Skip to content

GPS System Integrity

Vlad Gostomelsky

GPS spoofing attacks against vehicle navigation and autonomous systems.

Summary

### The Architecture of Satellite Navigation At 00:00 and 01:30, Vlad Gostomelsky introduces the structural dependencies and vulnerabilities of Global Navigation Satellite Systems (GNSS), focusing on the United States GPS constellation. He explains how receivers calculate geographic coordinates and precise timing via time-of-flight trilateration from orbital atomic clocks. However, because civilian GPS L1 C/A signals transmit without cryptographic encryption or authentication, receivers inherently trust any broadcast that matches the expected radio frequency format.

### RF Jamming Mechanisms and Fleet Disruption At 03:08 and 06:10, Gostomelsky differentiates between jamming and spoofing attacks. Simple RF jamming floods the 1575.42 MHz frequency band with noise, causing immediate denial-of-service and forcing receivers into signal acquisition drift. He highlights how commercial drivers routinely deploy cheap "cigarette-lighter" jammers to evade company telematics and geofencing tracking, inadvertently blinding emergency services, cell tower timing synchronizers, and airport approach radars within a several-mile radius.

### SDR-Based Spoofing and Coordinated Manipulation At 09:14 and 12:16, the presentation examines sophisticated signal spoofing enabled by low-cost Software Defined Radios (such as HackRF and BladeRF) running open-source toolkits like `gps-sdr-sim`. Rather than knocking out signals, spoofers transmit mathematically coherent, slightly stronger satellite signals that gradually desynchronize the receiver's internal clock and manipulate reported coordinates without triggering loss-of-lock alarms.

### Maritime, Aviation, and Automotive Threat Vectors At 13:51 and 16:51, Gostomelsky reviews documented real-world attacks, including widespread GPS spoofing incidents in the Black Sea that caused dozens of commercial transport vessels to report positions miles inland. He illustrates how automotive telematics and semi-autonomous driving systems rely heavily on GPS for road navigation and speed limit data, demonstrating that falsified positioning can cause vehicles to execute unexpected lane maneuvers or misroute entirely.

### Mitigation Strategies and Hardened Receiver Design Concluding between 20:05 and 23:06, Gostomelsky outlines defensive countermeasures for GNSS-dependent systems. Effective mitigations include integrating multi-constellation receivers (incorporating Galileo and GLONASS), pairing satellite positioning with inertial dead reckoning (accelerometers and wheel tick sensors), monitoring automatic gain control (AGC) anomalies, and deploying Receiver Autonomous Integrity Monitoring (RAIM) algorithms to detect out-of-sequence pseudoranges.

(AI summary — Gemini 3.8 Flash)

Related talks

Wireless Village·28 min

  • DEF CON
  • Red Team
  • Date: Aug 2019
  • Location: Las Vegas

Kent Britain/WA5VJB

Care and feeding of Software Defined Radios We will cover the various kinds of antennas available to optimized your SDR radio for different types of spectrum monitoring. We will also explain why RF filters are necessa...

wirelessautomotivesdr+2