GPS 'Spoofing' Could Threaten National Security

Oct. 2, 2008 -- Computers have been hacked for decades. But now, scientists at Cornell University and Virginia Tech are now warning about the dangers of "spoofing," or hacking into the Global Positioning System (GPS) that controls everything from car navigation to national power grids.

"The average person doesn't realize how much infrastructure is based on GPS and how vulnerable it is," said Brent Ledvina of Virginia Tech, who helped build a spoofer to show weaknesses in the system. "But the truth is that a lot can be done about these vulnerabilities."

A GPS receiver detects signals from about 30 orbiting satellites. Based on the time it takes for the signal to reach the receiver and the direction it came from, the receiver can triangulate an exact time and place, down to hundreds of nanoseconds, according to Ledvina.

The easiest way to mess with a GPS device is simply to jam it, or create a false GPS signal that overpowers the real GPS signal. In this case, the victim would know about the sabotage right away; often the GPS receiver simply doesn't work.

The second, more sinister, method is called spoofing. In spoofing, the intended target doesn't know that the signal received from a GPS unit is wrong: A spoofer creates a false GPS signal that passes as a real GPS signal, and an incorrect time or location appears on the intended receiver.

Related Content:

"It looks exactly like a real GPS signal," said Ledvina. "Everything looks completely normal, but the spoofer is controlling your position in time and space."

Being a couple microseconds off of the real time might not sound like a big deal to the average consumer with a GPS car navigation system, but GPS has spread far beyond what its creators envisioned in the 1970s.

Being even 10 microseconds off could cause power generators, some of which use GPS signals to sync electrical grids to power stations, to explode, said Ledvina. Air traffic controllers use GPS to help avoid plane collisions. Banks time-stamp financial transactions using GPS. Police attach GPS receivers to criminals to monitor their activities.

At its worst, successfully spoofing a GPS receiver could mean plane crashes and exploding generators. A more likely scenario, said Paul Kintner of Cornell University, is less disastrous but still illicit -- people could falsify their geographic or chronological position to avoid house arrest or authorities, for instance.

"Apparently fisherman are required to carry a GPS monitoring unit and already have made crude attempts at spoofing," said Kintner. "There are likely more examples of where people do not want to be tracked that would gladly pay for a spoofer."