GPS spoofing it's about time, not just position

GPS spoofing it's about time, not just position

Speakers: Ken Munro

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=wSVdfOn737o

Overview

Ken Munro's DEF CON 32 talk, "GPS spoofing it's about time, not just position," delves into the critical, yet often overlooked, vulnerability of Global Navigation Satellite System (GNSS), specifically GPS, to spoofing attacks, with a particular emphasis on the manipulation of time signals rather than merely positional data. Munro, a seasoned red teamer and penetration tester with extensive experience in the aviation sector, highlights how such attacks pose a significant threat to aircraft navigation and safety, especially as the industry increasingly relies on GPS while simultaneously retiring older, more resilient navigation aids.

The presentation serves not as a definitive answer but as a call to action, aiming to stimulate interest and further research into the complex interplay of GPS, time synchronization, and aviation security. Munro underscores the profound implications of GPS spoofing, extending beyond aviation to other critical infrastructure sectors like financial services and industrial control systems, all of which depend on the precise timing information provided by GNSS. His unique perspective, combining deep cybersecurity expertise with practical piloting experience, grounds the technical discussion in real-world operational realities and potential safety hazards.

Background

▶ Watch: Introduction to GPS spoofing and aviation safety (0:00)

The aviation industry, renowned for its safety record, achieves this through rigorous incident analysis and a culture of transparent, blame-free reporting. This ethos of learning from failures is central to Munro's approach to cybersecurity in aviation. He stresses the paramount importance of responsible and ethical vulnerability disclosure within this domain, contrasting it sharply with the rapid disclosure timelines (e.g., 90-day Google Project Zero style) often seen in other tech sectors. Due to stringent certification requirements and the inherent safety-critical nature of aircraft systems, patching vulnerabilities in aviation can take up to "a couple of years," making immediate public disclosure highly irresponsible. Furthermore, Munro debunks common misconceptions, such as the feasibility of hacking aircraft systems from passenger seat-back screens, emphasizing that aircraft networks are strictly segregated to prevent such lateral movement.

Munro provides a foundational review of traditional aviation navigation systems, which have historically provided layers of redundancy:

• Non-Directional Beacons (NDB): These are among the earliest "steam-powered" navigation aids, providing a simple cockpit indicator that points towards the beacon. NDBs boast a very long range, following the curvature of the Earth, making them ideal for remote locations like northern Canada. However, they suffer from significant weaknesses, notably pointing towards thunderstorms in instrument meteorological conditions, potentially leading pilots astray. Despite their age, NDBs still serve as markers or locators for Instrument Landing Systems (ILS).
• VHF Omnidirectional Range (VOR): Emerging around 1947, VORs represented a significant advance over NDBs. They are unaffected by thunderstorms, easier to use, and more accurate, providing directional information. VORs are typically found at airway intersections, guiding aircraft along established routes. Unlike NDBs, VORs are line-of-sight systems and do not provide altitude information. Their high maintenance costs and the advent of GPS have led to their gradual retirement, particularly those off main airway routes.
• Distance Measuring Equipment (DME): Operating like a "submarine ping," DME calculates distance by measuring the time of flight between a transmitted signal and its received response. It is highly accurate and commonly used during ILS approaches to verify an aircraft's precise distance from the runway.
• Instrument Landing System (ILS): These ground-based radio systems, comprising a localizer and glideslope, provide incredibly precise horizontal and vertical guidance for aircraft approaching a runway. ILS enables landings in extremely poor visibility conditions, known as Cat 3C, where the aircraft can land safely with the aid of a radio altimeter, even in complete fog.
• Inertial Reference Systems (IRS): Historically, aircraft like the Boeing 707 relied on navigators using sextants for celestial sightings. Modern IRS, initially gyro-based (like on Concorde) and now often laser-based, use highly accurate accelerometers and gyroscopes to track an aircraft's position relative to a known starting point. While phenomenal—achieving an accuracy of as little as one nautical mile off position on a 3,000-nautical-mile flight from London to New York—IRS alone is not precise enough for the final approach and landing phases.

The increasing accuracy and cost-effectiveness of GPS have led to the retirement of many traditional navigation aids. However, this growing reliance on a single system, particularly one susceptible to spoofing, introduces new vulnerabilities that demand careful consideration.

Key Findings

▶ Watch: The terrifying Courchevel Altiport and its unique challenges (2:00)

Munro's primary finding is that GPS spoofing is not a theoretical threat but a practical and "pretty straightforward" attack vector, requiring surprisingly little power—"a few watts will do it"—due to the inherently weak nature of the GPS signal received from satellites. The talk emphasizes that the critical element of GPS susceptible to manipulation is not just positional data, but crucially, time. GPS provides an extremely precise point in both space and time, and the integrity of this time signal is vital for numerous applications, especially in aviation.

He highlights that the impact of GPS spoofing appears to be "specific to some planes," suggesting that not all avionics systems react identically to manipulated signals. This specificity necessitates further research to understand the varying vulnerabilities across different aircraft models and their integrated navigation suites. A significant concern raised is the ongoing trend of retiring conventional navigation aids, such as VORs, due to their perceived redundancy and high maintenance costs. This widespread retirement, driven by the adoption of GPS, risks creating a dangerous single point of failure in the navigation infrastructure.

The speaker's core message is a call for the aviation industry to prioritize hybrid navigation systems. Such systems would leverage GPS for its accuracy and efficiency but cross-correlate its data with existing, independent ground-based navigation aids. This approach would provide a vital layer of redundancy and a means to validate the integrity of GPS signals, thereby mitigating the risks associated with spoofing attacks. The implications extend beyond aviation, as many other sectors, including financial services for high-frequency trading and various industrial control systems, also rely heavily on accurate GPS time, making them potentially vulnerable to similar spoofing scenarios.

Technical Deep Dive

▶ Watch: Why aviation is safe: blameless incident reporting (3:58)

The technical foundation of Munro's talk rests on understanding how GPS delivers both precise position and, more critically, precise time, and how this differs from preceding navigation technologies. GPS satellites transmit signals that contain highly accurate timing information. A receiver on Earth calculates its distance from multiple satellites by measuring the time difference between the signal's transmission and reception. By triangulating these distances from at least four satellites, the receiver can determine its precise three-dimensional position (latitude, longitude, altitude) and, simultaneously, synchronize its internal clock to GPS time with extraordinary accuracy.

This reliance on time is what makes GPS spoofing particularly insidious. An attacker doesn't necessarily need to move an aircraft's perceived position drastically; simply manipulating the time signal can disrupt systems that depend on precise synchronization. For instance, if an aircraft's internal clocks or navigation computers receive a spoofed time signal, it could lead to incorrect calculations of speed, distance, or even trigger erroneous warnings or system failures.

To appreciate the significance of GPS, it's crucial to contrast it with the older systems:

• NDBs transmit continuous, non-directional signals. An aircraft's Automatic Direction Finder (ADF) points towards the NDB, providing only a relative bearing. While long-range and following Earth's curvature, their susceptibility to atmospheric interference (e.g., thunderstorms) makes them unreliable for precise navigation in adverse conditions.
• VORs provide more sophisticated directional information. A VOR ground station transmits two signals: an omnidirectional reference phase and a variable phase that rotates. An aircraft's VOR receiver measures the phase difference between these two signals to determine its magnetic bearing relative to the station. This offers more accuracy than NDBs but is limited by line-of-sight transmission, meaning signals cannot penetrate terrain or curvature of the Earth effectively. VORs do not provide altitude or distance information directly.
• DME works by sending an interrogation pulse from the aircraft to a ground station, which then transmits a reply pulse. The aircraft's receiver measures the time delay between interrogation and reply to calculate the slant range distance to the station. DME is highly accurate for distance but provides no directional or altitude data independently.
• ILS is a highly specialized system for precision approaches. The localizer transmits two overlapping radio beams that provide horizontal guidance to the runway centerline. The glideslope similarly provides vertical guidance. By flying in the narrow overlap region, pilots can accurately align the aircraft for landing, even in zero visibility (Cat 3C). ILS is incredibly precise but is only available for a specific runway and approach direction.
• Inertial Reference Systems (IRS) represent a different paradigm, being entirely self-contained. They use a system of gyroscopes and accelerometers to continuously track the aircraft's motion from a known starting point. Modern IRS, utilizing laser-based gyros, are incredibly accurate for long-distance navigation, capable of maintaining position to within one nautical mile over a 3,000-nautical-mile flight. However, their accuracy drifts over time, and they lack the absolute positioning capability of GPS, making them unsuitable for the final, precise phases of flight like landing without external updates.

The move towards GPS was driven by its superior accuracy, global coverage, and ability to provide a precise point in space and time continuously, making older, more expensive-to-maintain systems seem redundant. However, this transition, particularly the retirement of these "steam-powered" aids, erodes the inherent redundancy that characterized aviation navigation for decades. A successful GPS spoofing attack, especially one that manipulates the time component, could lead to cascading failures in systems relying on that precise timing, without immediately appearing as a positional discrepancy. The weak signal strength of GPS makes it vulnerable to relatively low-power, localized spoofing devices, posing a significant challenge to its integrity.

Demo / Proof of Concept

▶ Watch: Ethical vulnerability disclosure and slow fixes in aviation (4:10)

Ken Munro's talk at DEF CON 32 did not include a live demonstration or a detailed proof of concept of GPS spoofing. As he explicitly stated, he is "not going to give answers" but rather aims to "stimulate... interest in the space." He referenced "a series of incidents that I've been told about, that have been published, some haven't," implying that the discussion is based on observed or reported real-world occurrences and potential vulnerabilities rather than a direct, hands-on exploitation scenario presented by the speaker himself. His objective was to highlight the existence and implications of GPS spoofing, particularly concerning its time component, without providing specific methods or tools for replication.

Defensive Implications

▶ Watch: Understanding early aviation navigation: NDB, VOR, DME (4:50)

The insights shared by Ken Munro underscore several critical defensive implications for the aviation industry and other sectors reliant on GPS:

• Implement Hybrid Navigation Systems: The most crucial defensive strategy proposed is the adoption of hybrid navigation. This involves using GPS as the primary navigation source but continuously correlating its data with independent, ground-based systems like VORs, DMEs, and ILS. By cross-checking GPS-derived position and time against these known, resilient sources, discrepancies indicative of spoofing can be detected. This requires a strategic re-evaluation of the ongoing retirement of traditional navigation aids. Munro warns against getting "too excited" about retiring all "steam powered navigation aids," as they are essential for this hybrid approach.
• Maintain Redundancy of Traditional Nav Aids: The ongoing trend of decommissioning VORs and other ground-based navigation systems needs careful reconsideration. These systems, while less precise than GPS, offer crucial resilience against GPS outages or spoofing. Maintaining a robust network of these traditional aids provides an invaluable fallback and a means for verification, ensuring that the aviation system doesn't become overly reliant on a single, potentially vulnerable technology.
• Strengthen GPS Signal Authentication and Integrity: While not explicitly detailed in the talk, the underlying need for stronger authentication and integrity mechanisms for GPS signals is implied. Research into military-grade GPS (like M-code) or enhanced commercial services that offer greater spoofing resistance could be explored for critical applications.
• Prioritize Responsible Vulnerability Disclosure: Given the safety-critical nature of aviation systems and the lengthy certification and patching cycles (which can take "a couple of years"), ethical and responsible disclosure practices are paramount. Researchers must engage with manufacturers and regulators, providing sufficient time for vulnerabilities to be addressed safely and thoroughly, rather than publicizing flaws immediately.
• Enhanced Pilot Training and Situational Awareness: Pilots remain the ultimate safeguard. Training must emphasize recognizing the signs of navigation system anomalies, including potential GPS spoofing, and the procedures for reverting to alternative navigation methods or cross-referencing information from multiple sources. The talk acknowledges that "there's always someone in control up front" who is "paid to fly safely."
• Cross-Industry Awareness and Collaboration: The threat of GPS time spoofing extends beyond aviation to other critical sectors such as financial services (for high-frequency trading) and industrial control systems. These industries must also assess their reliance on GPS time and implement similar defensive strategies, including redundancy and validation mechanisms, to protect against potential disruptions.
• Continuous Research and Development: Munro explicitly calls for "more research" into how GPS spoofing affects "some planes" specifically. This highlights the need for ongoing investigation into the specific vulnerabilities of different avionics architectures and how to develop more robust, spoofing-resistant systems and protocols. Understanding how maintenance procedures can become "much less disruptive" for such incidents is also a key area for improvement.

Key Takeaways

• GPS spoofing is a significant threat to aviation, with time manipulation being a critical, often overlooked, vector. Attackers can disrupt precise timing mechanisms with relatively low power, impacting critical systems beyond just positional data.
• Over-reliance on GPS and the retirement of traditional navigation aids create a dangerous single point of failure. The aviation industry's move away from redundant "steam-powered" systems like VORs and NDBs reduces overall resilience against spoofing and outages.
• Hybrid navigation, combining GPS with ground-based systems, is the recommended mitigation strategy. Continuously cross-checking GPS data against independent, robust systems provides a crucial layer of verification and redundancy.
• Responsible vulnerability disclosure is essential in aviation due to long certification and patching cycles. Unlike other tech sectors, addressing vulnerabilities in aircraft can take years, necessitating careful coordination with manufacturers and regulators.
• The implications of GPS time spoofing extend beyond aviation to other critical infrastructure. Financial services and industrial control systems, which rely on precise GPS timing, are also vulnerable and should adopt similar defensive postures.
• More research is needed into specific aircraft vulnerabilities and improving maintenance procedures for spoofing incidents. Understanding how different avionics systems react and streamlining response protocols will enhance overall safety and resilience.

About the Speaker(s)

Ken Munro is a highly experienced cybersecurity professional with a deep specialization in aviation. He is a red teamer and penetration tester, having founded his own pen testing firm in 2002. His work frequently involves conducting "vanilla research" on retired aircraft, allowing him to gain invaluable insights into both legacy and modern aviation systems, including collision avoidance systems, instrument landing systems, and electronic flight bags. Munro has advised several airlines and manufacturers, maintaining strong relationships with industry giants such as Boeing.

Beyond his professional work, Munro is an avid general aviation pilot, albeit humorously self-deprecating about his flying skills, recounting incidents like landing at the wrong airport or experiencing engine failure. His personal flying experience includes piloting a Piper Cherokee 6, learning to fly old Russian airliners in Eastern Europe, and navigating multi-engine aircraft, including a memorable and challenging flight into Courchevel Altiport with its unique 20-degree angled runway. While he is not a commercial pilot or a self-proclaimed GPS expert, his extensive knowledge of aircraft navigation systems, cockpit resource management, and the human factors in aviation incidents provides a unique and practical perspective on cybersecurity threats in this critical domain. He is a strong advocate for the aviation industry's culture of blame-free incident reporting, which he believes is key to its safety record.