GPS Spoofing, by its nature, mimics global positioning signals to provide false positives. The main actor in the rise of spoofing is Russia.
Key Judgements
KJ–1. Russia is almost certainly at the forefront of developing large-scale GNSS spoofing capabilities. Over 9,000 spoofing incidents were recording within Russian waters between 2016 and 2018.
KJ–2. Incidents surrounding the Kerch Strait is almost certainly one of the most concerning areas in which spoofing has been deployed. Misdirecting shipping through Ukraine’s only access to oceans in the East has the potential to increase tension in the area further.
KJ–3. Individuals and small groups can make spoofing devices. However, these open-sourced tools, which cost less than $300 to make do not provide the same amount of threat that a militarised system presently provides.
Why is this Important?
With GPS being ubiquitous around the world, preloaded onto the majority of smartphones and global militaries relying on various global positioning systems, the ability to misdirect an active target is almost certainly one of the most dangerous evolutions in electronic warfare.
Global Navigation Satellite System (GNSS) misdirection (spoofing) goes above what is capable with a common GPS Jammer. A GPS Jammer is relatively common, with cheap options available on eBay for as little as £22, and information freely available online on how to use them. Their usage is often not nefarious in intention with regard to public safety. Taxi drivers, as an example, may use these to prevent companies from spying on what they deem as personal information. However, these devices can still cause damage within several kilometres, affecting all users locally as well as systems on the same frequency (EG: 5G) of GPS.
GPS Spoofing
Spoofing, in contrast, is almost certainly only nefarious in use and can cause much more disruption.
The idea of Spoofing a GNSS signal and jamming are two very different notions. Jamming by nature is more of a brute force technique that will stop all signals coming in or out of a certain area. Spoofing, in contrast, is a much more calculated and underhand technique that pretends to be an original signal to a target.
Although commonly referred to as GPS spoofing, this nature of attack targets GNSS, rather than the United States GPS network specifically. Any system using GNSS, such as GPS, the European Union’s new Galileo system, Russia’s Global Navigation Satellite System (GLONASS) and others can be targeted.
Spoofing also requires the false signal to be stronger than the legitimate one. False signals can lead to a target either appearing in a different area than it occupies, to slight course changes that can lead vehicles into dangerous areas and enemy territory. The University of Texas in 2013 demonstrated how this could be done in an inauspicious way that would make it unlikely that a false signal would be noticed. In a demonstration, they managed to spoof the signal of a superyacht, changing course by 3 degrees. With the ship out at sea, the only sense of direction the crew had was the GPS, resulting in an unrecognised change of direction.
Russian GPS Spoofing
The main actor in the rise of spoofing is Russia, almost certainly the main force behind the development of spoofing. The most notable incidents have taken place either within Russia or in and around its territorial waters.
In June of 2017, there were reports of multiple ships within Russian waters in the Black Sea experiencing problems with global positioning systems. Although they were in the sea in between Turkey and Ukraine, the GPS in 20 ships showed their position being within an airport in Sochi.
However, one of the most concerning areas in which GPS was spoofed was within the Kerch Strait. Vessels traversing this waterway were being sent signals that positioned them either within the Simferopol airport in Crimea, or within Anapa airport on the Russian mainland on the east bank. On the 15th of September 2016 and 15th of May 2018, Vladimir Putin visited the Kerch Bridge.
On both occasions, it was the only official visit by Putin in the year and the only spoofing incidents in the year in Kerch. In 2016, ships were told that their present location was at Simferopol airport 200km away in Crimea, while the 2018 event was when the vessels were told that they were currently located in Anapa Airport 65km away.
The Kerch Strait is a key waterway for both Ukraine and the Russians. Ukraine uses the Azov sea as its only connection to open oceans and world trade, while Russia is seeking to control the area since the annexation of Crimea. With Russia building up its fleet in the area and Ukraine disputing its now lack of commercial ship access due to the bridge being built only having a 33m height, the deployment of spoofing equipment in the area is almost certainly an indicator that the Russians plan to deploy it in anger at some point in the near future.
The Center for Advanced Defense (C4ADS) released a report that detailed 9,883 vessels in Russia, Crimea and also Syria between February of 2016 and November of 2018. The Russian mainland locations were:
- Moscow
- Petersburg
- Gelendzhik
- Arkhangelsk
- Vladivostok
Crimean locations were:
- The Kerch Strait
- Sevastopol
- Olyba
The Russian Khmeimim airbase in Syria was also detected to have had GPS spoofing operations.
What’s Next in GPS Spoofing?
Although spoofing originally was only used in the hands of the state military, it is slowly being co-opted by individuals as technology is disseminated. A Japanese Researcher, Takuju Ebinuma, has posted a GPS signal-simulator on GitHub. Not only is this software now open-source, but there are now researchers developing and testing homemade spoofing equipment that is almost certainly near consumer-ready in the next 2-3 years.
Although these designs are becoming consumer-friendly and easy to create for a backroom hacker, there are significant drawbacks for non-military spoofers.
- They need to be within close proximity of any target (Either on the vehicle itself – or in a drone flying, above for example)
- Pre-defined knowledge of a route is needed for an effective attack against human-controlled vehicles.
- If an individual knows where they are going, it won’t work.
Conclusion
GNSS spoofing, although evolving at a rapid rate, is still early in development and will likely not be a common danger within the next two years. Despite this, Russian deployments of the technology warrant caution and further investigation and indicate they are highly likely the leaders in the development of this technology. Military uses of spoofing almost certainly represent a greatly increased threat than individual actors using the technology at present. Although its primary use at present is focused on shipping and other transport, its use on drones, aeroplanes and other vehicles in a warfare setting represent a heightened threat should it be deployed on the battlefield.
Image: Russian MOD (link)
Image2: Virginia Tech (link)
