Marine

University of Texas team takes control of a yacht by spoofing its GPS

University of Texas team takes control of a yacht by spoofing its GPS
The 213-foot White Rose is the US$80M megayacht whose GPS navigational system was spoofed by about $2,000-$3,000 worth of equipment (Photo: U of Texas at Austin)
The 213-foot White Rose is the US$80M megayacht whose GPS navigational system was spoofed by about $2,000-$3,000 worth of equipment (Photo: U of Texas at Austin)
View 6 Images
The 213-foot White Rose is the US$80M megayacht whose GPS navigational system was spoofed by about $2,000-$3,000 worth of equipment (Photo: U of Texas at Austin)
1/6
The 213-foot White Rose is the US$80M megayacht whose GPS navigational system was spoofed by about $2,000-$3,000 worth of equipment (Photo: U of Texas at Austin)
Jahshan Bhatti operates the spoofing hardware aboard the White Rose (Photo: UTexas at Austin)
2/6
Jahshan Bhatti operates the spoofing hardware aboard the White Rose (Photo: UTexas at Austin)
The distance from three satellites determines the location of a point on Earth's surface (Image: B. Dodson)
3/6
The distance from three satellites determines the location of a point on Earth's surface (Image: B. Dodson)
The electronic chart shows the ship's GPS-based location and the planned route over a navigational chart, on which the ship's current location and direction of travel is indicated by the black target and arrow, respectively (Image: UTexas at Austin)
4/6
The electronic chart shows the ship's GPS-based location and the planned route over a navigational chart, on which the ship's current location and direction of travel is indicated by the black target and arrow, respectively (Image: UTexas at Austin)
The RADAR system measures the distance and bearing to nearby targets and plots their course, along with the ship's (spoofed) course derived from GPS measurements (Photo: UTexas at Austin)
5/6
The RADAR system measures the distance and bearing to nearby targets and plots their course, along with the ship's (spoofed) course derived from GPS measurements (Photo: UTexas at Austin)
On the bridge of the White Rose appear, from left to right, crewmember Sammy, graduate student Ken Pesyna, Professor Todd Humphreys, Captain Andrew Schofield, and crewmember Ryan (Photo: UTexas at Austin)
6/6
On the bridge of the White Rose appear, from left to right, crewmember Sammy, graduate student Ken Pesyna, Professor Todd Humphreys, Captain Andrew Schofield, and crewmember Ryan (Photo: UTexas at Austin)
View gallery - 6 images

Civilization depends on the Global Positioning System for everything from precision armaments to finding the location of the nearest pizza shop. Indeed, access to GPS's strengths and capabilities has grown so fast that little concern about its weaknesses has penetrated the public consciousness. Fortunately, assistant professor Todd Humphreys' team at the University of Texas at Austin continues to arrange splashy demonstrations of GPS spoofing. His latest is to covertly alter the course of an oceangoing yacht.

The Global Positioning System (GPS) is made up of a constellation of satellites and ground stations, the satellites continually transmitting the current time and their location in orbit. Even though the transmitted power is only about 10-16 watts, the extraordinarily sensitive GPS receivers in many cases can detect multiple GPS signals from an indoors location.

Given such signals from four GPS satellites, the time interval between sending and receiving the signals reveals how far away the satellite is from the GPS receiver. Added to information pinpointing the orbital locations of the GPS satellites at the time of transmission, this is enough information to locate the receiver to within about a 5-meter (16-foot) circle on the Earth's surface. The delicacy of the location task is illustrated by the fact that, were corrections for general relativity ignored, the resulting position error would increase by about 10 km (6 miles) per day.

This summer, Professor Humphrey's group was invited on board the White Rose, a US$80M, 213-foot (65-meter) superyacht, to attempt to capture control of the large ship via GPS spoofing. Having previously captured a GPS-guided unmanned aerial vehicle (UAV), Humphreys and his group are continuing their mission to show that GPS spoofing is dangerous to all GPS-directed modes of transportation.

A GPS spoofing attack works by diverting the attention of a GPS receiver so it locks onto a fraudulent GPS signal that appears to have been received from the GPS satellites. This is accomplished by constructing the fraudulent signal, and slowly increasing the power of its transmission. When the spoofing signal is stronger than the real signal for one or more of the GPS satellites, the receiver only detects and reads the stronger signal.

The distance from three satellites determines the location of a point on Earth's surface (Image: B. Dodson)
The distance from three satellites determines the location of a point on Earth's surface (Image: B. Dodson)

As illustrated above, a GPS receiver determines its location by measuring the distance from three satellites in orbit around the Earth (four are needed for determination of a unique location, but drawing this would obscure the figure). The receiver is located 12,000 km (7,456 miles) from satellite 1, 10,000 km (6,214 miles) from satellite 2, and 13,000 km (8,078 miles) from satellite 3. The blue ring is the locus of points which are the correct distances from satellites 1 and 2. The green circle is the Earth's surface, and the intersection of the locus of points 13,000 km from satellite 3 and the blue ring identifies a maximum of two points, one of which must be the location of the GPS receiver. Including distance from a fourth satellite removes this dichotomy, and also makes the calculated location more robust against noise.

A spoofing signal contains information consistent with the real signal from one of the GPS satellites, but alters the apparent distance between that satellite and the receiver. As a result, the 3D quadrangulation process used to determine the location of the receiver will give the wrong answer and that answer will be wrong in a predictable manner. In other words, the apparent location and course of a GPS-guided vehicle can be changed nearly at will with rather simple equipment.

A GPS spoofing attack begins by broadcasting a slightly more powerful signal that initially agrees with the correct position of the GPS receiver, and then slowly alters the apparent position of the vehicle. The spoofer's adjustments must be sufficiently slow that the receiver does not lose signal lock – it must lock onto the spoofing signal without noticing the signal is different.

“With 90 percent of the world’s freight moving across the seas and a great deal of the world’s human transportation going across the skies, we have to gain a better understanding of the broader implications of GPS spoofing,” Humphreys said. “I didn't know, until we performed this experiment, just how possible it is to spoof a marine vessel and how difficult it is to detect this attack.”

Jahshan Bhatti operates the spoofing hardware aboard the White Rose (Photo: UTexas at Austin)
Jahshan Bhatti operates the spoofing hardware aboard the White Rose (Photo: UTexas at Austin)

At a point some 30 miles (48 km) off the coast of Italy, graduate students Jahshan Bhatti and Ken Pesyna began to send a faint set of GPS spoofing signals from their briefcase-sized transmitting device on the upper deck of the yacht. As they increased the strength of their signals, the ship's GPS location system eventually was thoroughly spoofed – paying attention only to the UTexas team's spoofing signals.

At this point, the indicated course of the yacht was altered by a few degrees, although the ship had not actually turned. The spoofed GPS then reported a difference between the ship's location and the desired course, and altered course to return to the correct course. Of course, in doing so it took on a course that same few degrees different from the proper course. By continuing to maintain this discrepancy, the yacht showed in its wake that the ship was turning, even though the electronic chart of the navigational system showed the ship was on a steady course. This is shown in the form of an animation in the video below.

“The ship actually turned and we could all feel it, but the chart display and the crew saw only a straight line,” Humphreys says. “This experiment is applicable to other semi-autonomous vehicles, such as aircraft, which are now operated, in part, by autopilot systems. We’ve got to put on our thinking caps and see what we can do to solve this threat quickly.”

Source: University of Texas at Austin

Spoofing on the High Seas

View gallery - 6 images
11 comments
11 comments
nutcase
As we all become more and more dependant on radio signals it makes sense to keep a close "eye" on them. A bit of RDF would reveal the bogus tx.
Slowburn
GPS is a great convenience but it should not be a replacement for the ability to navigate. Electronically comparing the GPS to a good inertial navigation system should be able to spot bogus GPS location quickly enough to avoid problems if you have a competent navigator.
myale
With people using autopilots and the old adage that a computer never lies that was used to be drilled into people - how many people follow satellite navigation blindly till they litterally drop off a cliff - and still say - well I was following the navigation. Always relying on the human or analgue element is a good fall back, but in the computer age is probably not the answer.
Mel Tisdale
Perhaps with ships etc. it might be possible to have some direction-finding equipment that could confirm that the signals are actually coming from where the satellites are known to be (this need not be too precise because it would be impossible for a hoaxer to transmit a signal from anywhere remotely close to the proper location of the satellite.
I cannot see this working on cars as I imagine the direction-finding equipment would be quite large.
Nathaneal Blemings
"The spoofed GPS then reported a difference between the ship's location and the desired course, and altered course to return to the correct course."
Seems to me this is where you would build/program something to relise when your being spoofed, im not sure all the ways that this would happen normaly, where your driving in a straight line, and then suddenly your pointing somewhere else without having turned at all. I mean you should be able to build hardware that monitors the actual steering and if the boat turns when it hasnt been steered then your possible being gps spoofed.
Of course i guess its possible that weather/high wind could blow you off course. they should invent something, that only works at night, that scans the night sky for stars to align to so they could get an exact position. I wonder if there is a way to do this during the day to, i mean we have telescopes that can observe stars during the day using different radiation then the visible spectrum, i think.
Ron Stidmon
Seems like inertial, compass, and radio beacon data could be integrated with GPS so that anomalies could be reconciled by humans and/or heuristics.
Theveni
Seems like a cross check between the propulsion system and the GPS would therefore indicate the error--the ship says it's turning, but the GPS says no. Who wins?
If landmarks are available (tough at sea, but stars at night could be a fall-back), the advertised GPS position and heading could be loaded into a digital map or star chart and compared. Any difference, who wins?
Great work. I'll have to check to make sure that this is corrected before I buy my Google Autopilot Car.
Of course, deviation of just a few degrees might go unnoticed, sufficient to drive your yacht into the jaws of a secret interceptor! (http://jamesbond.wikia.com/wiki/Liparus)
Mirror16
"GPS is a great convenience but it should not be a replacement for the ability to navigate".
The ability to navigate using what? Even the old radio direction finding is easily hacked. Or do you mean manually with chronometers, sextants, astronomical observations and tables? Good luck with that!
MQ
Probably the magnetic compass is the least easily spoofed device (at least not easily spoofed from a remote location (a (mechanical, or laser ring) gyrocompass must be periodically reconciled to a magnetic one, as the gyro suffers drift due to the earth moving through space (MEMS and laser ring gyros, suffer additional drift due to random processes at the smaller scales)
For a given location, and a given vector, there will only be a single magnetic course which is correct, IF there is no ocean current or prevailing wind (then the compass direction will vary according to the combination of all factors.) So it may not be so easy in nonideal conditions to tell if one was being spoofed just by looking at the other instruments.
Probably the best way to check would be if the spoofing signal correlated perfectly to the GPS almanac (direction finding would be a little more cumbersome), though I would think that the spoofers would be smart enough to include a random dither in their time signal to replicate transmission through the ionosphere (just run a ionospheric delay model).
This experiment could be inherently dangerous, if the experimental spoofing signal were received by other craft (surface or airborne) in the vicinity of the cooperating vessel..
I think that for civilian operations, navigation aids must be taken on trust, given that there are many movements of surface and air craft daily which rely on such signals. In the future, possibly anyone wanting a more spoof proof signal will have to subscribe to a secure encrypted provider, for all navigation aids, and thereby have greater confidence that the signal they are receiving is valid.... But then what happens when the provider gets hacked....
This sort of attack is little different to the lights used by ship-wreckers back in the day, just a little more technologically advanced. Who would have thought that the US defence forces would have been unprepared for this back when Iran downed the Sentinel. (then who would have thought that they weren't encrypting all of their comm's traffic.
Capt'n Squid
I wouldn't be too concerned about interrupting ship navigation. Any experienced captain maneuvering in a critical situation will use multiple sources of information. But, think of all the other systems world wide that rely on the GPS clock. International finance being the first that comes to mind.
Load More