cybercriminals
In 1492, under a charter from the monarchs of Spain, an Italian man named Christopher Columbus severely underestimated the Earth’s circumference, sailing three ships into what he would reportedly die believing was the East Indies, but which was in actuality an Archipelago thousands of miles away, now known as the Bahamas.
Mistakes of this nature may seem impossible today, with multiple GPS satellites sending their signals to anyone who wants to figure out his or her exact position on Earth’s surface. Born as a navigation system for military ships, Global Positioning System (GPS) slowly became a mainstream tool for sailors, tourists, everyday people and semi-autonomous robots. To make this location tracking system available for everyone, GPS creators avoided using encryption of any kind in the civilian variety of the satellite signal, thus eventually making this attack and conceptually similar ones possible.
A few months back, a rather large luxury yacht deviated from its intended course somewhere in the Mediterranean Sea after a team of radio navigation researchers built a device capable of overriding the ship’s GPS receivers with spoofed signals.
The project was carried out by researchers from the University of Texas at Austin. According to them, spoofing is a process whereby an attacker creates a false civil GPS signal more local and stronger than the satellites that transmit real civil GPS signals. In this way, the attacker can compromise GPS receivers, making them believe that the false GPS signal is the legitimate one.
Holding a first-of-its-kind blue box roughly the size of a suitcase and standing onboard the White Rose of Drachs super-yacht as it travelled through international waters from Monaco to Rhodes Greece, researchers aimed the spoofing device in the direction of the vessel’s two GPS antennae. The blue box transmitted a subtle collection of fake civil GPS signals that eventually overwhelmed the ships GPS systems and gained complete control of its navigational course.
The process did not trigger any alarms nor were the fake signals in any way distinguishable from the real ones. In other words, a potential attack of this kind would be completely unnoticeable to the crew of a modern ship.
The way this attack works is slightly counter-intuitive: the researchers didn’t use fake GPS to directly alter the ships course. They used the fake GPS signals to trick the crew into altering the course on their own. So, the researchers spoof the GPS – causing the crew to think the boat has moved slightly off course. The crew then redirects the boat to what it believes is the correct course. In reality, the crew is over-compensating and sending the boat on what could become a wildly different course depending on how for it has to go.
“The ship actually turned and we could all feel it, but the chart display and the crew saw only a straight line,” Project leader Todd Humphreys said.
The researchers claim that their spoofing device has implications that reach far beyond altering the navigation course of a privately-owned, $80 million super-yacht. In fact, just last year Humphreys led a team of researchers who managed to perform a similar GPS hijack on an unmanned aerial vehicle. The implications of the research could implicate the entire transportation industry as the trend toward autonomous navigation continues.
“This experiment is applicable to other semi-autonomous vehicles, such as aircraft, which are now operated, in part, by autopilot systems,” Humphreys said. “We’ve got to put on our thinking caps and see what we can do to solve this threat quickly.”
In fact, in late 2011, reports surfaced that the Iranian military may have exploited similar vulnerabilities in order to safely land a U.S. drone within their borders.
The problem we’re facing here is clear – it’s easy to patch a webserver, it’s more complicated to patch a browser installed hundreds of millions of computers, but it’s almost impossible to patch billions of microchips with embedded GPS functionality. It’s not that complicated to patch the software on GPS satellites. The problem emerges when it turns out that new hardware is required, thus introducing the need to spend many years and billions of dollars on lifting new hardware into space – basically, manufacturing and launching next-generation GPS satellites.
Hard to say what you can do to protect yourself on this one. Pray? Really though, the transportation industry is just going to have to stay on top of this and try to be proactive about fixing the underlying problems that lead to these sorts of attacks. As of right now, take solace in the fact that this attack was launched by a group of super-intelligent academics from UT Austin, but also be wary of the fact that we are rapidly entering a world where smart people can hack all the things. And as USA Today Journalist Byron Acohido more-or-less said at the Visa Global Security Summit two weeks ago: what the really smart guys can do today, everyone can do in the future.
Tips