ACL's and setting the "hidden" bit won't stop these details appearing unless you turn off the radio or AP.
They may well be adding SSID information, but I would hope they filtered this to just agreed providers.
There are more BAe Systems employees in the US than in the UK.
There is more BAe Systems revenue in the US than in the UK.
You can check this in any Annual Report for the last few years.
Plus whenever I visited sites like Warton, the "UK employees" always included significant numbers of US citizens "temporarily" working in the UK.
All in all, I think that makes them not very British.
I wouldn't trust what the Iranians have to say any more than I'd trust what the US says back.
From what the Iranians have said so far, they could have gained the same information from shooting down a drone or waiting for a drone to fail by some other means and salvaging its equivalent of a black box from the wreckage and cobbling together a basic model of its airframe out of plywood and larger bits of debris.
The Iranians displayed a complete, undamaged drone, explained how they brought it down, and revealed other bits of on-board info including mission data, past service history etc to prove their point. And tellingly, the US has not denied that what the Iranians say is plausible/possible.
The simplest conclusion, therefore, is that they did, indeed, bring it down as they say. Any other explanation is currently not as likely. Remember this is a nation on the brink of independently developing nuclear weapons, with a very high level of technological expertise. It's worth taking what they say very seriously.
Two conclusions:
1. Whether or not it's possible to encrypt GPS usage so that it cannot be spoofed, the current US attack drones don't do so.
2. On-board data stored in the drone's computers is obviously not adequately encrypted.
Neither of these conclusions are surprising, since the whole point of drones is that they can be developed and deployed quickly and cheaply. But I'd be very surprised if there wasn't a fast scramble in the US to sort out their encryption.
The simplest conclusion, therefore, is that they did, indeed, bring it down as they say. Any other explanation is currently not as likely
maybe they just bought one....
I bought an accessory for my motorcycle, in HongKong, that set me back the equivalent of 29 pounds whixh jams all cell and GPS frequencies including 3G.
It's small enough to fit in my under-seat storage and the antennae are fairly inconspicuous.
In the city the range is approximately just over a 100 metres (tested against cells and a GPS receiver). In the open country/highways things get much better. As our CGST (highway police) use speed traps with GPS attached and speed checking is far shorter distanced with a plastic bodied motorcycle/motorscooter, than a huge blob of steel in the form of a car or truck (lorry). Without GPS readings the courts will not accept speeding tickets. The GPS reading is on the picture along with the time, date, compass direction and speed.
I suspect BAE's wet dream could be as easily defeated.
"I bought an accessory for my motorcycle, in HongKong, that set me back the equivalent of 29 pounds whixh jams all cell and GPS frequencies including 3G."
So you're saying that when you have an accident and you - or somebody else - is lying in the road, unconscious and bleeding to death, nobody can call the emergency services? And all so that you can roar through speed cameras above the legal limit, most likely causing the aforementioned accident? Moron. You don't deserve an ambulance.
You sir, are a cretin.
Please explain how wiping everyone's mobile signals within 100m will stop them from texting or being distracted as they approach the rear of your car/bike? I don't know about your phone, but I can happily text away on my phone without a signal, but it obviously won't send. Also, if I was in the naughty situation of using my phone while driving, suddenly losing signal for no reason is probably going to make me more distracted trying to work out what went wrong.
What is funny is you're doing one illegal thing (jamming signals), to stop people doing other illegal things (using phones while driving), but with the ultimate aim of helping you do illegal things and not get caught (speeding).
While Google's location service using the MAC addresses of WiFi routers collected by Streetview vehicles is usually accurate, it has an interesting flaw: moving routers.
I first noticed this when a photo taken at home with my Android phone on a Caribbean island had a Brussels address in the EXIF information. Later, I noticed when using free WiFi in Dutch trains the location to be off with as much as 200 kilometers. Then I figured it out: Streetview vehicle passes, sees router, puts it in database. Router moves (from Brussels to the Caribbean, or on board a train), location is off.
MAC addresses are routinely configurable in software, so are very easy to spoof, as anyone who has configured a router in expert mode or used Aircrack-NG is likely to know. So these addresses should be expected to relocate, and should not be expected to be globally unique, which was the original intention of making these up using first half as unique manufacturer code and the second half as unique to manufacturer serial number. When I upgraded my home from a computer acting as a router to using a dedicated router I reconfigured the MAC address on the new router to the same as the old Ethernet card on the WAN side so the ISP didn't change my IP address.
Differntial GPS, to compensate Selective Availability (SA), was known and in use since 1986. It consisted of a radio beacon with known position. This was broadcast to differential GPS receivers, so that the SA offset could be compensated for a certain range (at least tens of miles) around the beacon. It was used a/o in geodetics, to obtain very precise positions, e.g. to find out if a seawall was moving. It was also looked at in the contaxt of car navigation. I do not believe for a moment that this basic idea was patented by BAE Systems or Ploughshare, so I do not think their patent can be worth much.
From the article:
Quote: Using ambient radio signals to confirm a location isn't "a real game changer" as BAE systems would have us believe, then, but it is quite a good idea: which is why Google, Apple and other rather faster-moving technology firms started doing it long ago. Unquote.
This is identical do DGPS
"This is identical do DGPS" [sic]
In a nutshell, differential GPS relies on removing the noise from the observations at a target receiver by applying a series of corrections (one for each common observable) obtained from a reference receiver at a known position--knowing that those errors are very similar over a relatively large area--such that it is possible to solve for 'e' in the equation C = O + e (where C: corrected value, O: observed value, e: error). In the original technique, called DGPS, this was done by applying the above formula to the pseudoranges at a reference station and either broadcasting the correction values (Real-time DGPS), or committing them to persistent storage so that they could be applied latter (post-processed DGPS).
A number of refinements followed over the years, the latest of which are so-called space-state solutions, where the corrections are applied to the satellite ephemerides instead of the pseudoranges, and are thus globally valid. Anecdotally, the pioneers in this area, in the commercial arena, were tractor and agricultural equipment company John Deere with their StarFire system, based on previous research by NASA's JPL.
One important point to note is that if a GPS signal is unavailable, be it due to jamming, obstructions, or system failure, DGPS is of no help whatsoever (the 'O' in the equation is undetermined).
Now, I am thoroughly unfamiliar with the idea proposed by BAE. My simple and no doubt incomplete and inaccurate understanding, is that this is an evolutionary improvement over the triangulation methods used for radiolocation which have been in use since before WWI (e.g., such as NDBs used in aviation), and is used to complement rather than enhance the precision of, GPS.
So, would you care to explain then how is this "identical to DGPS", please?
You do not have to tell me how GPS works, I was in charge of the team that designed the CARIN system and, later, the Caresse system in Philips, from 1988 to 1999, Your explanation is nothing but a lot of jargon, probably with the aim to come over impressive. It did not work, unfortunately. At an exam session I would probably fail you.
How is DGPS very similar to the idea used to correct GPS positions in smartphones and the like? Simple, the DGPS protocol is: A GPS position is acquired. It is verified with information from one (or more) local beacon(s), whose position(s) is (are) exactly known. The (if necessary) corrected position is then established.
"the DGPS protocol is: A GPS position is acquired. It is verified with information from one (or more) local beacon(s), whose position(s) is (are) exactly known. The (if necessary) corrected position is then established."
On that level of detail a Mini and a double decker bus are identical too. They've both got an engine and four wheels. But how many people can you get in a Mini?
Details matter. At any sensible level of detail, this BAe concept is not like DGPS. Obviously, DGPS allows you to take a trustworthy GPS position and make it better by using specifically designed and built local DGPS transmitter infrastructure and a co-operating DGPS receiver. This shiny allegedly new thing from BAe alleges that it can use existing ("ambient") signals, not needing any new infrastructure at all, to provide a (not particularly high resolution, not particularly accurate [1]) position fix, independent of GPS.
[1] Resolution (precision) and accuracy are different. I could say that my wages are £3,141,592 euros per week. That is quite a precise number. It is also completely inaccurate.
This is BAE and the MOD. It's got nothing to do with GPS or security - simply setting up another cash conduit to the BAE ministerial retirement fund.
By the way
"Ploughshare Innovations" - I like that.
Is funny yes cos they have beaten the swords into ploughshares and they're going to have a f*$%*g war anyway and make loadsadosh. Hahaha - that'll teach that peacemongering Isaiah.
This article is missing some important details - see
http://www.theengineer.co.uk/sectors/electronics/news/bae-navigation-system-identifies-suspicious-signals/1013081.article
and
http://tech.slashdot.org/comments.pl?sid=2950387&cid=40517317
Some key differences are the accuracy possible with NAVSOP versus smartphones, the integrity monitoring performed, the ability of NAVSOP to locate spoofers and jammers during operation, the type of measurements performed (Skyhook/Google/Apple only perform RSSI measurements, NAVSOP exploits timing and carrier phase), the learning capabilities of NAVSOP far exceed those of smartphones, the list goes on.....
If the author is interested in what can really be achieved with smartphones alone, beyond the default capabilities provided by Skyhook, Apple or Google, he should read an award-winning paper from the NAVSOP team: http://www.plansconference.org/abstract.cfm?meetingID=36&pid=51&t=C&s=1%29
Thumbing through my copy of the NRL EW Handbook (NRL 9737. Handy for lots of basic electronics) Let me see if I can unpack this.
You've built a civilian bands Electronic Support Measures receiver (which is what this process basically is) and hooked it up to a database package and a GPS. There might be motion sensors on the package to detect when the *receiver* movers, rather than the sources.
If you've got GPS you build the emitter database Using your (known) position and as you move you (as measured by either GPS or the IMU motion sensor) work out attenuation factors to get range to source, transmitter power etc by some kind of incremental filter.
If you loose GPS you continue to record and build the DB in terms of signal strengths, bearings, phase shifts etc. IE You're not at 85deg 45"12'N, 67deg16"5'W but 2km from that 100Kw FM radio station that is 3deg from North.
Given ESM receivers are complex and power hungry You've presumably got some Special Sauce ( (c) Lewis Page) that speeds up the process and cuts the power requirements.
Yes you can track a train under a tunnel by the GSM system used for train drivers (does that work in the London Underground?).
I just find the whole scenario implausible. A "clean kill" that takes out *only* GPS and leaves everything else standing? That sort of ignores several details.
Military GPS is *much* harder to spoof given the code patterns and are likely to synch up in friendly territory and stay locked on throughout, making civilian GPS corruption irrelevant. As this is BAe's primary target.
Systems that use GPS for timing reference *still* need a timing reference. I see no provision for getting one through this system.
There are *multiple* GPS waveforms and the Galileo, GLONAS and Chinese systems. They would also have to be inoperable or ruled out. We're back to the military are we not?
I like diversity and admire a clever hack as much as any one but I'd suggest that organizations concerned about GPS outage (those that need a position fix, not a 50ns precision clock) would simply make sure their receivers received some of the other signals as well. If they are not the UK MoD they will look at the cost/benefit case and conclude it's just not worth it.
And of course it's not likely to work very well down a cave in Reganistan or any other bit of primitive mountainous cave pocked country where British troops have been sent as part of the "special" relationship.
It's an impressive achievement. But is going to be of any actual *use*?
If you read the links in the previous comment you will learn that RSSI is not the primary metric for outdoor NAVSOP, timing and carrier phase are, so you in good company and haven't guessed correctly about how NAVSOP works. Signal strength for distance estimation is rubbish for long ranges to transmitters, look up free space path loss. There is a clean kill of GPS every time you go indoors, but many opportunistic terrestrial signals are still available, so that is happening every single day to everybody. All satellite positioning signals have the same failure modes caused by the extremely weak signals at the earth's surface, so adding more satellites doesn't provide true resilience - no sat signal punches indoors like cellular, dab, dvb, etc. All GNSS are susceptible to ionospheric issues, so a severe scintillation event will remove use of all GNSS, etc. Integrity monitoring of GNSS is an important capability regardless of how expensive your GNSS gear is. Opportunistic signals can provide stable timing, that is a key thing NAVSOP learns about. Some digital signals are locked to atomic standards independent of GPS, some are locked to GPS, some are only running at OCXO stability or worse, and those statements are based on experimental evidence.
"you will learn that RSSI is not the primary metric for outdoor NAVSOP"
Nor did I suggest it was. You are conflating 2 different parts of my post, one of which was written to give a flavor of how the system switches between GPS available and unavailable modes.
"timing and carrier phase are,"
I think cut down ESM receiver architecture (some of which use interferometric methods) is a pretty good short form description. I would not like to try carrying one around however.
"There is a clean kill of GPS every time you go indoors, "
Quite possibly. Which would be unimpressive except that GPS was never designed to work *inside* buildings.
You have a life threatening application that *depends* on GPS for navigation *inside* buildings that's in wide spread use I'm clueless. What is it? Because if you don't I doubt you're going to capture that market. Those people who are using GPS to *supplement* their interior guidance will either use a fall back mode or set up some private backup radio system.
Joking aside this sounds like you're shifting the goalposts, or the target market. Fixed locations needing precision timing references? Vehicle guidance? Indoor nav?
"All GNSS are susceptible to ionospheric issues, so a severe scintillation event will remove use of all GNSS"
Now that sounds like the glimmer of a *plausible* problem. Specifically a high power solar flare (but again high enough to disrupt the ionosphere but not enough to cook the ground level radio infrastructure).
"Integrity monitoring of GNSS is an important capability regardless of how expensive your GNSS gear is. "
I think if it's provided by BAe "expensive" is a given.
"Some digital signals are locked to atomic standards independent of GPS"
Like what was MSF Rugby at 60Khz (now IIRC moved to 59Khz to harmonize with *global* frequency standards). It can't do the high frequency thing but I'll bet it can *converge* a local oscillator to the correct time accuracy fairly quickly.. I believe HP coined the term "digital vernier" for some clever circuitry to do just that.
I don't know the details of the system and I'm not interested enough to register to find them out. I'd probably look for the patents that have no doubt been filed for this. You might call me a professional obtrusionist.
I'm sure it was lots of fun to work out the details of this and fully worthy of getting a PhD but actually getting people to buy it if (unlike the MoD) they actually see they have a choice is likely to be more of a challenge.
Like email the world has gradually become addicted to GPS to the extent widespread outage for any serious period of time (hours in some cases) could have serious consequences. Is this the answer? IDK.but beware of BAe bearing gifts.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
