GPS Spoofing.

[Mooneymite]

Next time you do an LPV to minimums, think about this:

from AIN

GPS Jamming and Spoofing On the Rise

GPS jamming and interference events are growing exponentially as aircraft systems are becoming increasingly reliant upon them for primary navigation. During the last three years, Spirent Communications, a company that tests navigation equipment, has captured 150,000 different jamming and interference events. “Global navigation satellite system [GNSS] jamming essentially is as hard as it is to get your credit card out. You can go out and get a piece of jamming equipment rather easily. Yes, it is illegal, but if you are jamming GNSS you probably don't care,” said Jeremy Bennington, Spirent corporate solutions and technical strategy lead. He added that the risk to aviation safety is real and tangible. “Since 2013 the FAA Aviation Safety Information Analysis and Sharing System has recorded more than 100 instances of pilot reports of GPS systems being jammed. But we know it was far more than that.” According to Bennington, the “Pokemon Go” augmented reality app released in 2016 encouraged hackers to spoof GPS to win prizes and put code online. “The spoofing they were doing was largely on cellphones, but you take that same code and software-defined radio and put that together along with position and timing data and you can make a fairly sophisticated GPS or GNSS spoofing device,” he said. “We've seen a huge increase in GNSS-related spoofing incidents in part because of Pokemon Go." Read Expanded Version

[Piloto]

GPS spoofing or jamming has no major impact on the aircraft en-route navigation since most aircraft have secondary systems. Where the impact is major is on ATC systems relying on ADS-B transponder GPS position reports. An ATC systems relying on ADS-B spoofed GPS position reports that could be totally different than what the pilot visually asses could create a conflicting situation, specially at night. The pilot can always asses his position by secondary nav sources or visually. But an ATC controller relying only on ADS-B has only GPS.

José 

[Marauder]

GPS spoofing or jamming has no major impact on the aircraft en-route navigation since most aircraft have secondary systems. Where the impact is major is on ATC systems relying on ADS-B transponder GPS position reports. An ATC systems relying on ADS-B spoofed GPS position reports that could be totally different than what the pilot visually asses could create a conflicting situation, specially at night. The pilot can always asses his position by secondary nav sources or visually. But an ATC controller relying only on ADS-B has only GPS.
José 

That may be true of planes using inertial nav but what about a GA plane using GPS and is in the clouds on a direct to route? I am not always running the VORs in the background to verify my position.

I did have one GPS LOI issue that really bothered me. I was on the RNAV to runway 8 at KLNS when I got the LOI message. It wasn’t a degraded RNAV message (LPV to LNAV), it was a pure you’re SOL message. Fortunately I was running the ILS on the second Aspen as a backup.


Sent from my iPad using Tapatalk Pro

[Mooneymite]

45 minutes ago, Piloto said:

GPS spoofing or jamming has no major impact on the aircraft en-route navigation since most aircraft have secondary systems.

While our GA navigators generally have a "drift mode" to cover short periods of gps interruption, as @Marauder points out, we really don't have a backup.  Think about loss of gps inside the FAF...how ya gonna do the missed approach?  

[Piloto]

Unlike ATC that rely only on ADS-B GPS, GA planes have windows, VOR/ILS, DME and ADF. Any good IFR pilot should always check with secondary navs, not only because of spoofing but because your GPS may not be working properly or has the wrong airport entered. Flying in the vicinity of TV towers can cause GPS interference. 

José

[Mooneymite]

1 hour ago, Piloto said:

Unlike ATC that rely only on ADS-B GPS, GA planes have windows, VOR/ILS, DME and ADF. Any good IFR pilot should always check with secondary navs, not only because of spoofing but because your GPS may not be working properly or has the wrong airport entered. Flying in the vicinity of TV towers can cause GPS interference. 

José

Backups with VOR, etc. are problematical for missed approaches at the ever-increasing number of airports that have only GPS approaches. 

[aviatoreb]

If someone wanted to - can't a VOR be spoofed as well?

[thinwing]

I read an article where the FCC was proposing a 32k fine to a truck driver operating a jammer.His story ,was his boss kept tabs on his trucks position via GPS tracker on the truck.He had a girl friend close to Newark airport so he bought a 100 mw jammer to hide his truck during visits.That 100 mw jammer being hundreds of times stronger than a satellite signal knocked out the instrument approach to Newark...they finally tracked his signal down and arrested him.

[jaylw314]

I imagine that an illegal transmitter would set off the redundancy checks in any GPS receiver.  You might not be able to do the approach with bad data, but you would be "jammed," not "spoofed" into flying into the ground a la "Die Hard 2".  If you are doing an LPV to minimums and no alarms go off, then you should be good.

Radio navigation aids, though could be spoofed if you had enough power since they have no internal redundancy checks.

[EricJ]

1 hour ago, aviatoreb said:

If someone wanted to - can't a VOR be spoofed as well?

Yes.   

2 minutes ago, jaylw314 said:

I imagine that an illegal transmitter would set off the redundancy checks in any GPS receiver.  You might not be able to do the approach with bad data, but you would be "jammed," not "spoofed" into flying into the ground a la "Die Hard 2".  If you are doing an LPV to minimums and no alarms go off, then you should be good.

Radio navigation aids, though could be spoofed if you had enough power since they have no internal redundancy checks.

Jamming and spoofing are two different things.   Jamming just interferes with a signal enough that it can no longer be reliably received.   This can be done with a noise generator (e.g., a diode), and a power amplifier in the appropriate band, and would be detectable in both GPS and VOR systems.  Jamming is basically a Denial of Service attack.   Spoofing replaces the desired signal with another signal that provides misdirection.   My favorite example of GPS spoofing was this:

https://en.wikipedia.org/wiki/Iran–U.S._RQ-170_incident

https://theaviationist.com/2016/10/02/iran-unveils-new-ucav-modeled-on-captured-u-s-rq-170-stealth-drone/

Any entity with a capable satellite or, even easier, a high-flying aircraft, can generate a spoofed GPS stream and broadcast it to receivers below.   It is very possible that your receiver might not detect or indicate LOI, since a sufficiently spoofed signal will appear authentic.

I think having a secondary nav system is critical.   Over-reliance on GPS is, imho, a Bad Idea for a number of reasons beyond jamming and spoofing susceptibility.

[aviatoreb]

1 hour ago, EricJ said:

Yes.   

Jamming and spoofing are two different things.   Jamming just interferes with a signal enough that it can no longer be reliably received.   This can be done with a noise generator (e.g., a diode), and a power amplifier in the appropriate band, and would be detectable in both GPS and VOR systems.  Jamming is basically a Denial of Service attack.   Spoofing replaces the desired signal with another signal that provides misdirection.   My favorite example of GPS spoofing was this:

https://en.wikipedia.org/wiki/Iran–U.S._RQ-170_incident

https://theaviationist.com/2016/10/02/iran-unveils-new-ucav-modeled-on-captured-u-s-rq-170-stealth-drone/

Any entity with a capable satellite or, even easier, a high-flying aircraft, can generate a spoofed GPS stream and broadcast it to receivers below.   It is very possible that your receiver might not detect or indicate LOI, since a sufficiently spoofed signal will appear authentic.

I think having a secondary nav system is critical.   Over-reliance on GPS is, imho, a Bad Idea for a number of reasons beyond jamming and spoofing susceptibility.

I agree.

Hey you big heavy iron drivers - is inertial guidance a thing?  I know its used in submarines.  But the large scale inertial guidance is very heavy.  How far are we to accurate inertial guidance etched in to MEMs devices?  If that could attain the accuracy - that would be a superb backup.

[Mooneymite]

Ring laser gyros and accelerometers will fit in a very small space. The computational power of a cheap cell phone would be overkill to drive the whole thing. 

I suspect the reason we don’t all have IRUs is because WAAS GPS receivers are even cheaper. 

However...if this jamming/spoofing starts rearing it’s ugly head, we may all be equipping our planes with IRUs. 

[Piloto]

eLoran is another option to GPS. Unlike weak signals from the GPS satellites eLoran signals from the ground are strong and harder to jam or spoof. At 100KHz operating frequency the jammer would need a 200ft tower and a 1 KW transmitter. eLoran does not provide altitude for approaches but is good enough for LNAV approaches. Wish the Federal Government would put it back. eLoran/GPS navigators would provide a high integrity navigation solution.

http://www.ursanav.com/solutions/technology/eloran/

José

[EricJ]

4 hours ago, aviatoreb said:

I agree.

Hey you big heavy iron drivers - is inertial guidance a thing?  I know its used in submarines.  But the large scale inertial guidance is very heavy.  How far are we to accurate inertial guidance etched in to MEMs devices?  If that could attain the accuracy - that would be a superb backup.

Yup, cheap MEMs devices are what drive many AHRS and IMU/IRU thingies these days.   Here's a good 9-degree-of-freedom joint 3-axis gyro and 3-axis IMU that retails for $15.   This is basically the same type of AHRS that will plug into a Stratux so you can use your tablet or cell phone as an AI/DG.

https://www.adafruit.com/product/3463

Eons ago when gps was new and IMU guidance was the go-to technology for non-jammable accurate guidance, the thought was that the gps would be used to provide periodic alignment updates to the IMU, since the IMU was the more precise device as long as drift could be corrected.   That was the old school way of doing things, so reverting to IMU guidance if gps fails would essentially be a reversion to those techniques.

 

[aviatoreb]

Just now, EricJ said:

Yup, cheap MEMs devices are what drive many AHRS and IMU/IRU thingies these days.   Here's a good 9-degree-of-freedom joint 3-axis gyro and 3-axis IMU that retails for $15.   This is basically the same type of AHRS that will plug into a Stratux so you can use your tablet or cell phone as an AI/DG.

https://www.adafruit.com/product/3463

Eons ago when gps was new and IMU guidance was the go-to technology for non-jammable accurate guidance, the thought was that the gps would be used to provide periodic alignment updates to the IMU, since the IMU was the more precise device as long as drift could be corrected.   That was the old school way of doing things, so reverting to IMU guidance if gps fails would essentially be a reversion to those techniques.

 

Right - but is the accuracy there for the more demanding task of inertial guidance?

[EricJ]

7 minutes ago, aviatoreb said:

Right - but is the accuracy there for the more demanding task of inertial guidance?

There've been tons of papers on the topic and comparisons with Fiber Optic Gyroscopes and Ring Laser Gyros over the last ten years or so, and lots of vendors of MEM-based systems for various applications.   I don't know what implementations are favored for different application requirements, but it seems like the ability to have some INS guidance for a while after a gps failure may be within reach for GA performance-wise.   Getting standards accepted and equipment certified is probably the much bigger hurdle.   Reading the product lit and manuals for things like G5s leads me to believe that some of this may be going on already, but mostly for filtering (sensor fusion) rather than for backup.

This article is five years old:

http://www.analog.com/en/technical-articles/the-battle-between-mems-and-fogs-for-precision-guidance.html

Would be cool to get some detail from folks in the nav computing trenches.

 

[jaylw314]

19 hours ago, EricJ said:

Yes.   

Jamming and spoofing are two different things.   Jamming just interferes with a signal enough that it can no longer be reliably received.   This can be done with a noise generator (e.g., a diode), and a power amplifier in the appropriate band, and would be detectable in both GPS and VOR systems.  Jamming is basically a Denial of Service attack.   Spoofing replaces the desired signal with another signal that provides misdirection.   My favorite example of GPS spoofing was this:

https://en.wikipedia.org/wiki/Iran–U.S._RQ-170_incident

https://theaviationist.com/2016/10/02/iran-unveils-new-ucav-modeled-on-captured-u-s-rq-170-stealth-drone/

Any entity with a capable satellite or, even easier, a high-flying aircraft, can generate a spoofed GPS stream and broadcast it to receivers below.   It is very possible that your receiver might not detect or indicate LOI, since a sufficiently spoofed signal will appear authentic.

I think having a secondary nav system is critical.   Over-reliance on GPS is, imho, a Bad Idea for a number of reasons beyond jamming and spoofing susceptibility.

It's hard to imagine an individual miscreant could reliably spoof GPS since there are multiple satellites to cross-check against.  You'd have to somehow jam all the visible satellites, and then supply 3+ false GPS signals in the face of all that jamming, right?

Also, the Wikipedia article points out there is controversy about how the RQ-170 was brought down, with some asserting INS (not GPS) is not the primary navigation system.

[jaylw314]

12 hours ago, EricJ said:

There've been tons of papers on the topic and comparisons with Fiber Optic Gyroscopes and Ring Laser Gyros over the last ten years or so, and lots of vendors of MEM-based systems for various applications.   I don't know what implementations are favored for different application requirements, but it seems like the ability to have some INS guidance for a while after a gps failure may be within reach for GA performance-wise.   Getting standards accepted and equipment certified is probably the much bigger hurdle.   Reading the product lit and manuals for things like G5s leads me to believe that some of this may be going on already, but mostly for filtering (sensor fusion) rather than for backup.

This article is five years old:

http://www.analog.com/en/technical-articles/the-battle-between-mems-and-fogs-for-precision-guidance.html

Would be cool to get some detail from folks in the nav computing trenches.

 

There are PFD's for experimentals that have been doing pseudo-INS for a while with MEMS-based AHRS as an automatic temporary backup for GPS.  What is not clear is how long this is feasible or safe for.  I'm guessing only minutes.

http://grtavionics.com/home/efis-systems/

 

[aviatoreb]

13 minutes ago, jaylw314 said:

There are PFD's for experimentals that have been doing pseudo-INS for a while with MEMS-based AHRS as an automatic temporary backup for GPS.  What is not clear is how long this is feasible or safe for.  I'm guessing only minutes.

http://grtavionics.com/home/efis-systems/

 

Exactly.  For a usable viable INS system it comes down to the accuracy of the sensors.  Depending on the accuracy are we talking usable results that are sufficiently accurate for seconds?  minutes?  Hours?  The longer into the future requires tighter error bars at each instant.

I don't know the details of what's already installed but I would doubt that the already installed stuff whos purpose is AHARS is sufficient for INS for hours.

[EricJ]

2 hours ago, aviatoreb said:

Exactly.  For a usable viable INS system it comes down to the accuracy of the sensors.  Depending on the accuracy are we talking usable results that are sufficiently accurate for seconds?  minutes?  Hours?  The longer into the future requires tighter error bars at each instant.

I don't know the details of what's already installed but I would doubt that the already installed stuff whos purpose is AHARS is sufficient for INS for hours.

I'm curious whether the typical low-cost modern MEMS units are even good enough to get yourself down to a circling approach or something like that within an hour or so once you've gotten notice that the rnav has failed.   I suspect some might be, but I don't know.   

[N601RX]

Here is the software you need to spoof a gps.  In addition you will need to download labview. Both are offered as a free trial. Then you will need either an Ettus or NI USRP for the hardware.  We have played with it at work and it works well, in a RF chamber of course. 

http://sine.ni.com/nips/cds/view/p/lang/en/nid/204980

 

http://www.ni.com/en-us/shop/select/usrp-software-defined-radio-device?storeId=10201&userLocale=en-US&requestLanguage=en&localeGroup=en-us&requestLangId=-1&langId=-1

https://www.ettus.com/

Edited May 24, 2018 by N601RX

[jaylw314]

4 hours ago, N601RX said:

Here is the software you need to spoof a gps.  In addition you will need to download labview. Both are offered as a free trial. Then you will need either an Ettus or NI USRP for the hardware.  We have played with it at work and it works well, in a RF chamber of course. 

http://sine.ni.com/nips/cds/view/p/lang/en/nid/204980

 

http://www.ni.com/en-us/shop/select/usrp-software-defined-radio-device?storeId=10201&userLocale=en-US&requestLanguage=en&localeGroup=en-us&requestLangId=-1&langId=-1

https://www.ettus.com/

"Spoofing" in an RF chamber does not mean it works in real life.

This was from http://gpsworld.com/defensesecurity-surveillanceassessing-spoofing-threat-3171/:

"The menace posed by such an attack is diminished by the fact that it is likely easy to detect, because of the difficulty of synchronizing a simulator’s output with the GPS signals in its vicinity. An unsynchronized attack effectively acts like signal jamming, and may cause the victim receiver to lose lock and have to undergo a partial or complete reacquisition. Such a forced re-acquisition would raise suspicion of a spoofing attack. If the unsynchronized attack somehow avoids causing loss-of-lock, it will nonetheless cause an abrupt change in the victim receiver’s GPS time estimate. The victim receiver could flag jumps of more than 100 nanoseconds as evidence of possible spoofing. The spoofer can attempt to counter this defense by intentionally jamming first and then spoofing, but an extended jamming is itself telltale evidence of interference."

My take--simply having a GPS simulator is insufficient if your goal is "spoofing" an aircraft GPS.  By broadcasting GPS signal(s) that are inconsistent with the signal received from multiple satellites, the end result would simply be RAIM/WAAS failure or obviously incorrect data on the GPS.

Most of the other more sophisticated techniques in the article require the spoofing transmitter be located in close proximity to the target receiver so that it can synchronize its data with the received real GPS data.  THAT would require that one of your passengers is a hacker with a death wish--unlikely for the type of passengers we are likely to carry in our Mooneys (I hope)!

[M016576]

10 hours ago, aviatoreb said:

Exactly.  For a usable viable INS system it comes down to the accuracy of the sensors.  Depending on the accuracy are we talking usable results that are sufficiently accurate for seconds?  minutes?  Hours?  The longer into the future requires tighter error bars at each instant.

I don't know the details of what's already installed but I would doubt that the already installed stuff whos purpose is AHARS is sufficient for INS for hours.

The 3-ring laser gyro INS’s that drive attitude and position in a modern fighter jet drift up to 1NM an hour (if not aided by gps) and are still “within spec.” More than accurate enough for area navigation... not accurate enough for a hard IMC approach.

fighters typically use an INS that is continuously updated by GPS.  The reason being that the GPS alone cannot keep up with the speed and attitudes of the maneuvers that we typically fly during a fight.... or even during bombing patterns, really.  So the INS is doing the quick calculation work (roll, yaw, pitch, position), then the inputs are updated via GPS to make sure the own ships position doesn’t go out to lunch.  I’d imagine that commercial airlines use a similar system (ins aided by gps), rather than our “pure” gps type systems we see in GA.... but I could be wrong there.

if that INS is backed up by a WAAS gps, it has the herz/verz that are only a few feet off at their worst.

 

Edited May 25, 2018 by M016576

[jetdriven]

The old school 747-200s had Litton-72 iron gyros and were good for 3T+2.  The later Litton-92 were ring laser gyros and although certified to the same standard they were more accurate. But still a ten to 20 mile circle after 12 hours.  The -400 with its ADIRU’s we’re always 0.0 after a 16 hour flight. 

Edited May 25, 2018 by jetdriven

[EricJ]

7 minutes ago, jetdriven said:

The old school 747-200s had Litton-72 iron gyros and were good for 3T+2.  The later Litton-92 were ring laser gyros and although certified to the same standard they were more accurate. But still a ten to 20 mile circle after 12 hours.  The -400 with its ADIRU’s we’re always 0.0 after a 16 hour flight. 

These days a G5 connected to a gps has all of the same basic sensors, capability, etc.   I wouldn't be surprised if the accuracy wasn't similar.   A G5 and an IFD550 (with the internal AHRS) with good sensor fusion should be pretty capable, I'd think.   I doubt the software is there now, but the hardware probably isn't all that far off.