Commercial Flights Are Experiencing 'Unthinkable' GPS Attacks and Nobody Knows What to Do

https://lemmy.world/post/8651764

Commercial Flights Are Experiencing 'Unthinkable' GPS Attacks and Nobody Knows What to Do - Lemmy.World

Commercial Flights Are Experiencing ‘Unthinkable’ GPS Attacks and Nobody Knows What to Do::New “spoofing” attacks resulting in total navigation failure have been occurring above the Middle East for months, which is “highly significant” for airline safety.

TL:DR: Israel is the source of the spoofing.
And Iran, according to the article
Lemmy is starting to feel like Discord with people dropping lazy images like this in every damn thread.
Literally couldn’t even bother to edit the image so the country names are in the image.
Wow. The state of Israel is really piling on the reasons to hate it these days.

It was doing this for decades but Western countries only start hearing about it.

Social media have prevailed over classic media, and this time they have proven to be harder to steer.

The article says the spoofing was first recorded in September from Iran, then Israel started doing some after the October Hammas attacks

Iran has been doing this shit for decades. I’m sure Israel has too.

Basically, they figure out what a GPS receiver would hear if it was receiving signals from a specific location, say “London”. They then broadcast those exact signals. Any receiver that hears them now thinks it is in “London”.

Update the spoofed location based on the aircraft’s actual position and its intended destination, and you can get it to go where you want it.

If the aircraft is trying to fly to London, for example, and you want it to turn to the east of its track, you start spoofing a location west of London. The aircraft thinks it is west of London, and turns to the east to get to spoofed-London.

Exclusive: Iran hijacked US drone, says Iranian engineer

In an exclusive interview, an engineer working to unlock the secrets of the captured RQ-170 Sentinel says they exploited a known vulnerability and tricked the US drone into landing in Iran.

The Christian Science Monitor
And Russia was doing it just a few years ago, too.
That just means you can’t use autoland in low visibility conditions. Modern IRUs (inertial reference unit) are highly accurate laser gyros that can use GPS for correction, but will throw out the data if it doesn’t make sense. Navigation won’t be affected much, and autoland (if used) will still rely on VHF guidance.
Modern IRUs also take input from multiple sources (GPS, Navaids) to update their drift error. With spoofed GPS, bad drift corrections are made and when the navigation solution eventually fails the IRU is just as unusable.

ADIRUs will throw out bad GPS data if it disagrees with multiple IRUs, hence why there’s usually 3 on the aircraft.

If they’re using the older IRUs, the drift is corrected via redundancy and not GPS. Usually pilots will report drift based on their final IRU coordinates compared against GPS. Even then, they should still be checking their course with VOR.

Anyone with the ability to jam GPS can easily spoof VOR signals.
But in this case, they’re not. Plus, the crew are going to be the ones determining if their VOR/DME makes sense or not.
We don’t know that they aren’t spoofing VOR/DME as well. We might be seeing reports from affected aircraft, rather than specific targets.
But the article mentioned that “the spoofing corrupts the Inertial Reference System”. How?
Yeah I have the same question. Based upon a comment above, it looks like the independent gyro system is updated for drift based upon the spoofed GPS data and thus causes issues. If the IRS is not updated at all then drift becomes a bigger issue but if it’s updated regularly with valid GPS data then it’s a good thing. So the challenge is to only update the gyro drift with valid GPS data which I am guessing is hard to determine.

Pretty much this, look up Kalman filters if you want details. The most likely explanation is that they are tuned to effectively trust GPS more than the internal IMU for long periods of time. Really good IMUs are very expensive and still drift but have high speed output. When it works well, GPS is cheap and doesn’t drift but with a slow update rate. The cost optimisation probably means that the IMU data is usually only trusted for a few seconds, probably 10 min at most before it takes whatever the GPS says as truth. If they lost gps signal through jamming, then they would keep navigation on the less certain IMU data, but the GPS sensor thinks all is well so they shift position.

There is probably a software upgrade to the filter that could be used to limit these attacks, but I imagine it’s an active area or research.

If it’s a smaller plane (such as a CRJ / ERJ) with only one IRU, it will not be able to determine if GPS is valid or not, so the drift correction gets spoiled.

Large commercial aircraft are using 3 IRUs, with newer aircraft using ADIRUs. If GPS does not agree with the three IRUs, the GPS data is thrown out. If the GPS is within tolerance, correction is applied. You could build up very small errors over a long distance, but you should still be pretty close to the airfield when you get there.

ILS has nothing to do with gps…
Well the article says it caused at least one plane to almost fly into Iran’s restricted airspace…

Ignore my ignorance. Are you saying the aircrafts track where they are going by calculating their position from gyroscope data? And this is more precise than GPS?

That’s like using the accelaration sensors in your phone to navigate. Or sailing with compass and nautical maps.

Possible. Tech isn’t even that novel. But still impressive.

Yes. Most of commercial navigation systems rely on the IRUs as a primary source of position data, and they’ll usually have 3 of them. VHF is used by the crew to confirm that the aircraft is on track by referencing VOR stations, though these are slowly being phased out due to GPS.

That being said, a single traditional IRU can have up to 2km of drift over a 2 hr flight (at which point it’s removed from service and replaced). When used in combination with two other IRUs, the error is dramatically reduced. Traditional IRUs are gyroscopically mechanical in nature and do not talk to GPS.

Now, that being said, the new standard is called an ADIRU (ADvanced IRU), which ties in with GPS and features laser gyros. They’re extremely accurate and have essentially zero drift, plus multiple redundant components within each unit.

The missile knows where it is by knowing where it is not.
boosting the stereotype

This sounds rather dangerous. GPS was originally opened up to civilian use for the purpose of keeping flights on course, after the disaster of Korean Air Flight 007 straying into Soviet airspace and being shot down back in the 1980s.

I can’t understand what is to be gained by deliberately trying to knock civilian airliners off course.

GPS guided drone attacks
Are you meaning 300 measurements per second? Because civilian gps has an accuracy of ~3 meters. I may be misunderstanding though

The GPS chips have internal limits on how fast they think they can move. If they determine that they are moving faster than 300m/s they will stop outputting any results for a period of time. This limit is, IIRC, put in at the silicon level, so only military chips can bypass it.

If you try to use mapping apps on a plane you sometimes run into this issue.

But even the fastest airliners at the moment (A330 neo) moves slower than 300m/s. Wikipedia claims that COCOM limits are even higher so I don’t think that they are the reason for the inaccurate tracking on planes.
There’s also a height limit
Maybe a misapplication then. I’ve run into it with model rocketry before (for good reason)
Turns out it’s 1000 knots (~600m/s), or 18,000 feet. So it’s the altitude in this case. But a slow-moving drone at <18,000ft is fine.
It is trivial to make your GPS receiver firmware ignore these limits. There are even open-source receivers (SwiftNav piksi, for example). Modifying a binary is much harder, but not impossible for a motivated state like Iran or Russia. It’s best to think of the COCOM limits as suggestions.
Oh, neat. I was not aware of that. I have seen that before but thought it was due to the phone not being able to lock on to the signal from inside a big metal tube.
Would that be relevant for a drone attack? I wouldn’t think a drone that isn’t operated by a state actor is likely to be moving that fast, and presumably a state actor could build their own chips without a limiter?
Thus the point of the spoofing. A drone will be moving much slower than 300 m/s, so spoofing GPS would be an attempt to force it off-course.
Ah, I see, I misunderstood what you meant
Holy shit, that really happened? Just finished watching “For All Mankind” and recognized some events, but had no idea this one was real.

I can’t understand what is to be gained by deliberately trying to knock civilian airliners off course.

You don’t deal with terrorists, do you?

Nobody knows what to do?

How they did between 1890 and 1980? Maybe with paper maps and their eyes? It needs investigating!

I don’t know from 1903 to 1980 but from 1890 to 1903 they did not fly at all. The first “modern” flight happened in December 1903.

The planes first received spoofed GPS signals, meaning signals designed to fool planes’ systems into thinking they are flying miles away from their real location. One of the aircraft almost flew into Iranian airspace without permission

Tomorrow Never Dies continues to be bizarrely relevant.

Is that the one with Jonathan Pryce as the villain? That was a good one
Johnathan Pryce as the mad, egocentric head of a mass media and tech empire that with an inordinate amount of reach and influence on the world stage.
I’m not nervous, you’re nervous
That was a badass videogame on PS1. Core memory unlocked
Do none of the systems, GPS, glonass etc. use encryption or authentication of any form?
Nope. And more importantly, it looks like nobody considered what might happen if the signal gets spoofed. The backup systems that are supposed to keep working if GPS breaks also break due to these spoofed signals.
GPS is encrypted, it’s just that the US military won’t share the encryption keys so the rest of us have to use the unencrypted channels. They’ve clearly thought about it and decided against making it public.

GPS is old, the amount of data you get from the satellite is small, essentially satellite id and timestamp. If we would redesign this today, you could include a digital signature.

Sure, but… you can google this to verify … one can probably manipulate GPS by introducing delay, i.e. resend data from a sat that was hear some seconds ago. With this signal the location will be off.

But that would also mean the timestamp to be off. Just resending them would also require extremely precise timing if you want to simulate a position that is not anywhere but just a bit off the last position. Making a GPS position jumping around half the world is (comparably) easy, pushing it off for a few kilometers is much, much harder.

Yes Galileo supports encryption. But as far as I know it’s not in use. Has been trialled only. But I know all Airbus aircraft only support GPS satellites and nothing else (yet). I assume Boeing, being American would be the same then.

As far as solutions go, an aircraft can navigate fine without GPS. It can update its position from ground navigation aids and if they are not available it can still Dead Reckon very well. The navigation error very slowly grows until it’s out of the black spot and can use GPS or navigation aid to increase its accuracy. But this navigation error on the time frame of say an hour is a matter of kilometers at most, not dozens.

We need a backup for GPS. LORAN should never have been shut down.
I can’t see how omega and similar were not just as susceptible to this type of attack. Active outside in tracking almost always has this vulnerability.
There are 3 of them. Galileo, Glonass and Beidou

Easy solution: homing rockets that seek out the strongest signal using that band. Whitelist the sources that are official and proper.

GPS is passive so the rockets won’t go for the plane… it’ll go for the transmission tower.

Use less destructive devices if you’d rather risk sending humans to do the job.