matthew ahrens* December, 12th, 2014

Transcription

1 G P S A N D W I R E L E S S S I G N A L J A M M I N G : AT TA C K S A N D D E F E N S E S matthew ahrens* December, 12th, 2014 contents 1 Introduction History of GPS What is the need for security of GPS? How GPS Works Attacks Signal Jamming Signal Spoofing Examples: University of Texas Examples: Carnegie Mellon Defenses Detection Prevention GPS Alternatives Conclusion 10 For Comp116, Intro. to Computer Security, with Prof. Ming Chow * Department of Computer Science, Tufts University, Medford, MA 1

2 introduction 2 1 introduction 1.1 History of GPS GPS, Global Positioning System, is a type of Global Navigation Satellite System 1 that currently consists of 27 satellites that orbit around fixed points on the earth. Originally designed for military use, GPS was not used for commercial and civilian applications until early 1980s.[Glo14] In 2000, the U.S. government disabled the GPS protocol selective availability. This feature was the intentional degradation of quality for specific uses of GPS in some regions. Selective availability was implemented originally as a security measure against malicious use of tracking.[gov14a] The user benefits of turning selective availability off are obvious, higher accuracy for civilian applications. 1.2 What is the need for security of GPS? Government programs are moving forward with three new dedicated civilian layers of GPS signal.[gov14b] They include: L2C: A 1227 MHz signal for civilian needs at military accuracy or better L1C: A 1575 MHz signal for the interoperability of GPS with other GNSS systems for urban use L5: A 1176MHz signal for use on dedicated life safety systems such as transit, commercial aircraft, and emergency transport In analyzing precursory information about these signal bands, security is only mentioned once in protecting the L1C signal translation between US GPS systems and EU systems like Galileo 2 from normal urban noise. There is no mention of even the possibility of malicious attacks. The description of L5 is the most interesting in the scope of security. Added control measures by the Department of Defense are being added. These measures are to 1 Abbv. GNSS 2 Galileo is the European GPS equivalent run by civilians for general use.

3 introduction 3 insure that from the new wave of GPS satellites, to the control stations, communication is robust and redundant.[od14] The definition of what a healthy data set looks like shows a continuous integrated approach by the DoD, the air force, and the USDOT to collaborate for a higher quality of service 3. The bigger question is What about security? Currently there are little to no guarantees that any aspect of the GPS protocol can guarantee correctness at the level of the consuming client. Given the wide variety of GPS client manufacturers, how do you assure quality is maintained in the face of malious attacks, not just common noise and interference. One of the inherit benefits of putting life safety systems on their own band is less interference and higher QoS for these integral systems. But, by signaling them out, it becomes easier for attackers to target critical systems while going undetected since other GPS enabled systems would show no symptoms. Also, unlike their military counterparts, the authentication mechanisms for civilian GPS bands are unencrypted. This leaves them open to vulnerabilities and attacks. In order to understand how these attacks against critical clients would work, we will look at how GPS trasmission and reception works, and how security is more difficult with GPS than other wireless systems. 1.3 How GPS Works Client GPS systems receive signals from a collection of the 27 satellites that fly in medium Earth orbit. Using tuples of signal from any three (but typically for or more for accuracy) satellites the client can use trilateration to find the Latitudinal and Longitudinal intersection around three fixed points, giving a precise location on the Earths surface. The signal data contains a payload of an atomic timestamp, the location of the satellite, and optionally a checksum. Since radio waves travel near the speed of light when ignoring interference, clients use the timestamp to calculate the distance of the satellite. If the checksum is implemented client side, and the current GPS satellite supports it, then the quality that the signal is not malformed due to noise is insured. Checksum can then be thought of as proving the integrity of the signal; however, it does not insure the authenticity of the 3 These agencies are working together on the open standard for this band and the L2C band.

4 attacks 4 signal. Generally, client systems treat any signal that correctly forms to the NMEA 4 standard as being authentic and from an approved source satellite or otherwise. How these client systems tell satellites apart from one another is through their coarse acquisition code 5. This code is a pseudorandom number stream that is unique to that satellite and is public. There is no guarantees on verifying that a signal broadcasted with a specific C/A code originated from that satellite.[nld + 12] GPS is similar to its wireless brethren WiMax 6 In this way where the physical layer is unencrypted and unauthenticated by design.[mb08] 2 attacks There are two major types of attacks that have been commonly used in the past. Signal Jamming is the transmission of noise over the GPS frequency band which acts as a Denial-of-Service 7 attack against the clients. Signal Spoofing is transmitting false data using a satellite s C/A code to cause clients to make incorrect pseudo ranges or other estimates of where the satellite is currently. The threat model is growing as more robust attack services are being made. Building on these two attack vectors, researchers have been able to make attack systems that can affect the control layer 8 that are inexpensive to construct and are hard to find the origin of or trace. 2.1 Signal Jamming Jamming is very simplistic of an attack. Like WiFi, WiMax, and cellular signals such as 3G and 4G, GPS is susceptible to noise and interference. Unlike these signals, the size of the data packet is known and the rhythm in which synchronization data is also known by definition. Blanket jamming attackers, where an attack outputs noise on the GPS frequency band is the 4 National Marine Electronics Associationhttp:// 5 Abbv. C/A code 6 Known as the IEEE standard 7 abbv. DoS 8 The intermediate layer that guarantees communication between satellites and major stations.

5 attacks 5 common and simple version of this attack. This attack comes at a grave risk to attackers, as it is easy to trace a spaming signal and is highly illegal. As signal Jamming is a very disruptive attack to life systems such as police and medical transport, as well as large commercial systems such as transit and airports, the FCC has made it explicitly illegal to buy, sell, market, or operate jamming equipment.[fcc14] The rhythmic nature of GPS allows attackers focusing on jammer attacks to be sneakier than those trying to avoid police radar or disable wifi. Because GPS clients need to sync against a satellites C/A code and then calculate the offset in time to find position, an attacker needs to only spam signals during the time when the code is broadcasted, and not block out every GPS transmission. Secondly, since there is no feedback from GPS clients, a jammer can be very far away from the clients it is attacking and cover a large area easily. For the casual, accidental attack, such as the employee trying to obfuscate his location from his employeer[mat13], a small jammer running off of the auxiliary of a 12 volt battery can disrupt the operation of a service such as an air traffic control tower from a major road more than two-thousand feet away. While this attack is just a crude example that most networks are susceptible too, more insidious attacks that are harder to trace and have more detrimental effects exist. 2.2 Signal Spoofing One of the major problems of GPS clients is that they treat well-formed input as trusted source. This is equivalent to trusting that well-formed text input from a client application does not contain malicious values such as with code injection or cross-site scripting. Traditional spoofing attacks can attack one of two systems that clients take from GPS signal input. They can attack the clock or they can attack the position. Attacking either will induce error in the core functionality of the client, the pseudorange for the satellite will be incorrect. If the time is attacked, then the cycles the client must shift in order to calculate distance will be wrong. The position will simply be referenced to an incorrect value of the position is spoofed. Spoofing the position is

6 attacks 6 easier to detect and correct for, a correct position will overwrite an incorrect one as position history would typically not be kept in the calculation. By attacking the time, though, the client s history of input from the satellite will be off and take many cycles to correct if it gets corrected at all. Simple attacks use GPS simulators, which are commercial devices used to test the performance of GPS receivers. Simulators generate the L1 signal using either default data, or the user can upload the specification of a signal in a standard format, e.g., Spirent uses NMEA. The main purpose of simulators is offline testing. Simulators for a constellation of satellites typically cost several thousand dollars. In 2002 researchers rented a simulator, added an amplifier, and showed that nearby receivers would lock onto the signal.[nld + 12] 2.3 Examples: University of Texas In a more sophisticated attack, researchers from Todd Humphreys lab at University of Texas showed that buy spoofing civilian GPS signals 9, they were able to convince the ship to change course and that it was in vital danger i.e. trick it into thinking its altitude was under sea level.[neu13] The tests showed that this spoofing signal worked from as far as thirty kilometers away. So, while casual users are deterred by aforementioned US laws and penalties for repeat offense in blocking signals where the likelihood of being caught is high one time attackers looking to overtake specific systems for only a few attacks can easily falsify the system, gain control, and be harder to trace. 2.4 Examples: Carnegie Mellon In showing the viability of organized, sophisticated attacks while still being easy and inexpensive, Researchers from Carnegie Mellon sought to make a Phase-coherent Signal Synthesizer to perform stealthy spoofing-like attacks 9 Specifically the L1 band

7 defenses 7 Figure 1: Carnegie Mellon s DSP diagram for the functionality of their Phasecoherent Signal Synthesizer against the civilain GPS band. Using a standard DSP pipeline, they build a robust signal processor and producer for under $2,500 USD which they say is comparible to a high-end laptop and all parts are available to the general public. This device works by receiving legitmate signals broadcasted from GPS satellites and syntheses new GPS signals with the injected payloads in real time. If a target is defined, then the device can account for the delay relaying the signal would add and account for it in the navigation payload, thus cloaking its location of origin which preserves the attacker and makes the signal s authenticity more believable which mitigates defenses. [NLD + 12] These experiments show in great detail how attacking a GPS can have large detrimental affects, and as we sanction out bands it is likely to become attractive to integrate the data from GPS signals such as positioning and atomic time into core systems of other devices. As we embedded GPS into phones, cars, trains, plains, medical transport, and other things where guarantee of delivery and robustness are the assurances we are given, we are leaving ourselves open to a new line of vulnerabilities up the chain. 3 defenses The simpler versions of these attacks can be easily mitaged if client GPS systems become wary of the origins of their signal input. Much like with Web programming, GPS client programmers need to sanitize input. This is harder since it is very simple to see malformed textual input that harbores

8 defenses 8 malicious code, but GPS signal input must already adhere to a data protocol. Statistical and Differential techniques can be used to mitigate jamming and spoofing, and these techniques fall into the two categories common to most security applications: Detection and Prevention. 3.1 Detection On the client level and more easy to adopt GPS should borrow from some of the approaches of security of Wireless Sensor Networks 10 and use the fact that GPS systems are typically embedded as a stength and not a weakness. Much like Wireless Sensor Networks do periodic history authenitcation using a base station or some other localization [PVC09], GPS systems could network together to verify the authenticity. Several GPS devices could communicate with eachother through some other transmission medium (TCP/IP, RF, etc.) that has its own encryption, authentication, or other handshaking. They can then share notes and compare signals received for a given satellite s C/A code. If a device has a significant amount of signal history that does not agree with the results of its correspondence, it: Has detected an attack Can begin defending, reporting, or otherwise trying to mitigate that attack If communication to networked devices is unavailable or dangerous i.e. behind enemy lines or in other time of crisis then the quality of the data signal should be scrutinized in real time by its frequency, its offset, and its predictability. Given the current location, and the basic acceleration reading of any cheap sensor, a device should be able to predict its next location with some small margin of error. By doing online calculation of where it thinks the satelite should be given some assumed valid past data, if an attacker tries to inject into the system, it could easily be noticed as an outlier. This fails though, as attacks such as the ones researched by Carnegie Mellon become more sophisticated and minimize difference. This also fails if the 10 abbv. WSNs

9 defenses 9 area is already compromised by fake signals, but is still better than trusting the input as valid by default. 3.2 Prevention 3.3 GPS Alternatives At a systemic level, the best way to detect (and prevent) jammers and spoofers would be to add encryption to the C/A code much like the military GPS signals already have. Other prevention measures that do not include detection first must mean that data is supplemented from other positioning sources Local Positioning Systems Specifically in the cases of urban and suburban GPS security of transit and medical systems, there is an abundance of freely broadcasted data that can be used to prevent attacks from succeeding. A GPS client now is typically a full stack application with access to an OS, hardrive, and other nicities that allow it to interact with a broader array of sensors. Similar to how the accelerometer detection would work online, the GPS client could take in BSSID data hardware mac addresses of nearby wifi (and 3G/4G cell towers) and associate it with some location either by supervised input or GPS automation if the data at that time is assumed to be valid. The client could then do a localized 2D trilateration inbetween GPS signals to confirm within some strong confidence that the GPS data is accurate. The assumptions made here are that: Wifi routers are not likely to change position Wifi routers are not likely to appear / disappear In these cases, where any given household or corporate office in a densly populated area is producing and consuming broadcasted wifi signal, not only can locally positioning based off of wifi routers help authenticate validity of position, but also can provide faster and more accurate positioning than processing GPS data alone. The major drawback to this is that clients

10 conclusion 10 would need to collect data beforehand / offline before being able to use this feature, but two ways to overcompensate for that are (1) to trust GPS data is valid the first time in an area and collect data at that step or (2) communicate with other networked devices and share data in order to not recompute / store rundundant information where you would also need to trust the validity of that data. Many major carriers and mapping providers e.g. Google, Apple already do this and it is proven effective in general at providing reliable, valid data through mixed mode validation. 4 conclusion As GPS evolves into more specific, life critical applications both on the system side and the client side, we as developers need to think about how to mitigate the risks and potential for attacks by not blindly trusting the input just because it is well-formed. As we have seen, even though a signal can conform the standard set by NMEA and adhere to the robustness of the three new Civil bands for GPS, research has shone that GPS is one of the most suseptible wireless data protocols out there for civilians due to lack of encryption, authentication, and the increasing ability to stealthily jam and spoof signals. We have presented some mitigation and detection techniques that we hope to see in future commericial standards that take advantage of the fact that GPSes being embedded in smarter systems should be more resilliant, not more compromisable. references [FCC14] The FCC. Jammer Enforcement fcc encyclopedia, [Glo14] Mio Global. History of gps, [Gov14a] U.S. Government. Gps, [Gov14b] U.S. Government. New Civil Signals modernization, 2014.

11 references 11 [Mat13] Chris Matuszczyk. Truck driver has gps jammer, accidentally jams newark airport, [MB08] Siddharth Maru and Timothy X Brown. Denial of service vulnerabilities in the protocol. In Proceedings of the 4th Annual International Conference on Wireless Internet, WICON 08, pages 37:1 37:9, ICST, Brussels, Belgium, Belgium, ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering). [Neu13] Peter G. Neumann. Risks to the public. SIGSOFT Softw. Eng. Notes, 38(6):21 28, November [NLD + 12] Tyler Nighswander, Brent Ledvina, Jonathan Diamond, Robert Brumley, and David Brumley. Gps software attacks. In Proceedings of the 2012 ACM Conference on Computer and Communications Security, CCS 12, pages , New York, NY, USA, ACM. [od14] Department of Defense. Dod announces start of civil navigation message broadcasting, [PVC09] Josep Paradells, Jordi Vilaseca, and Jordi Casademont. Improving security applications using indoor location systems on wireless sensor networks. In Proceedings of the International Conference on Advances in Computing, Communication and Control, ICAC3 09, pages , New York, NY, USA, ACM.