Expert, lawmakers at odds over GPS security

Securing GPS receivers
With the door to authenticated civilian GPS effectively closed, Humphreys and other researchers are turning their attention to a grassroots campaign. There’s a laundry list of defenses--detailed in his testimony last week--that can be implemented by GPS receivers.

“The first thing engineers can do is pay attention to auto gain controls in receiver front ends that can tell you the power levels of the incoming GPS signals,” said Humphreys.

GPS signals are very weak. Hackers trying to create fake signals to control a system are most likely to use readily available GPS test systems that emit significantly more powerful signals.

An op amp responsible for auto gain control could deliver a GPS signal voltage readout to a baseband chip. The baseband could then do a relatively straightforward calculation to determine whether the signal was coming from a tester or a satellite.

The measure would not detect a more sophisticated GPS spoofer such as the units the Austin lab has developed using software radios based on Texas Instruments’ DSPs.

So far only one company supports auto gain control, but it is too coarse to detect GPS tester signals, he said.

Several other fixes could be implemented at the receiver, such as using multiple antennas. But most of them are not suitable for mobile systems because they require too much physical space.

The fixes do not appear to be on the radar screen for consumer GPS chip makers such as Broadcom and Qualcomm. “They are probably aware of it but they have taken no steps as far as I can tell,” Humphreys said.

Ostensibly, the threat to consumer gadgets such as smartphones and car navigation devices is relatively low. Hackers likely would not be motivated to get the average driver lost on the way to his hotel or weekend party.

However, a GPS hack potentially could be used to compromise other aspects of a device. For example, at the Black Hat conference this week, one security expert will show how hackers could spoof near-field communications signals to access data on a smartphone.

The bigger threat is to “critical national infrastructure gear that typically uses higher end chips that still are not protected,” many of them supplied by NovAtel of Calgary, Canada, he said.

“If you could just build some paranoia using these receiver techniques, we would be leagues ahead of where we are today,” he said.

The Texas lab got interested in the drone problem after Iran broadcast pictures of a U.S. drone spy plane it captured last December. Iranians claimed they used a spoofing attack to capture the drone.

The lab was able to secure funding—and use of a White Sands, New Mexico facility-- from the U.S. Department of Homeland Security to determine the level of vulnerability of civilian drones.

“It was months of hard work,” said Humphreys. “We showed these drones nav systems are hackable by their exposed GPS stream, and once you spoof it, you can have your way with a drone,” he said.