2
$\begingroup$

While having a discussion with someone on a forum about GPS spoofing, he mentioned that GPS signal can be spoofed for a cruising missile and make it land somewhere else using side-channel attack along with cryptographic accelerator. Now, from all that I could gather about side-channel attack and cryptographic accelerators it doesn't seem possible to me. Doesn't military usable satellites have spoofing protections like the AIM+ which is an algorithm to distinguish between fake and legit signals? And I have also searched a lot about how can cryptographic accelerators be in any way used for GPS spoofing but I couldn't find anything about it?

It would be highly appreciative if someone could clear my doubt about this. Thank you!

$\endgroup$

1 Answer 1

3
$\begingroup$

Non cryptographic answer:

GPS spoofing can be done without breaking the encryption. By recording the encrypted signal and brodcasting it back with controlled delay and stronger local signal. It is the original encrypted signal and therefor decryption and verification will succeed. Deriving location is done from the difference in time delay between different satellites. If we add our own delay we can create for a target in known location any fake GPS location we choose. We start with small induced error and gradually increase.

It is theoretically possible to detect such an attack. E.g by monitoring clock jumps and falling back to other navigation systems such as INS. However such detection is heuristic and requires the victim to have a high accuracy clock and/or the attacker to be limited in the minimal delay he can induce and of course you need to have a good fallback. Plenty of military hardware does not have such anti spoofing measures.

Iran hijacked a US military drone and captured it intact. They obviously didn't share technical details but common wisdom is they jammed the control signal and spoofed the GPS signal, no evidence the encryption was broken.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.