Just when you think the government is finally getting a clue about cybersecurity, along comes a few entrepreneurs to blow up your hopes with another attack vector. This time it’s your GPS.
In February 2020, then-President Donald Trump signed Executive Order 13905, “Strengthening National Resilience Through Responsible Use of Positioning, Navigation, and Timing (PNT) Services.” It directed the Department of Commerce (DOC) to identify systems, networks, and assets dependent on these services and detect any disruption and manipulation.
Since then, the National Institute of Standards and Technologies (NST) listed a series of threats to Global Navigation Satellite Systems (GNSS), the satellite constellations for PNT. Most people just think it’s for GPS apps on mobile phones, but it’s so much more. Today, GNSS is the primary source of accurate time for national critical infrastructure including financial institutions Smart Power Grid Systems, 5G technology, and Data Centers to name a few applications.
According to the report of the European GNSS Agency, more than 2.9 million GNSS time servers will be sold in the world by the end of this year. It doesn’t seem like a lot. But every unit is a source of synchronization for vital infrastructure.
A GNSS satellite transmitter in orbit at 20,000 km puts out a signal is as low as 60W. By the time it reaches Earth’s surface the signal is -155 dBW. It’s a hundred times lower than the ambient noise level. That makes it susceptible to RF interference.
Unsurprisingly, Reports of RF signal spoofing are rising dramatically. In 2017, a GPS spoofing attack placed 40 ships in the Black Sea far inland. One tanker registered a location 32 kilometers inland, at Gelendzhik Airport. Luckily, the attack came during the day and visibility was good so there were no collisions. The attack, apparently, was an experiment to see if it could be done.
Entrepreneurialism raises an ugly head
“GNSS has no authentication and is vulnerable,” said Simon Linstead, a security consultant and founder of the www.info-sec.live community. “Ten years ago, it required considerable technical skills and financial expenses. Now you can buy low-cost devices to do it on Amazon with software downloaded from GitHub. Any student can organize a spoofing attack on a bank’s processing centre in 15 minutes.”
It’s possible these products could have been at the center of the Black Sea GPS spoof. According, Patrick O’Keefe, a former NATO cybersecurity adviser in a 2020 interview. “Satellites are technically outdated, unpatched, and always connected – and still cybersecurity is not a topic for satellite manufacturers nor operators,” said Patrick O’Keefe,
Does that include the SpaceX satellite network?
“Yes. When I talk to companies building satellites I point out the security flaws of their design in both hardware and software,” he explained. “They tell me I need to talk to the cybersecurity team about the problem. When I go to the cyber team, they tell me to go talk to the satellite designers.”
GNSS spoofing has become the de facto standard of defense against drones in some countries. An anti-drone station monitors the RF and detects drone control signals. When detected, it activates the GNSS spoofer and simulates the coordinates of the nearest airport. For drones, this is a no-fly zone and the drone either lands or flies to the take-off point.
In this case, spoofing is short-term, lasting a few minutes. But this is enough to crash the synchronization system.
Coming technological answers.
This year, NIST published the final NISTIR 8323 to meet the requirements of the executive order. Specialized systems needed to fulfill the requirements are in short supply. Linstead said that out of a handful of potential providers, GPSPATRON is in the lead.
“As far as we know, the start-up has been developing a system for analysing the quality of GNSS signals and detecting spoofing for three years. They have already conducted successful pilots in Russia. Russia has state-of-the-art electronic warfare and permanently utilizes GNSS spoofing in its territory.”
GSPATRON is now looking for stakeholders to conduct pilot projects in the US.
“This is a fast-evolving market, that many governments and institutions around the world that seems to be ignored ” Linstead observed. “I can however foresee a mad panic by both government departments and corporations once regulation is clarified.”
Lou Covey is the Chief Editor for Cyber Protection Magazine. In 50 years as a journalist he covered American politics, education, religious history, women’s fashion, music, marketing technology, renewable energy, semiconductors, avionics. He is currently focused on cybersecurity and artificial intelligence. He published a book on renewable energy policy in 2020 and is writing a second one on technology aptitude. He hosts the Crucial Tech podcast.