GPS Spoofing Could Cause Problems for Sailors
Back in June we ran a couple of stories about GPS ‘spoofing’ — a series of incidents in which AIS was showing boats circling off Pt. Reyes, while the vessels themselves were actually hundreds of miles away. Some theorized that hackers were somehow spoofing the GPS system to intercept signals and digitally move the ships’ locations. Now The New Yorker has come out with a more in-depth article that confirms this. At some point, it could, and maybe already has, become a major headache for the Department of Defense, Google, Apple, Uber, autonomous vehicles and sailors. However, not all face equal threats.
We asked Stan Honey how concerned sailors should be. He replied, “To spoof a GPS, a spoofer needs to be within line of sight of the vessel to be spoofed, and transmit signals that are stronger than the real GPS signals. The second part is easy because GPS signals are weak, but the first part is tough unless the spoofer is just trying to spoof GPS receivers in a small area, like near Putin. So, for oceanic cruisers, it is very unlikely for them to be spoofed when on the high seas. When they approach harbors it is possible, but ideally, by then, they would have alternate sources of navigation information like bearings on landmarks. It continues to be good seamanship to not rely on GPS alone when near land, and take and plot bearings on landmarks from time to time.”
Stan and Sally are now cruising the occasionally foggy coast of Maine aboard their Cal 40 Illusion. Stan said they’re “in Northeast Harbor now, headed to Winter Harbor tomorrow, still on our way east.” Likely with both chart and GPS.
Spoofing GPS signals and altering AIS reports are two different things. One can alter a vessel’s position report (doing circles off-shore) without doing anything to alter GPS broadcast signals.
Both can have serious consequences and have different threat exposures. It would be good to see Latitude distinguish between the two types of threats.
To Jonathan’s point, and as I commented in a previous article on Latitude 38, this is almost certainly *not* GPS spoofing. A far more likely explanation is AIS spoofing, which reports an incorrect/spoofed GPS position over AIS. Since AIS uses a self-reported GPS position and has no security behind it, it is very vulnerable to attack. GPS is much less vulnerable to attack. More here on AIS spoofing: https://www.pentestpartners.com/security-blog/hacking-ais/
We reread the article in the New Yorker and, to us, it really sounds like it is GPS spoofing. They use the device to misdirect a drone that had nothing to do with AIS. Here’s the second paragraph: “On a hill about a kilometer away, his team was gathered around a flat metal box the size of a carry-on suitcase. The electronic machinery inside the box was called a spoofer—a weapon by another name. Soon, a Hornet Mini, a drone-operated helicopter popular with law enforcement and rescue agencies, was scheduled to appear forty feet above them. Then the spoofer would be put to the test.”
Later in the story it says, “Up on the hill, his students switched on the spoofer. Gradually increasing its power, they directed the bogus signal toward the Hornet, which appeared to hesitate in midair, as if encountering an invisible obstacle. The spoofer was, in essence, whispering lies in the drone’s ear, feeding it inaccurate information about its location. Convinced that it had drifted upward, the drone tried to correct, beginning a steep dive toward the desert floor. Just as it was about to crash into the ground, a manual operator grabbed the controls, pulling the Hornet out of its nosedive. Humphreys’s team let out a celebratory whoop over the radio.”
To us, it says they’re spoofing the GPS signal to cause problems with the drone. The technology could be used to spoof AIS but is not limited to that.
Well, I would have to be pretty friggin “spoofed” to end up like the boat in the photo. A bit melodramatic? I’m just sayin’…
You’re right. A little dramatic but sometimes it takes a little drama to get attention. Boats can end up like that even without being spoofed.