GPS Spoofing Attack Hacks Drones 214
Rambo Tribble writes "The BBC is reporting that researchers from the University of Texas at Austin managed to hack an experimental drone by spoofing GPS signals. Theoretically, this would allow the hackers to direct the drone to coordinates of their choosing. 'The spoofed drone used an unencrypted GPS signal, which is normally used by civilian planes, says Noel Sharkey, co-founder of the International Committee for Robot Arms Control. "It's easy to spoof an unencrypted drone. Anybody technically skilled could do this - it would cost them some £700 for the equipment and that's it," he told BBC News. "It's very dangerous - if a drone is being directed somewhere using its GPS, [a spoofer] can make it think it's somewhere else and make it crash into a building, or crash somewhere else, or just steal it and fill it with explosives and direct somewhere. But the big worry is — it also means that it wouldn't be too hard for [a very skilled person] to work out how to un-encrypt military drones and spoof them, and that could be extremely dangerous because they could turn them on the wrong people."
Surprised? (Score:5, Informative)
"the big worry" described above (Score:5, Informative)
isn't that exactly how Iran caught that US drone a few months ago?
google...
tada:
http://news.slashdot.org/story/11/12/15/2013249/us-sentinel-drone-fooled-into-landing-with-gps-spoofing [slashdot.org]
Re:Surprised? (Score:4, Informative)
Military drones, and other aircraft that use GPS for navigation use some form of GPS-enhanced INS, rather than just GPS. 'Hacking' a drone that only uses civillian GPS (ie. unencrypted signals) is probably no harder than 'hacking' an open WiFi - or even one with WEP. You just need the right equipment and software.
Hacking an aircraft using the encrypted military signal and GPS-enhanced INS is a different game altogether. It is very unlikely that Iran could have done this; a spurious GPS signal will be rejected and the aircraft will simply fly with un-corrected INS until such as time as the GPS signal is determined to be reliable again.
Also note that this has been successfuly demonstrated by GPS-guided bombs. Iraqis attempted to jam or spoof the GPS signals, but the onboard INS guided the bombs to target.
A paper on this from 2002 (Score:2, Informative)
Here's a paper [anl.gov] on this from 2002.
All they did was purchase a commercial GPS simulator, which is used by companies to develop their GPS receivers and is easily attainable. They just connect an antenna to the simulator and beam it at the direction of a GPS receiver, jam the receiver so it loses current lock, and then it'll be spoofed once it locks onto your antenna. I always thought you needed to do some super complicated math and use multiple sources since GPS relies on careful timing information to get position, but the commercial simulator handles it all for you.
Re:Surprised? (Score:5, Informative)
Link [wired.com]
Quick summary: Security on the drones has a history of bad decisions, such as unencrypted video feeds and malware. Breaking GPS encryption would be almost impossible, but it's quite possible that the drones were programmed to use unencrypted GPS as a fallback if encrypted GPS was lost, so if Iran jammed only the encrypted GPS signal, the plane would rely on spoofed unencrypted GPS. The short answer: it would have been tough, and we don't know whether they really did it or not, but it's not as impossible as people are making it out to be.