Large SE Area GPS Jamming

[Dream to fly]

I'm going to fix this problem....  I'm tying a string to my tail so I can follow it back home 

[gsxrpilot]

I'm all for having backups, but paper charts?  No thanks. I've used them for years but have been very happy to let them go in favor of electronic charts. iPad overheating is a very easily prevented situation. And in the event of a complete brain fart and I let the iPad overheat, I have the same charts on my iPhone.

[Bob_Belville]

39 minutes ago, gsxrpilot said:

I'm all for having backups, but paper charts?  No thanks. I've used them for years but have been very happy to let them go in favor of electronic charts. iPad overheating is a very easily prevented situation. And in the event of a complete brain fart and I let the iPad overheat, I have the same charts on my iPhone.

I have 5 sets of charts on board, 4 current in GTN, GPS 696, phone and tablet, plus out of date paper though I'd have to get those from the baggage area... hope the altitude hold can keep the nose level!

[EricJ]

5 hours ago, 201er said:

Thanks for the distinction. I mean is it possible to locally broadcast a spoofed GPS signal on the same channel with a stronger signal, thereby overriding the real GPS signal?

Just to add a little bit, spoofing GPS has been done very effectively.   The Iranians have gotten pretty good at it:

https://sofrep.com/46818/gps-spoofing-how-iran-tricked-us-patrol-boats-into-capture/

https://en.wikipedia.org/wiki/Iran–U.S._RQ-170_incident

 

[Piloto]

5 hours ago, EricJ said:

Just to add a little bit, spoofing GPS has been done very effectively.   The Iranians have gotten pretty good at it:

https://sofrep.com/46818/gps-spoofing-how-iran-tricked-us-patrol-boats-into-capture/

https://en.wikipedia.org/wiki/Iran–U.S._RQ-170_incident

 

Reading both article there is no substance for the claim of spoofing. GPS airborne antennas mask signals 5 deg above the horizon so a spoofing signal from the ground would be weak and unstable. A GPS navigator can receive 12 satellite signals simultaneously if one or two are spoofed they will not converge at the position solution (lateral and vertical) of the majority so they are out of the solution. Keep in mind that this a dynamic scenario.

José

[Browncbr1]

16 hours ago, gsxrpilot said:

I'm all for having backups, but paper charts?  No thanks. I've used them for years but have been very happy to let them go in favor of electronic charts. iPad overheating is a very easily prevented situation. And in the event of a complete brain fart and I let the iPad overheat, I have the same charts on my iPhone.

I keep out of date paper chart in seat back pocket.  And when I print out paperwork that is required to be onboard in physical printed copy format like a SID/DP, on the back side of the same sheet of paper, I print the area IFR low route chart and it sits on my knee board.  It is easy and no hassle or extra space.   I always print destination and alternate approach plates as well.  It's too easy to print and put on the knee board.  Isn't a knee board meant to manage a few papers??

[N601RX]

11 hours ago, Piloto said:

Reading both article there is no substance for the claim of spoofing. GPS airborne antennas mask signals 5 deg above the horizon so a spoofing signal from the ground would be weak and unstable. A GPS navigator can receive 12 satellite signals simultaneously if one or two are spoofed they will not converge at the position solution (lateral and vertical) of the majority so they are out of the solution. Keep in mind that this a dynamic scenario.

José

Newer vector signal generators have the bandwidth to spoof the entire gps or glonass band with a single wideband transmission. National Instruments provides a toolkit for labview that takes care of all the low level stuff so the person doing it doesn't need any technical knowledge of the gps system. It will reproduce the signals from all the satellites as a composite wide band signal allowing you to control what each one does individually. You give it a starting point, speed and direction and it builds up the IQ files and streames them to the vector signal generator.  

The trial version can be downloaded free for 30 days. It works very well. I tried it out in one of our screen rooms a few years ago and could make my cell phone think it was anywhere I wanted it to be and moving at any speed and direction I wanted it to. 

[Yetti]

On 6/21/2017 at 11:10 PM, Piloto said:

The moving map will simply not work since it requires aircraft position. You will need to rely on your VOR/OBS/DME, ADF and terrain if visible at night. If your GPS navigator is SBAS (GPS/GLONASS) capable it will be  immune to certain type of interference. Unlike GPS that uses one channel for all SVs GLONASS uses multiple frequencies so it is harder to jam.

SBAS ARCHITECTURE

José

This interest me.   My $15.00 USB GLONASS capable receiver works better than the $15,000.00 panel mount GPS reciever

[Piloto]

21 minutes ago, N601RX said:

Newer vector signal generators have the bandwidth to spoof the entire gps or glonass band with a single wideband transmission. National Instruments provides a toolkit for labview that takes care of all the low level stuff so the person doing it doesn't need any technical knowledge of the gps system. It will reproduce the signals from all the satellites as a composite wide band signal allowing you to control what each one does individually. You give it a starting point, speed and direction and it builds up the IQ files and streames them to the vector signal generator.  

The trial version can be downloaded free for 30 days. It works very well. I tried it out in one of our screen rooms a few years ago and could make my cell phone think it was anywhere I wanted it to be and moving at any speed and direction I wanted it to. 

What you are describing is a constellation simulator that are used to test GPS navigators. The problem is that the GPS navigator you are trying to spoof is in constant motion and the spoofed timing signals will not correlate with the GPS onboard or even the compass. As an example the spoofed signal may show a east track of 90 deg. when the plane is actually flying a northern compass heading of 010 deg. At first the pilot may think he is getting a strong crosswind condition, but after a heading change there is no change on the spoofed track so he assume something wrong with the GPS and turn it off. One limitation of trying to spoof is that the source is a single point in space vs multiple points for the constellation so actual aircraft motion will not correlate with the spoofed signal.

José

[EricJ]

15 minutes ago, Piloto said:

What you are describing is a constellation simulator that are used to test GPS navigators. The problem is that the GPS navigator you are trying to spoof is in constant motion and the spoofed timing signals will not correlate with the GPS onboard or even the compass. As an example the spoofed signal may show a east track of 90 deg. when the plane is actually flying a northern compass heading of 010 deg. At first the pilot may think he is getting a strong crosswind condition, but after a heading change there is no change on the spoofed track so he assume something wrong with the GPS and turn it off. One limitation of trying to spoof is that the source is a single point in space vs multiple points for the constellation so actual aircraft motion will not correlate with the spoofed signal.

José

The input to the GPS system from the satellite constellation is a single antenna, so the receiver has no way to determine whether the input signal is actually from multiple satellites or an accurately reproduced signal from a single source.   The antennas aren't very directive, since they need to be able to see from nearly horizon to horizon, and it is not difficult to overcome the satellite signal level if one were intent to do so, even from the ground.  If something like a drone is using GPS to navigate, an attacker on the ground can manipulate the drone into navigating where the attacker desires.    There are a number of fairly in-depth forensic articles on what likely happened to the RQ-170 drone, and it's very practical.   The Iranians were very clever about it.   The first article I linked also cited some other spoofing demonstrations including one from the radio navigation lab at UT Austin, but it has been demonstrated many times.   The guy from UT Austin gave a TED talk on the topic.   The last third or so has to do with spoofing.   There isn't a lot of detail given, naturally, but more detail is available via searching.

 

[Piloto]

1 hour ago, EricJ said:

The input to the GPS system from the satellite constellation is a single antenna, so the receiver has no way to determine whether the input signal is actually from multiple satellites or an accurately reproduced signal from a single source.   The antennas aren't very directive, since they need to be able to see from nearly horizon to horizon, and it is not difficult to overcome the satellite signal level if one were intent to do so, even from the ground.  If something like a drone is using GPS to navigate, an attacker on the ground can manipulate the drone into navigating where the attacker desires.    There are a number of fairly in-depth forensic articles on what likely happened to the RQ-170 drone, and it's very practical.   The Iranians were very clever about it.   The first article I linked also cited some other spoofing demonstrations including one from the radio navigation lab at UT Austin, but it has been demonstrated many times.   The guy from UT Austin gave a TED talk on the topic.   The last third or so has to do with spoofing.   There isn't a lot of detail given, naturally, but more detail is available via searching.

 

Yes GPS receivers uses one non-directional antenna. But as the aircraft change heading (velocity vector) the relative timing changes of the satellite in view of the constellation change accordingly. This new relative timing is reflected as a new track on the GPS display. But when spoofing is used how the spoofer is going to know that the aircraft has changed heading so he can modify the spoofer timing. You may be able to spoof a walking person with a GPS but not an aircraft in flight. What you read about diverting drones to a specific locations was done through the command link. Furthermore how the Iranians would know the onset point of the GPS military PRN code. The best the Iranian could have done is jamming the GPS signal but not spoofing it.

José

Edited June 23, 2017 by Piloto

[Yetti]

I thought for the Iranian taking the drone they just overwhelmed the positive control with a larger signal and then hand flew it to their base. No real need to get fancy with the GPS.

[Yetti]

Kind of like when the Iraqi people figured out that US Drown camera downlink was not secured.   So they used this http://www.skygrabber.com/en/index.php

to watch the downlink off the UAV

[Piloto]

A Syrian drone old fashion GPS jammer in action create holes in the GPS receiver. Very effective. Forget about GPS jammers go the old fashion way.

https://www.bing.com/videos/search?q=Anti-Aircraft+Gun+in+Action&&view=detail&mid=CA94B00E33DC49776DCCCA94B00E33DC49776DCC&&FORM=VDRVRV

José

Edited June 23, 2017 by Piloto

[201er]

3 minutes ago, Piloto said:

A Syrian drone old fashion GPS jammer in action create holes in the GPS receiver. Very effective. Forget about GPS jammers go the old fashion way.

https://www.bing.com/videos/search?q=Anti-Aircraft+Gun+in+Action&&view=detail&mid=AB28F94F19D664F3B8CBAB28F94F19D664F3B8CB&FORM=VRDGAR

José

They yell "allah akbar" so many times that it jams and confuses the GPS receiver?

[EricJ]

1 hour ago, Piloto said:

Yes GPS receivers uses one non-directional antenna. But as the aircraft change heading (velocity vector) the relative timing changes of the satellite in view of the constellation change accordingly. This new relative timing is reflected as a new track on the GPS display. But when spoofing is used how the spoofer is going to know that the aircraft has changed heading so he can modify the spoofer timing. You may be able to spoof a walking person with a GPS but not an aircraft in flight. What you read about diverting drones to a specific locations was done through the command link. Furthermore how the Iranians would know the onset point of the GPS military PRN code. The best the Iranian could have done is jamming the GPS signal but not spoofing it.

José

All spoofing does is make the GPS indicate that it's in some position other than what it is actually in.  That can be done independently of where it is or what direction it is headed in or how fast it is going.   As a simple example, if you send it the same signal it would see if it was in Hawaii while it's in Iowa, it'll indicate that it's in Hawaii.   What the signal should look like to a receiver at any given time in any given location is a solvable problem, and that's basically what is done to spoof a receiver.   If you have an independent means to track a drone that you're attacking, say, with a radar, you can drive the GPS spoofing signal using the feedback from the tracking method to steer it, especially if you know where it was intending to go.   As I mentioned, there is a fair amount of literature out there on the topic.   It is not a new thing, it's been demonstrated and studied for some time now.

It isn't a trivial thing to do, but it is doable, and has been done.

 

[aviatoreb]

On 6/22/2017 at 2:35 PM, Dream to fly said:

I'm going to fix this problem....  I'm tying a string to my tail so I can follow it back home 

That would never work.  When you turn around your propellor will cut the string.  So I suggest bright orange string so that you can still see it once it falls the the ground.

[Piloto]

7 hours ago, EricJ said:

All spoofing does is make the GPS indicate that it's in some position other than what it is actually in.  That can be done independently of where it is or what direction it is headed in or how fast it is going.   As a simple example, if you send it the same signal it would see if it was in Hawaii while it's in Iowa, it'll indicate that it's in Hawaii.   What the signal should look like to a receiver at any given time in any given location is a solvable problem, and that's basically what is done to spoof a receiver.   If you have an independent means to track a drone that you're attacking, say, with a radar, you can drive the GPS spoofing signal using the feedback from the tracking method to steer it, especially if you know where it was intending to go.   As I mentioned, there is a fair amount of literature out there on the topic.   It is not a new thing, it's been demonstrated and studied for some time now.

It isn't a trivial thing to do, but it is doable, and has been done.

 

If you are already tracking a drone that you are attacking you maybe better off with the 40mm jammer instead of the GPS spoofer. In combat it has been found that the 40mm is more effective than the spoofer. 

40mm in action https://www.bing.com/videos/search?q=Anti-Aircraft+Gun+in+Action&&view=detail&mid=CA94B00E33DC49776DCCCA94B00E33DC49776DCC&&FORM=VDRVRV

José

[EricJ]

Just now, Piloto said:

If you are already tracking a drone that you are attacking you maybe better off with the 40mm jammer instead of the GPS spoofer. In combat it has been found that the 40mm is more effective than the spoofer. 

40mm in action https://www.bing.com/videos/search?q=Anti-Aircraft+Gun+in+Action&&view=detail&mid=CA94B00E33DC49776DCCCA94B00E33DC49776DCC&&FORM=VDRVRV

José

Makes recovering the on-board data and reverse-engineering the drone a little tougher, though.  Not as useful for propaganda, either.  

[Piloto]

Just now, EricJ said:

Makes recovering the on-board data and reverse-engineering the drone a little tougher, though.  Not as useful for propaganda, either.  

The onboard data is in a USB memory stick. Why bother with reverse engineering when you can get all type of drones on Amazon.com.

[EricJ]

Just now, Piloto said:

The onboard data is in a USB memory stick. Why bother with reverse engineering when you can get all type of drones on Amazon.com.

Can't miss out on being the only kid on the street with an RQ-170 on ebay.

[Yetti]

Heck there is a whole section of UAVs at Best buy these days.  Just charge and fly.   I still want to make a Predator Model of pretty good size and fly it around to get all the government is going to get us all people worked up.

[Piloto]

I just can't imagine when FEDEX and UPS start delivering using drones. The kids in the neighborhood armed with slingshots will have a heck of a time getting them down. I just can't wait for the news.

José

[cliffy]

To throw a little levity into this discussion-

Two of you here are talking Star Wars s*&t    Way beyond us mere dinosaur drivers

And for one prolific contributor-

      "Antennae" refers to insects and

      "Antenna" refers to airplanes

Now back to our regular program!       Smile! You're on Candid Camera" :-)

[carusoam]

Cliffy,

don't bugs start with two antennae?

If you pull one off, it only has one antenna left?

PP thinking out loud, not an entomologist (?) 

-a-