More on the danger of GPS spoofing

coming from the device, because it is the clearest source (receivers are programmed to look for the clearest signal, to avoid problems related to clouds and other weather-related obstructions). At that point, when the receiver has “learned” to “trust” the transmitter, the transmitting device could begin modifying transmissions, altering the signals little by little until the target receiver shows any time and position the attacker chooses. Kintner says that an attacker could use fake GPS signals to disrupt the power grid, potentially causing power spikes and even damaging generators. The same trick could let criminals under house arrest move around freely, he adds.

Richard Langley, a professor in the Department of Geodesy and Geomatics at the University of New Brunswick, in Canada, who has worked extensively with GPS, says that this potential weak spot in the technology has, in fact, been known for years, although little has been done to date to protect the civilian system against it. “You would think that more would have been developed by now,” he says, “but maybe it takes the demonstration that these guys have carried out to show how easily a GPS receiver can be spoofed.”

Langley notes that solutions are some distance away. Although the European navigation system — Galileo — will have the ability to send encrypted signals for civilian use, it is not scheduled to be fully operational until 2013. It would be possible to add encryption to the existing system, but Langley says that the likely cost and disruption make this an unlikely solution. The best bet in the near term, he says, is to add security features to normal GPS receivers.

One option would be to add more antennas to receivers. The attack relies on the fact that most consumer GPS receivers use just a single antenna to receive signals from multiple satellites. By adding multiple antennas, a normal receiver could recognize that the spoofed signals in fact come from only one source. Langley notes, though, that there would be a cost trade-off. “Manufacturers have to get a return on any investment they make in antispoofing technology,” he says.

Kintner says that manufacturers have time to respond before attacks become realistic, but he warns that countermeasures have to be introduced. “We live in a time where we’re really dependent on technology,” he says. “We need to understand how that makes us vulnerable.”

If the technology needed to make a GPS spoofing device is miniaturized, then handheld devices could be produced for about $1,000 each, Kintner warns. “My greatest fear is that someone will reduce it to the size of a cigarette pack, and the world will be flooded with these small devices at a fairly cheap price,” he says. “That would make GPS useless in a whole variety of circumstances.”