On the requirements for successful GPS spoofing attacks

TLDR

An increasing number of wireless applications rely on GPS signals for localization, navigation, and time synchronization, yet civilian GPS signals are vulnerable to spoofing attacks that mislead receivers into false locations. The study investigates the conditions under which GPS spoofing attacks succeed, including the attacker’s required transmission location, signal precision, and the feasibility of satellite‑lock takeover after initial legitimate lock. We use a civilian GPS signal generator to conduct experiments that determine the minimal signal precision needed for covert satellite‑lock takeover. The experiments show that any number of receivers can be spoofed to a single arbitrary location, but spoofing a group while preserving the constellation limits the attacker to only a few transmission sites and requires high signal precision.

Abstract

An increasing number of wireless applications rely on GPS signals for localization, navigation, and time synchronization. However, civilian GPS signals are known to be susceptible to spoofing attacks which make GPS receivers in range believe that they reside at locations different than their real physical locations. In this paper, we investigate the requirements for successful GPS spoofing attacks on individuals and groups of victims with civilian or military GPS receivers. In particular, we are interested in identifying from which locations and with which precision the attacker needs to generate its signals in order to successfully spoof the receivers. We will show, for example, that any number of receivers can easily be spoofed to one arbitrary location; however, the attacker is restricted to only few transmission locations when spoofing a group of receivers while preserving their constellation. In addition, we investigate the practical aspects of a satellite-lock takeover, in which a victim receives spoofed signals after first being locked on to legitimate GPS signals. Using a civilian GPS signal generator, we perform a set of experiments and find the minimal precision of the attacker's spoofing signals required for covert satellite-lock takeover.