5 ms·

What I don't understand about this GPS spamming: we don't need to rely on GPS. We have Galileo, (GLONASS) and BAIDU. That is the reason we its now called GNSS.

What I don't understand about this GPS spamming: we don't need to rely on GPS. We have Galileo, (GLONASS) and BAIDU. That is the reason we its now called GNSS. Most of the chips and as such the receivers are supoorting all of these systems in parallel. While I understand that the Chinese use their own coordinate system, I don't if BAIDU is based on that or not. Galileo is available. Galileo is able to use authenticated signals. Galileo has much improved over GPS. I assume in (important) comercial applications like aircrafts, you could use the better Galileo service for which you have to pay for. So how important is GPS spaming really?

jstanley 2y ago
Do you mean it is specifically GPS that is getting spammed, or more generally are all of the GNSS systems getting spammed?
- bArray 2y ago
  In the UK "GPS" is used as a general term for GNSS. I don't doubt that the aircraft already use multiple satellites.
ElectRabbit 2y ago
> Galileo Which has optional cryptographic signatures of its positioning data. It's not spoofable anymore (but still jam'able with strong transmitters). Free for use. (https://www.gsc-europa.eu/sites/default/files/sites/all/files/Galileo_OSNMA_SIS_ICD_v1.0.pdf https://www.gsc-europa.eu/sites/default/files/sites/all/file...) Same for the HAS (High Accuracy Service) which offers precision down to 30cm without additional correction data. Also free for use. But requires a special receiver as it's using an additional band. Galileo was the ugly duckling for a very long time - but it turned into a shining one after it aged a bit.
- PinguTS 2y ago
  > Galileo was the ugly duckling for a very long time - but it turned into a shining one after it aged a bit. Yeah, for some time I was also in the camp of "why we need our own expansive service". But the current development has shown, that it was a wise desicion to have our own system. BTW: thanks for updating on some other details. I never followed up really, it was from the initial plans, that I was told there should be comercial service, that should pay. Also that for some emergency services there is a very limited possibility to have a back channel.
  - ElectRabbit 2y ago
    As far as I know all nav sats have emergency beacon payloads (Cospas-Sarsat). All providers (Beidou, GPS, Glonass, Galileo) joined this.
- azernik 2y ago
  It has optional cryptographic signatures of the navigation message, i.e. the data indicating position of satellites. Spoofing generally works not by altering the navigation message, but by altering the timing of arriving signals. I'd recommend this video for a publicly-available overview of the techniques: https://www.youtube.com/watch?v=sAjWJbZOq6I https://www.youtube.com/watch?v=sAjWJbZOq6I tl;dr Galileo spoofers exist and work just fine.
  - PinguTS 2y ago
    Nope, the GNAV message is not only the position of the sateellites, the almanac https://gssc.esa.int/navipedia/index.php?title=Galileo_Navigation_Message https://gssc.esa.int/navipedia/index.php?title=Galileo_Navig... Spoofing of Galileo was possible as long as the authentification was not enabled. https://www.septentrio.com/en/learn-more/insights/osnma-latest-gnss-anti-spoofing-security https://www.septentrio.com/en/learn-more/insights/osnma-late...
    - filleokus 2y ago
      In other comments to this link people are describing GPS according to my mental model, which is hard to combine with cryptography making it un-spoofable. If someone can re-broadcast the keystream and control the latency I perceive as a receiver, how would me checking that the MAC is correct help?
    - azernik 2y ago
      A) you keep on using the word "almanac". That term only refers to the imprecise information about all satellites that every satellite broadcasts, mostly to improve TTFF. The actual position used for navigation is called "ephemeris", and each satellite only broadcasts its own. B) none of that other stuff in the navigation message changes the pseudorange, which is what spoofers mess with. For a networking analogy - pseudoranges are calculated based on layer 1/2 properties of the network. (Specifically the code phase and Doppler shift.) Navigation messages are layer 7 information passed on top of that physical layer. You can change the timing and frequency characteristics of the PRN code without touching a single bit of the navigation message.) The G/NAV message (note the G - government) is for a separate service - not OSNMA - where not only is the navigation message encrypted, but the PRN code is also encrypted (symmetrically, so it can't be done for the mass market or even untrusted commercial customers).
sebzim4500 2y ago
Authenticating signals for GNSS sound like an impossible cryptographic task. What stops a malicious actor from recording the signals coming off the satellites and replaying them louder with a delay? If you pick the delay properly you can make the plane believe it is at an arbitrary point in space and time (although of course that time would always have to be at least a few `us` in the past).
- PinguTS 2y ago
  https://gssc.esa.int/navipedia/index.php/Galileo_Open_Service_Navigation_Message_Authentication https://gssc.esa.int/navipedia/index.php/Galileo_Open_Servic...
  - marsovo 2y ago
    Can you point us to which part of that can deal with the scenario in question? > What stops a malicious actor from recording the signals coming off the satellites and replaying them louder with a delay?
azernik 2y ago
"GPS" is being used as a genericism in these articles. All the GNSS constellations work the same way, and all of the military-grade spoofers are multi constellation.
jotux 2y ago
They receive these signals in parallel because they're sharing frequencies: https://novatel.com/support/known-solutions/gnss-frequencies-and-signals https://novatel.com/support/known-solutions/gnss-frequencies... You can jam 5-6 frequencies and knock out multiple constellations.

jstanley 2y ago

Do you mean it is specifically GPS that is getting spammed, or more generally are all of the GNSS systems getting spammed?

bArray 2y ago
In the UK "GPS" is used as a general term for GNSS. I don't doubt that the aircraft already use multiple satellites.

ElectRabbit 2y ago

> Galileo Which has optional cryptographic signatures of its positioning data. It's not spoofable anymore (but still jam'able with strong transmitters). Free for use. (https://www.gsc-europa.eu/sites/default/files/sites/all/files/Galileo_OSNMA_SIS_ICD_v1.0.pdf https://www.gsc-europa.eu/sites/default/files/sites/all/file...) Same for the HAS (High Accuracy Service) which offers precision down to 30cm without additional correction data. Also free for use. But requires a special receiver as it's using an additional band. Galileo was the ugly duckling for a very long time - but it turned into a shining one after it aged a bit.

PinguTS 2y ago
> Galileo was the ugly duckling for a very long time - but it turned into a shining one after it aged a bit. Yeah, for some time I was also in the camp of "why we need our own expansive service". But the current development has shown, that it was a wise desicion to have our own system. BTW: thanks for updating on some other details. I never followed up really, it was from the initial plans, that I was told there should be comercial service, that should pay. Also that for some emergency services there is a very limited possibility to have a back channel.
- ElectRabbit 2y ago
  As far as I know all nav sats have emergency beacon payloads (Cospas-Sarsat). All providers (Beidou, GPS, Glonass, Galileo) joined this.
azernik 2y ago
It has optional cryptographic signatures of the navigation message, i.e. the data indicating position of satellites. Spoofing generally works not by altering the navigation message, but by altering the timing of arriving signals. I'd recommend this video for a publicly-available overview of the techniques: https://www.youtube.com/watch?v=sAjWJbZOq6I https://www.youtube.com/watch?v=sAjWJbZOq6I tl;dr Galileo spoofers exist and work just fine.
- PinguTS 2y ago
  Nope, the GNAV message is not only the position of the sateellites, the almanac https://gssc.esa.int/navipedia/index.php?title=Galileo_Navigation_Message https://gssc.esa.int/navipedia/index.php?title=Galileo_Navig... Spoofing of Galileo was possible as long as the authentification was not enabled. https://www.septentrio.com/en/learn-more/insights/osnma-latest-gnss-anti-spoofing-security https://www.septentrio.com/en/learn-more/insights/osnma-late...
  - filleokus 2y ago
    In other comments to this link people are describing GPS according to my mental model, which is hard to combine with cryptography making it un-spoofable. If someone can re-broadcast the keystream and control the latency I perceive as a receiver, how would me checking that the MAC is correct help?
  - azernik 2y ago
    A) you keep on using the word "almanac". That term only refers to the imprecise information about all satellites that every satellite broadcasts, mostly to improve TTFF. The actual position used for navigation is called "ephemeris", and each satellite only broadcasts its own. B) none of that other stuff in the navigation message changes the pseudorange, which is what spoofers mess with. For a networking analogy - pseudoranges are calculated based on layer 1/2 properties of the network. (Specifically the code phase and Doppler shift.) Navigation messages are layer 7 information passed on top of that physical layer. You can change the timing and frequency characteristics of the PRN code without touching a single bit of the navigation message.) The G/NAV message (note the G - government) is for a separate service - not OSNMA - where not only is the navigation message encrypted, but the PRN code is also encrypted (symmetrically, so it can't be done for the mass market or even untrusted commercial customers).

sebzim4500 2y ago

Authenticating signals for GNSS sound like an impossible cryptographic task. What stops a malicious actor from recording the signals coming off the satellites and replaying them louder with a delay? If you pick the delay properly you can make the plane believe it is at an arbitrary point in space and time (although of course that time would always have to be at least a few `us` in the past).

PinguTS 2y ago
https://gssc.esa.int/navipedia/index.php/Galileo_Open_Service_Navigation_Message_Authentication https://gssc.esa.int/navipedia/index.php/Galileo_Open_Servic...
- marsovo 2y ago
  Can you point us to which part of that can deal with the scenario in question? > What stops a malicious actor from recording the signals coming off the satellites and replaying them louder with a delay?

azernik 2y ago

"GPS" is being used as a genericism in these articles. All the GNSS constellations work the same way, and all of the military-grade spoofers are multi constellation.

jotux 2y ago

They receive these signals in parallel because they're sharing frequencies: https://novatel.com/support/known-solutions/gnss-frequencies-and-signals https://novatel.com/support/known-solutions/gnss-frequencies... You can jam 5-6 frequencies and knock out multiple constellations.