Tag: spoofing

  • More than 100 experiments planned for NTS-3

    More than 100 experiments planned for NTS-3

    More than 100 experiments will be conducted with the Navigation Technology Satellite-3 (NTS-3), set to launch next year, according to a U.S. Air Force official and reported by FedScoop.

    “We’re really excited to push the state of the art with more than 100 experiments on this little [NTS-3] spacecraft and we’re looking at ways that we can solve warfighters’ problems in the contested environment,” Maj. Gen. Heather Pringle, commander of AFRL, told reporters April 6 at the 37th Space Symposium in Colorado Springs.

    Maj. Gen. Heather Pringle
    Maj. Gen. Heather Pringle

    Set to launch in 2023, NTS-3 is designed to push the boundary of today’s position, navigation and timing (PNT) technology to pave the way for a more flexible, robust, and resilient architecture for satellite navigation technology.

    NTS-3 is a product of the Air Force Research Laboratory (AFRL) and industry, designed to test advanced techniques and technologies to detect and mitigate interference to PNT capabilities and increase system resiliency for military, civil, and commercial users.

    Unlike the GPS medium-Earth-orbit satellites, NTS-3 will operate for one year in geosynchronous Earth orbit. Ultimately, NTS-3 will identify key aspects for new GPS receivers that incorporate multiple signals and readily adapt to warfighter needs.

    The NTS-3 experiments will also involve ground equipment and terminals such as command and control stations and software-defined radios. Specific improvements to the ground segment will enable experimentation with automated “lights-out” operations, control station failover, and near-real time environment sensing and generation of error correction and tailored waveforms. Onboard systems will monitor clock accuracy and orbit parameters to mitigate errors and notify the user.

    NTS-3 will test a new digital signal generator that can be reprogrammed on-orbit, enabling it to broadcast new signals, improve performance by avoiding and defeating interference, and adding signatures to counter spoofing.

    AFRL also will explore antenna configurations to provide Earth coverage and steerable regional beams in multiple frequencies and signal codes. The NTS-3 satellite will be equipped with 110 antennas to help counter attempted GPS jamming.

    Ultimately, NTS-3 is expected to provide users with enhanced signal stability, availability, integrity and accuracy.

    L3Harris plans to deliver NTS-3 later this year. The company is assembling the satellite at its Palm Bay facility near Cape Canaveral, Florida. The plant was expanded in 2021 to accommodate the NTS-3 program.

    Image: Air Force Research Laboratory
    All images: Air Force Research Laboratory
  • European agency warns of GNSS outages near ukraine

    GNSS jamming and possible spoofing has intensified in areas surrounding Ukraine, according to the European Union Aviation Safety Agency (EASA).

    The agency issued a bulletin on March 17 warning of a GNSS outage leading to navigation and surveillance degradation. According to the bulletin, which was directed at national aviation authorities and airlines, reports analyzed by EASA indicate that, since Feb. 24, GNSS spoofing and jamming has intensified in four key geographical areas:

    • the Kaliningrad region, surrounding Baltic Sea and neighboring states
    • Eastern Finland
    • the Black Sea
    • the Eastern Mediterranean area near Cyprus, Turkey, Lebanon, Syria and Israel, as well as Northern Iraq.

    “The effects of GNSS jamming and/ or possible spoofing were observed by aircraft in various phases of their flights,” the bulletin stated, “in certain cases leading to rerouting or even to change the destination due to the inability to perform a safe landing procedure.”

    Potential issues include:

    •  loss of ability to use GNSS for waypoint navigation
    • loss of area navigation (RNAV) approach capability
    • triggering of terrain warnings
    • inconsistent aircraft position on the navigation display
    • loss of ADS-B, wind shear, terrain and surface functionalities
    • failure or degradation of ATM/ANS/ CNS and aircraft systems that use GNSS as a time reference
    • airspace infringements and/or route deviations due to GNSS degradation.
  • Registration open for Munich Satellite Navigation Summit

    Registration open for Munich Satellite Navigation Summit

    Photo:

    The Munich Satellite Navigation Summit program is now online and registration for the event is open. The summit will be held online March 7-8.

    The Munich Satellite Navigation Summit focuses on satellite navigation in the present day and future, featuring global speakers and highlighting the latest developments in the field of GNSS. This year’s theme is “AI in GNSS – Intelligence brought to Navigation”.

    The summit will feature 12 sessions from industry experts, including sessions on the following topics:

    • First and Second Generation of the European Satellite Navigation System Galileo
    • Modernization of the US Global Positioning System
    • Status and modernization of the Russian Global Satellite Navigation System GLONASS and the Chinese Beidou System (BDS)
    • Developments of regional systems like the Japanese QZSS and the Indian IRNSS and the Korean Positioning System (KPS)
    • Use of AI within the navigation world and its implications
    • Jamming, spoofing, interference, and countermeasures; understanding secure Galileo services (OSNMA, PRS)
    • GNSS and the new race to the Moon; upcoming space mission related to PNT
    • Advanced technologies for PNT (quantum, optical) even beyond Galileo 2nd Generation

    The summit will also offer a free job market discussion and company pitches prior to the main conference for all attendees.

    To view the Munich Satellite Navigation Summit program and register, visit munich-satellite-navigation-summit.org

  • DOD tasks Orbital Insight to help identify intentional GNSS disruptions

    DOD tasks Orbital Insight to help identify intentional GNSS disruptions

    A new platform will detect and characterize GNSS spoofing operations using artificial intelligence and commercially available data

    Geospatial intelligence company Orbital Insight has been awarded a contract from the U.S. Department of Defense (DoD) to deliver a technology platform for identifying intentional GNSS interference and manipulation operations across the world.

    The platform will leverage commercially available data to detect GNSS spoofing, where falsified or manipulated GNSS signals are used to confuse adversaries or obscure illicit activities, presenting risk to both government and commercial operations. Orbital Insight was selected through DoD’s Defense Innovation Unit (DIU) solicitation process seeking commercial solutions to counter the growing threat of GNSS disruptions to national security.


    Research suggests that Russia conducted nearly 10,000 spoofing operations from 2016 to 2018 alone.


    The new technology will significantly improve situational awareness for warfighters, intelligence analysts and safety-of-life applications. Orbital Insight’s platform will leverage its multisensor data stack, artificial intelligence and machine-learning capabilities to alert analysts and operators to potential jamming and spoofing events, techniques commonly used by adversarial actors to cover up activities or sabotage operations.

    The platform leverages a suite of geolocation data — satellites, AIS, ADS-B and internet-of-things devices — along with new advanced algorithms designed to automatically recognize anomalies linked to spoofing, complemented by research intelligence from the nonprofit partner Center for Advanced Defense Studies. Research suggests that Russia conducted nearly 10,000 spoofing operations from 2016 to 2018 alone.

    “Helping organizations understand what’s happening on and to the Earth is at the heart of what Orbital Insight does, and spoofing is a national security problem that has proven challenging to solve,” said Kevin O’Brien, CEO, Orbital Insight. “GNSS spoofing is essentially a data problem, and Orbital Insight’s AI and deep data stack can help identify spoofing, along with other major humanitarian and environmental challenges. This is a perfect example of private and public sectors uniting through technology.”


    Other areas that may be addressed: identifying drug trafficking, illegal fishing, sea-borne piracy and unintentional commercial aviation disruptions


    The technology has broad implications that extend beyond situational awareness of intentional GNSS interference. Other national security, humanitarian and environmental challenges may be addressed, such as identifying drug trafficking, illegal fishing, sea-borne piracy and unintentional commercial aviation disruptions.

    Federal agencies are increasingly complementing their systems with commercial technology and data sources that are unclassified, universally accessible, and shareable with allies. The National Air and Space Intelligence Center will be the first customer to utilize the technology. Upon successful integration, the goal will be to expand this platform widely across the defense, intelligence and civil communities.

    Orbital Insight received the DoD contract on the heels of announcing a Phase II Small Business Innovation Research contract from the National Geospatial-Intelligence Agency to deliver a computer-vision model that uses synthetic data to detect novel classes of objects.

    The company also recently launched a new class of multiclass object-detection algorithms within its flagship GO platform to help the intelligence community monitor and differentiate activity at thousands of areas of interest. Like all of Orbital Insight’s products, these algorithms are being developed within an ethics framework that shapes the company’s work and values privacy.

    Image: matejmo/iStock/Getty Images Plus/Getty Images
    Image: matejmo/iStock/Getty Images Plus/Getty Images
  • Orolia and Hoptroff partner on traceable timing to protect networks

    Orolia and Hoptroff partner on traceable timing to protect networks

    Hoptroff’s Traceable Time as a Service to become an option for Orolia’s product portfolio; webinar scheduled for Dec. 15

    Orolia and timing solutions provider Hoptroff are partnering to deliver a service combining Orolia’s resilient positioning, navigation and timing (PNT) solutions with Hoptroff’s timing synchronization software.

    The collaboration will offer Hoptroff’s Traceable Time as a Service (TTaaS) as an add-on to Orolia’s suite of products, providing precise and verifiable time to customers in enterprise, financial, telecom, utilities, public safety, and other markets where traceable time is critical.


    Webinar scheduled

    Orolia and Hoptroff will host a joint webinar to discuss the partnership and new resiliency options for customers on Dec. 15 at 12 p.m. EST. Register here.


    Hoptroff’s TTaaS offers an additional level of security and precision to meet stringent regulatory and resilient infrastructure requirements by delivering accurate time over the network using a VPN connection over broadband or fiber networks.

    The bundled solution will simplify the challenge of getting accurate, traceable time in applications where GNSS access is not available or dependable. It can also serve as an accurate, reliable backup to GNSS to provide a high level of resiliency to timing systems being used in critical infrastructure.

    “As industries evolve and computer applications become more complex and widely distributed, it is essential that devices in a distributed process share the same accurate timescale to reconstruct digital events after the fact,” said Tim Richards, COO at Hoptroff. “Network-based traceable timing, such as TTaaS, provides resilient backup to a GNSS installation in the case of signal disruption, monitors the quality of performance of time servers, and keeps a record of this timing quality at a location of the customer’s choice. Our partnership with Orolia means businesses will now be able to back up and monitor physical time servers and virtual servers in the cloud, so that they can be sure they share the same accurate timescale, and they have the records to prove it.”

    “The partnership with Hoptroff aligns with Orolia’s resilient PNT strategy by providing a wireline solution to augment its space-based PNT solutions. This allows us to further simplify the challenge customers face when building a highly resilient timing solution,” said Jeremy Onyan, Orolia’s director of time sensitive networks. “By combining Orolia’s anti-jamming and anti-spoofing solutions, high-performance GNSS-based timing products, alternative signals like STL, a local high-quality oscillator, and now a wireline-based TTaaS we have one of the most robust portfolios of resilient PNT solutions in the market. Additionally, with the recent acquisition of Seven Solutions, we are well positioned to extend our capabilities into high-accuracy time distribution.”

    Seven Solutions is a global innovator in White Rabbit sub-nanosecond time transfer and synchronization technology. “With the capability to distribute time with little to no accuracy loss, Orolia’s customers using Hoptroff’s TTaaS or other time references such as GNSS can extend that time to other parts of their networks and create a high level of resiliency against potential outages,” Onyan added.

    Image: Panuwat Sikham/iStock/Getty Images Plus/Getty Images
    Image: Panuwat Sikham/iStock/Getty Images Plus/Getty Images
  • DHS offers resources to protect critical infrastructure from GPS vulnerabilities

    DHS offers resources to protect critical infrastructure from GPS vulnerabilities

    DHS logoThe U.S. Department of Homeland Security (DHS) Science and Technology Directorate (S&T) has published a GPS Receiver Whitelist Development Guide and a new release of the Positioning, Navigation, and Timing (PNT) Integrity Library to protect against GPS spoofing.

    The free resources are intended to advance the design of PNT systems and increase resilience of critical infrastructure to PNT disruptions.

    The GPS Whitelist Development Guide presents a software assurance approach to addressing potential vulnerabilities and increasing reliability of GPS receivers. The guide addresses data-related requirements in the Resilient PNT Conformance Framework, which provides guidance for defining expected behaviors in resilient PNT equipment.

    “We hope this guide and related resources will help industry advance towards a cybersecurity-based approach to PNT resilience,” said S&T Technical Manager Ernest Wong.

    Originally released in March 2021 as open source on GitHub, the PNT Integrity Library provides users with a method to verify the integrity of the received GPS data. The update includes:

    • A compliance check on Interface Control Document (ICD) IS-GPS-200, which is a formal means of establishing, defining and controlling communication between the GPS space and other user systems; and
    • A Do-It-Yourself (DIY) Toolkit, which describes how a perspective end-user of the PNT Integrity Library can assemble a demonstrational toolkit with commercial-off-the-shelf (COTS) hardware.

    “Since GPS signals can be jammed or spoofed, critical infrastructure systems should not be designed with the assumption that GPS data will always be available or will always be accurate,” said S&T Project Manager Brannan Villee. “Application of these tools will provide increased security against GPS disruptions. However, DHS also recommends a holistic defense strategy that considers the integrity of the PNT data from its reception through its use in the supported system.”

  • Research Roundup: Combatting jamming and spoofing

    Research Roundup: Combatting jamming and spoofing

    Image: MF3d/E+/Getty Images
    Image: MF3d/E+/Getty Images

    Of the hundreds of papers researchers presented at 2020’s annual Institute of Navigation (ION) GNSS+ conference, which took place virtually Sept. 21–25, the following six focused on combating jamming and spoofing. The papers are available at www.ion.org/publications/browse.cfm.

    Using Direction of Arrival

    The author presents a scheme to combine multiple measurements for GNSS spoof detection for safety-of-life applications. The author’s algorithm combines both independent and correlated direction of arrival measurements that result in an analytic solution for the detection threshold, which can be computed online by the receiver. The scheme is validated for correlated azimuth measurements with data recorded by a dual-polarization antenna mounted on a C12 aircraft in flight, and applied to data from a live spoofing event. Results show an increase in detections of 47% using just two sequential measurements, with equal robustness for false alerts compared to snapshot-based detection. The results also show using sequential spoof detection is a powerful way to improve the detection capability of an anti-spoof defense, costing only added computational complexity while introducing a timely component to the detection.

    Citation. Rothmaier, Fabian; “Optimal Sequential Spoof Detection Based on Direction of Arrival Measurements.” https://doi.org/10.33012/2020.17538

    Using Neural Networks

    Spoofing attacks are difficult to model and counteract. Data-driven schemes become useful if enough training data is available. This article explores such an approach using the cross-ambiguity function delay/Doppler map as input to a deep neural network for classification purposes. Several neural network models are trained, and their performance compared for detection and false-alarm probabilities. Results are promising, particularly with more complex neural networks, which are able to capture the nature of spoofing attacks. The method operates on a per-satellite basis.

    Citation. Borhani-Darian, Parisa; Li, Haoqing; Wu, Peng; Closas, Pau; “Deep Neural Network Approach to Detect GNSS Spoofing Attacks.” https://doi.org/10.33012/2020.17537

    Using Networks for Timing

    Information cross-validation can be a powerful tool to detect manipulated, dubious GNSS timing data. Opportunistic time providers, Wi-Fi beacons and dedicated timing infrastructures provide largely available, precise sources of time information. A promising approach is to leverage time obtained over networks to which a mobile device can connect, and detect discrepancies between the GNSS-provided time and the network time. The paper investigates different options to secure augmentation time information, notably Network Time Security (NTS) and modified Wi-Fi beacons to support authentication. This scheme requires limited overhead, does not disrupt the normal operation of the Wi-Fi access points, and can be readily deployed.

    Citation. Spanghero, Marco; Zhang, Kewei; Papadimitratos, Panagiotis; “Authenticated Time for Detecting GNSS Attacks.”

    Using Cooperative Positioning

    This paper highlights possible metrics to be checked to identify malicious attacks to the positioning and navigation systems in mass-market connected devices. The network-based exchange of GNSS data — such as GNSS raw measurements recently disclosed in Android smart devices — could offer the possibility to compare or combine such metrics to better identify spoofing and meaconing attacks.

    This paper provides experimental tests and analysis toward devising an anti-spoofing strategy in connected GNSS devices. Included are a classical spoofing approach (simplistic RF attack) and its effects on the raw GNSS observables. With two synchronized devices in a cooperative framework, possible metrics are highlighted to identify a spoofing attack to one of the devices by observing anomalies.

    Also included is work on simulated meaconing of an already-developed collaborative positioning framework based on the exchange of raw GNSS measurements through the network. The different approaches of an attack to the framework are laid down, and the anomalies to be considered to detect an attack in a network of cooperating devices are presented.

    This paper represents a part of a larger goal to develop an anti-spoofing detection and coping mechanism in connected commercial GNSS devices.

    Citation. Rustamov, Akmal; Gogoi, Neil; Minetto, Alex; Dovis, Fabio; “GNSS Anti-Spoofing Defense Based on Cooperative Positioning.”

    Using OSNMA in the GIANO GNSS receiver

    In recent years, the awareness about jamming and spoofing risks has been increasing, particularly in the timing community because they may cause the disruption of critical services and infrastructures in the telecommunication, energy and finance sectors, which rely on GNSS timing to operate. To overcome these hazards, the European GNSS Agency (GSA) has funded the development of timing receivers for professional applications, with the aim to address specifically the above vulnerabilities, improving the receiver’s robustness and the accuracy and reliability of time transfer.

    In this context, the GIANO (Galileo-based timing receiver for critical infrastructures robustness) project consortium, coordinated by Thales Alenia Space Italy and with the support of Deimos Engenharia S.A. (Portugal), the Space Research Centre PAS in Poznan (Poland), Piktime System SP. Zoo (Poland) and Business Integration Partner S.p.A. (Italy), has been awarded a contract in the framework of the GSA’s “Fundamental Elements” program to develop a timing receiver for critical infrastructure applications. Besides the implementation of some interference and spoofing detection and mitigation techniques, the GIANO receiver makes use of Galileo’s authentication service OSNMA (Open Service Navigation Message Authentication), which can be employed as an added defense against some types of spoofing.

    OSNMA exploits the TESLA (Time Efficient Stream Loss-tolerant Authentication) scheme, which is a protocol based on the transmission of message authentication codes generated with a key broadcast with some delay. The receiver authenticates the satellite messages through a digital signature algorithm and a public key known by the receivers, which also validates the root key of the TESLA chain, and through message authentication codes (MAC) used to authenticate specific fields of the navigation message. The receiver will also support public key renewals over the air.

    This paper presents the OSNMA implementation within GIANO receiver, including the cryptographic operations required. The GIANO OSNMA capability will be extensively tested and validated with the support of the European Commission Joint Research Centre (Ispra, Italy).

    Citation. Catalano, Valeria; Prata, Ricardo; Carvalho, Filipe; Nunes, Rui; Marradi, Livio; Franzoni, Gianluca; Puccitelli, Marco; Campana, Roberto; Gioia, Ciro; “Galileo OSNMA Preliminary Implementation in the GIANO GNSS Receiver.” https://doi.org/10.33012/2020.17714

    Using Chimera Authentication

    Chimera is a signal authentication enhancement suitable for protecting the L1C GPS signal. As specified by the acronym itself (chips-message robust authentication), Chimera is based on the insertion of authentication features both at the message and spreading code levels. The data are digitally signed, while the spreading code is protected by the insertion of cryptographically generated punctures.

    The Chimera interface specification document was made public in 2019, while its first transmission is expected to be broadcast from the Navigation Technology Satellite 3 (NTS-3) satellite, set for launch in 2023.

    This paper describes the software implementation of the functions required to enable a GNSS software receiver to elaborate the Chimera authentication service. It includes a description of the development work and a detailed software profiling analysis, allowing for evaluation of the additional computational burden required by the Chimera verification and useful for providing important guidelines for receiver implementation.

    Citation. Gamba, Micaela Troglia; Nicola, Mario; Motella, Beatrice; “GPS Chimera: A Software Profiling Analysis.” https://doi.org/10.33012/2020.17717

  • Two years since the Tesla GPS hack

    Two years since the Tesla GPS hack

    Photo: Roi Mitt
    Photo: Roi Mitt

    In June 2019, Regulus Cyber’s experts successfully spoofed the GPS-based navigation system of a Tesla Model 3 vehicle. This experiment provided an important warning for all companies using GNSS location and timing: these technologies, on which they depend, are highly vulnerable to spoofing attacks. In the two years since the experiment, companies and governments have continued to research the potential harm that can be caused by spoofing attacks and are learning more about how to defend themselves from them.

    The Tesla experiment was groundbreaking because it was the first time that a level 2.5 autonomous vehicle was exposed to a sophisticated GPS spoofing attack and its behavior recorded.

    We chose Tesla’s Model 3 because it had the most sophisticated advanced driver assistance system (ADAS) at the time, called Navigate on Autopilot (abbreviated NOA or Autopilot), which uses GPS to make several driving decisions. However, this experiment exposed several cybersecurity issues potentially affecting all vehicles relying on GPS as part of their sensor fusion for autonomous decision making.

    NOA makes lane changes and takes interchange exits once a destination is determined, without requiring any confirmation by the driver. Its several other features include autonomous deceleration and acceleration according to the speed limit, autonomous lane changing, and adaptive cruise control.

    These features use a variety of sensors, including cameras, radar, speedometers and more. The researchers wanted to test the extent to which the Model 3 relied on its GNSS receiver to make these driving decisions and how it behaved when receiving contradicting information from its GNSS receiver and its other sensors.

    The researchers used hardware and software purchased online to mimic the tools potential hackers would use. The experiment involved two software-defined radio (SDR) devices purchased online, one to spoof GPS and one to jam all other constellations, connected to an external antenna to simulate an external attack. The software used to simulate the GPS signal was downloaded from an online source, available for free.

    The test included three scenarios the researchers assumed would involve usage of GNSS, each one using a different spoofing pattern:

    Scenario 1. Exiting the highway at the wrong location

    Scenario 2. Enforcing an incorrect speed limit

    Scenario 3. Turning into incoming traffic

    A Tesla Model 3 was remotely hacked in a test of a GPS spoofing attack. (Photo: Regulus Cyber)
    A Tesla Model 3 was remotely hacked in a test of a GPS spoofing attack. (Photo: Regulus Cyber)

    Scenario 1: Exiting the Highway at the Wrong Location

    The car was driving normally at a constant speed of 95 KPH with NOA enabled. The destination determined for this ride was a town nearby and the car designated a certain interchange as the destination for an autonomous exit maneuver. The experiment began 2.5 km before the vehicle reached that interchange; however, the researchers’ fake GPS signal resulted in coordinates of a location on the same highway but only 150 m before the exit.

    As soon as its GNSS receiver was spoofed, the car assumed that it had reached the correct exit and began to maneuver to the right, activating the blinker, slowing down, turning the wheel, and crossing a dotted white line to its right side, exiting to an emergency pit-stop, confusing it with the exit 2.5 km ahead.

    To be clear, this would not have happened at any location along the highway, because sensor fusion with the radar and the camera enables the car to avoid physical obstacles and ensures that it does not cross a solid white line that makes a turn illegal.

    The spoofing attack succeeded, in that it enabled the attacker to remotely manipulate the car’s sensor fusion and make it exit the highway at the wrong location.

     

    Scenario 2: Enforcing an Incorrect Speed Limit

    The car was driving to a random city far away on a highway, at a constant speed of 90 KPH, which was 10 KPH below the highway’s speed limit, with NOA enabled. The researchers generated a fake GPS signal, with the coordinates of a nearby town road that has a speed limit of 33 KPH. Shortly thereafter, the vehicle assumed the speed limit had just changed to 33 KPH and instantly began decelerating. Each time the driver attempted to accelerate using the gas pedal, as soon as he lifted his foot off the pedal the car engaged in heavy braking to quickly decelerate back to 33 KPH.

    To be clear, this would not have happened if NOA had been turned off. The cruise mode can be disabled by either using the touch screen or by pressing the brakes, which would allow the driver to regain full manual control over the vehicle’s speed.

    Again, the spoofing attack succeeded, in that it allowed the attacker to remotely manipulate the car’s speed and made it enforce a speed limit much lower than the actual one on the highway.

    Scenario 3: Turning into Incoming Traffic

    The car was being driven manually on a two-lane road with one lane in each direction, the type of road on which NOA cannot be used. The researchers generated a fake GPS signal, with coordinates of a nearby three-lane highway, with all lanes in the same direction. Furthermore, the spoofed location was 150 m from a designated exit that the vehicle’s navigation system was programmed to take, requiring a left turn.

    Shortly after the car’s GNSS receiver was spoofed, the vehicle assumed it was on a highway and engaged NOA. Next, it triggered the exit maneuver, which began with activating the left blinker, followed by turning the wheel to the left. The driver had to quickly grab the wheel and manually drive the car back to its lane to avoid a collision with oncoming traffic.

    To be clear, this kind of scenario would not be possible without the driver enabling the NOA. Once a Tesla driver enables NOA, it automatically turns on once the vehicle is on the highway with a set destination. This is why the researchers assumed that NOA would be turned on by default, and as long as NOA is activated, the vehicle is susceptible to the attacks mentioned in the experiment.

    Once again, the spoofing attack was successful in that it enabled the attacker to remotely steer the vehicle into the opposing lane, placing it on a direct collision course with oncoming traffic. Out of the three scenarios described, this one proved that GNSS spoofing can endanger lives.

    The hardware used for the GPS spoofing test. (Photo: Regulus Cyber)
    The hardware used for the GPS spoofing test. (Photo: Regulus Cyber)

    GPS Cybersecurity for Automotive Applications

    The NOA system in the Tesla Model 3, being an ADAS, allows drivers to rely on the car and its sensors for basic driving functions. Therefore, it enables drivers to briefly take their hands off the wheel and reduces the number of actions they are required to take. Nevertheless, drivers are still required to be fully attentive to the road so that they can take control of the vehicle at any time.

    However, since this spoofing attack had such a sudden and instant impact on the car’s driving behavior, a driver who is not fully attentive and aware would not be prepared to quickly take control and prevent an accident. By the time the driver notices that something is wrong and reacts, it might be too late to prevent an accident. Already drivers have been found sleeping at the wheel, driving under the influence of alcohol, and doing other inappropriate tasks with NOA engaged.

    Furthermore, this situation assumes a level 2.5 autonomous vehicle as was tested. But what happens in level 3 vehicles, in which driver engagement is limited, or level 4 and 5, in which driver response is non-existent? This research provides us with a glimpse into the crucial importance of sensor cybersecurity and particularly of GNSS cybersecurity.

    The Tesla hack experiment and its results were eye-opening for the autonomous vehicles sector – the danger is real and rising as more and more vehicles are depending on GNSS technology as part of their sensors for assisted or automated driving. Up to 97% of new vehicles since 2019 incorporate GNSS receivers and most if not all are still vulnerable to the same spoofing attacks presented in this research.

    In January 2021, the UN’s World Forum for Harmonization of Vehicle Regulations (WP.29) issued Regulation No. 155, which sets guidelines for cybersecurity in the automotive industry with the goal of addressing every possible cyber threat that it might encounter. Annex 5 of the regulation defines cyber attacks and states that in order to get approvals in the future vehicle manufacturers will need to provide solid evidence that their vehicles are sufficiently protected against them.

    Among the cyber threats mentioned in the Annex is spoofing of data received by the vehicle — both sybil spoofing attacks and spoofing of messages. The Annex also lists the appropriate protection that vehicle manufacturers should implement and states that vehicle manufacturers will be required to provide evidence of the effectiveness of the mitigation measures they choose. These upcoming regulatory requirements can make the difference between life and death in situations caused by GNSS spoofing and ensure that only reliable and resilient positioning is used within vehicles, both today and in the future.


    Please note: Tesla released a statement saying that it is “taking steps to introduce safeguards in the future which we believe will make our products more secure against these kinds of attacks.” Regulus Cyber researchers did not perform any further experiments with Tesla Model 3 since this research was published two years ago.

    See the Tesla GPS spoofing experiment from the driver’s point of view:

  • Orolia adds new GNSS simulator to BroadSim product line

    Orolia adds new GNSS simulator to BroadSim product line

    BroadSim Solo provides advanced GNSS scenario creation on the engineer’s desktop

    Orolia Defense & Security released the latest addition to its GNSS simulator family — BroadSim Solo — at the Institute of Navigation Joint Navigation Conference (JNC) taking place this week in Covington, Kentucky.

    The Solo joins the BroadSim line of Skydel-powered GNSS simulators, which includes models suited for hardware-in-the-loop and multi-element antenna/controlled reception pattern antenna (CRPA) testing.

    Live demonstrations of BroadSim Solo are taking place in the JNC Exhibit Hall at Orolia Defense & Security booth No. 117 through Aug. 26. Orolia provides M-code solutions for resilient positioning, navigation and timing.

    BroadSim Solo shares the same Skydel simulation engine that runs on a standard BroadSim, BroadSim Anechoic and BroadSim Wavefront. It supports advanced scenario creation features and the benefits provided by a software-defined architecture such as high dynamics, a 1000-Hz iteration update rate and ultra-low latency of 5 ms.

    Photo: Orolia
    Photo: Orolia

    Nearly all civilian GNSS signals can be generated through the Solo’s single RF output (one frequency band at a time), along with jamming or spoofing signals, and GPS AES M-code. AES is an encryption method; rather than using the MNSA encryption, it is possible to use AES for testing purposes only.

    BroadSim Solo’s compact form factor is designed to do away with bulk, fitting comfortably at a typical desk or workstation. Plus, the Solo addresses the permanent challenge engineers face with laboratory capacity and availability.

    “Creating complex test scenarios can be a tedious process, especially when emulating challenged environments,” said Tim Erbes, director of engineering for Orolia Defense & Security. “Having the ability to create scripts at your desk significantly frees up lab time and space for running these important simulations. Also, scenario creation is no longer limited to one person fixed to one system. Imagine a team of engineers, each with a BroadSim Solo, simultaneously building tests. Having a whole fleet of BroadSim Solos? It’s game-changing.”

    BroadSim Solo with the Skydel simulation engine offers an intuitive user interface, a comprehensive API supporting Python, C++ and C#, and automation tools and custom plugins that will speed up development cycles, increase performance and ultimately drive innovation.

    “In an effort to enhance the customer experience and expand the reach of advanced GNSS simulators, we wanted to offer an affordable solution with all of the same core features as our most advanced BroadSim systems,” said Tyler Hohman, director of products for Orolia Defense & Security. “This gives our customers the opportunity to place more simulators in the hands of engineers and scientists without sacrificing capabilities. Our hope is that customers will find value in having a simulation ecosystem that is scalable based on their requirements.”

    Photo: Orolia
    Photo: Orolia
  • Spirent Federal launches alternative RF navigation simulator

    Spirent Federal launches alternative RF navigation simulator

    Photo: Spirent
    Photo: Spirent

    Spirent Federal has launched an alternative RF navigation simulator. As GPS jamming and spoofing continue to rise, interest in complementary sources of positioning, navigation and timing (PNT) data has likewise increased.

    Recent government directives recommend a layered, multi-source approach, with much of the attention focused on non-GNSS radio frequency signals. These RF signals, coined alternative RF navigation, offer unique PNT capability in GPS-degraded or denied environments. The signals are secure and resilient and can act as an effective complement to GPS signals.

    Spirent Federal’s product can simulate resilient alternative RF navigation signals on its own or concurrently with GNSS signals. Testing can be static or dynamic, with stationary, pedestrian and ground vehicle trajectories available.

    “As a result of our extensive research and development incorporating a variety of assured PNT technologies, we’re pleased to be the first to provide this capability to our customers,” said Roger Hart, director of engineering. “Our product enables developers to test early and often, from the first stages of R&D to integration and field testing. Solutions can be tested with edge cases, hardened against interference, and deployed faster with greater confidence they will work for our warfighters.”

    Spirent is actively engaged with several alternative RF navigation technologies and technology providers to incorporate signal simulation capability. To learn more, contact Spirent Federal to discuss fielded configurations.

    A U.S. Marine Corps radio operator grounds an during long-range HF radio training in Kuwait Oct. 7, 2020. (Photo: U.S. Marine Corps/Capt. Joshua Hays)
    A U.S. Marine Corps radio operator grounds an during long-range HF radio training in Kuwait Oct. 7, 2020. (Photo: U.S. Marine Corps/Capt. Joshua Hays)

    Collaboration with Xona Space Systems

    Spirent Federal Systems also announced that it is collaborating with Xona Space Systems to develop simulation and test capabilities for Xona signals produced by small satellites (smallsats) operating in low Earth orbit (LEO). Xona is a San Mateo-based startup developing a smallsat constellation for a dedicated PNT service.

    Xona’s patent-pending approach using small satellites in LEO is intended to improve global PNT resilience and accuracy by both enhancing GNSS and operating as an independent system. Xona’s high-power signals utilize advanced signal structure and security techniques, improving jamming and spoofing resistance as well as multipath mitigation.

    “We do all we can to protect, toughen, and augment PNT and are eager to work with emerging companies like Xona who are developing a next-gen navigation and timing architecture,” said Jennifer Smith, senior director of Business Development at Spirent Federal. “Our simulators provide critical support to developers and integrators by enabling testing and validation before the product deploys.”

    The space and defense sectors also benefit from Spirent Federal’s expertise in generating high fidelity RF signals using quadrature (I/Q) data. Spirent test tools allow the full customization of I/Q data. Customers can generate unique I/Q data corresponding to experimental modulation schemes and use Spirent Federal’s signal generation capabilities to create the corresponding RF.  Such rapid prototyping allows for quick turnaround times and shorter iteration cycles.

    Alternatively, scenarios created using Spirent Federal’s proprietary SimGEN software can be saved as I/Q data which can be processed by software-implemented receivers.

    “Building a new generation of satellite navigation and timing services goes far beyond just the satellites,” said Brian Manning, CEO of Xona Space Systems. “It requires building an entire ecosystem from ground stations to chipset manufacturers to end users and systems integrators. Having reliable and trusted simulation capabilities is critical to support all of these areas which is why we are thrilled to be working with Spirent to provide a robust solution to our partners.” 

  • PGE selects assured PNT clocks for smart-grid infrastructure

    PGE selects assured PNT clocks for smart-grid infrastructure

    ADVA’s aPNT platform is key for the development of PGE’s critical network infrastructure (Photo: Business Wire)
    ADVA’s aPNT platform is key for the development of PGE’s critical network infrastructure (Photo: Business Wire)

    Portland General Electric (PGE) is deploying Oscilloquartz PTP grandmaster clock technology as it upgrades to packet-based synchronization and protects its network against GNSS vulnerabilities and cyberattacks. The upgrades also conform to PNT Executive Order 13905.

    PGE, one of the largest power utilities in the Western United States, is using the ADVA scalable timing solution to enable a smooth transition from legacy synchronization and ensure new levels of accuracy, reliability and resiliency. The new system will  timestamp data and control grid substations at the edge.

    With multi-band GNSS receivers and artificial-intelligence (AI) threat detection, ADVA’s assured PNT (A-PNT) platform helps maintain resilient timing, even in challenging circumstances such as deliberate jamming and spoofing attacks. It also provides multi-source backup, including PTP network timing and in-device holdover oscillators for when GNSS signals are unavailable or disrupted.

    The solution is built on the OSA 5410 and OSA OSA 5420 series of edgeSync+ grandmaster clocks. It features multi-band, multi-constellation GNSS receivers and supports multiple PTP profiles, including substation power and core telecom backup sync, while also allowing conversion between them and supporting legacy interfaces.

    The products are part of ADVA’s new aPNT platform, integrating threat detection, multi-source backup and ADVA’s intelligent Ensemble Sync Director.

  • Orolia GNSS simulators now support ultra-low latency of 5 ms

    Orolia GNSS simulators now support ultra-low latency of 5 ms

    Latest advancement from Skydel uses software-defined advantages to deliver real-time performance

    The Skydel Real-Time Performance graphs illustrate the software-defined engine’s low latency during a GNSS simulation. (Screenshot: Orolia)
    The Skydel Real-Time Performance graphs illustrate the software-defined engine’s low latency during a GNSS simulation. (Screenshot: Orolia)

    Orolia has announced the launch of its Real-Time Performance capability, which achieves an ultra-low latency of five milliseconds. The feature will be standard on all Skydel-powered GNSS simulators.

    Skydel is a software-defined simulation engine that powers Orolia’s advanced GNSS simulators including its BroadSim (available via Orolia Defense & Security) and GSG product lines.

    “Skydel is known by users for its intuitive nature and ability to be quickly redeployed for a variety of projects,” said Tim Erbes, director of engineering for Orolia Defense & Security. “Delivering Real-Time Performance with latency as low as five milliseconds further shows that Orolia is a market leader empowering our customers by exceeding their expectations.”

    Skydel’s software-defined architecture is designed to meet the demanding GNSS simulation testing requirements in the automotive, military, space and other high-tech industries. Skydel also supports hardware-in-the-loop simulations without sacrificing ultra-low latency and high-end performance.

    The user interface has a sophisticated dashboard showing Real-Time Performance graphs. The tool enables users to grade the simulator’s performance, interpret data, diagnose inefficiencies, and optimize scenarios on the fly. In a video tutorial, Orolia demonstrates how the simulation engine processes data and how easy it is to read the graphs through its visualization and precise indications. As the system reaches its limits, it remains stable and fully operational, preserving the integrity of the simulation.

    Erbes said the Real-Time Performance graphs not only instill confidence in the simulator, but also allow for better integration in the testbed.

    “For example, instead of just hoping their hardware-in-the-loop configuration is working, users can view the real-time data and see that low latency is being maintained,” he said. “This feature provides enhanced visibility not only into the performance of the simulation, but also into the reliability of the hardware-in-the-loop integration, resulting in a more robust solution. This is critical when generating complex environments with high dynamics, jamming, spoofing, repeating, and alternative PNT sensors.”