IEEE Spectrum August, 2016 - 30

GPS satellites

False GPS
signals
transmitted
by attacker

to Fool a yaCHt: In this real-time spoofing

demonstration, an attacker transmits false GPs signals
to override those the White Rose receives from GPs
satellites. the attacker adjusts the coordinates so
that the crew believes the ship has blown off course
[blue line]. When the crew resets the ship's path, they
unwittingly guide it onto a new route [red line].

False GPS coordinates
indicate ship
is off course

Fortunately, Psiaki and his students from Cornell University had been forging antispoofing defenses. In fact, Psiaki
was testing an early prototype of a spoofing detector at White
Sands at the same time that Humphreys's group attacked the
drone. The prototype successfully detected every attack, but
only after hours of off-line computation.
Could Psiaki produce a real-time version? If so, Schofield
wanted to test it on the White Rose-and soon.

registers these weak signals as though they were part of the
stronger, true signals transmitted by those satellites.
Then comes the delicate art of the "drag-off," in which
HeRe ARe THRee MAIN WAYS to protect against
attackers must gently override the true signals. To do this,
GPS spoofing: cryptography, signal- distortion
the spoofer's operator gradually increases the power of the
detection, and direction-of-arrival sensing. No
false GPS signals until the receiver catches onto these new
single method can stop every spoof, but Psiaki's
signals. If the signal increase is too abrupt, the receiver or
team has found that combining strategies can proeven the ship's human navigators might detect something vide a reasonably secure countermeasure that could be comamiss. Once the receiver has latched onto the false signals, mercially deployed.
the operator can adjust the spoofer and receiver to a new set
Cryptographic methods provide a way for users to authenof coordinates and leave the true signals behind.
ticate signals on the fly. In one approach, for example, civilBack on the White Rose, crew members noted the appar- ian receivers would use PRN codes that are totally or partially
ent-but not actual-3-degree leftward drift that Humphreys's unpredictable, similar to those used by the U.S. military, so a
team had fooled the ship's receivers into recording at the spoofer can't synthesize the codes ahead of time. But to verify
start of the attack. However, the shift was so slight that the each new signal, every civilian receiver would have to carry
crew assumed it was due to natural forces such as water cur- an encryption key similar to those held by military receivrents and crosswinds, so they adjusted the vessel slightly to ers, and it would be difficult to keep attackers from obtainthe right. In reality, this corrective maneuver actually took ing such widely distributed keys.
them off course.
Alternatively, a receiver could simply record the unpredictAs a result of the crew's actions, the White Rose veered a kilo- able part of the signal and wait for its sender to broadcast a
meter from its intended course, unbeknownst to Schofield, digitally signed encryption key to verify its origin. However,
before Humphreys called off the spoof about an hour later. this approach would require the U.S. Air Force to revise the
The same trick could have been executed for a ship on auto- way GPS signals are broadcast and manufacturers of civilpilot, with the navigation system performing the course cor- ian receivers to change how those devices are built. It would
rection instead of the crew.
also require a slight delay, which would mean that navigation
Schofield was dismayed, to put it mildly. He and his crew updates would not be verified instantaneously.
depend on GPS for the safety of all on board-for example, for
An easier way to protect civilians would have them
navigating away from storms and for steering clear of shal- "piggyback" off of the encrypted U.S. military signals. Already,
lows and underwater hazards at night or in fog. Although military signals can be received and recorded by a civilian
Humphreys's spoofer is too sophisticated for the average receiver even if they cannot be decrypted and used for navicomputer hacker to assemble, this technology is within reach gation. Once they record the signals, civilian receivers can
of many countries-there have been rumors of spoofing "in observe the noisy trace of a PRN code even if they can't figthe wild" by North Korea-and even some private individuals. ure out the actual code. That means these receivers could
30

AUG 2016

north AmericAn

SPectrUm.ieee.orG

IllustratIon by

James Provost

http://SPectrUm.ieee.orG

Table of Contents for the Digital Edition of IEEE Spectrum August, 2016