Legal Over the Air Spoofing of GNSS and its Effects - DEF CON 27 Car Hacking Village

Victor Murray from the Southwest Research Institute (SwRI) addresses the critical vulnerabilities of Global Navigation Satellite Systems (GNSS/GPS) used in autonomous ground vehicles, presenting a mobile testing methodology that complies with strict federal regulations. Murray notes that public GNSS signals lack cryptographic authentication and integrity protections, making them inherently susceptible to radio spoofing attacks.

[04:40] Murray explains the regulatory and legal challenges of GNSS security research in the United States, where over-the-air radio frequency (RF) spoofing or jamming of satellite navigation signals is illegal under federal law. To overcome this limitation without confining tests to indoor RF chambers, SwRI engineered a legal mobile GNSS spoofing apparatus. The system utilizes RF cabling, inline attenuators, and localized frequency translation boxes [09:07] placed between software-defined radios and the vehicle's onboard GPS receivers, enabling closed-loop, over-the-road vulnerability assessments on an operational Unmanned Ground Vehicle (UGV).

[13:39] The talk showcases live field demonstrations of dynamic spoofing attacks against the autonomous vehicle. Murray illustrates how manipulating satellite ephemeris data and time-of-flight signals induced severe navigation failures, including forced sudden lane departures, driving the UGV completely off the roadway, triggering emergency halts, and overriding path-planning algorithms. He concludes by emphasizing the urgent need for multi-sensor fusion—combining GNSS with LiDAR, radar, visual odometry, and inertial navigation systems (INS)—to detect and reject spoofed location telemetry in autonomous systems.

(AI summary — Gemini Flash)