gps spoofing

5 Articles

A digital map is shown with a series of red waypoints making a roughly C-shaped curve. A smaller group of green waypoints stays stationary near one of the corners of the map.

Defeating Satellite Spoofing With Galileo’s Encryption

September 27, 2026 by 29 Comments

Considering how important it is for everything from navigation to keeping clocks in sync, satellite navigation systems are surprisingly vulnerable to a variety of attacks, ranging from simple jamming to more sophisticated spoofing attacks. This may be changing, though, as Galileo, Europe’s GNSS, recently demonstrated its first cryptographically-secured position fix under spoofing conditions.

Most GNSS systems, including GPS, have no verification measures to keep an adversary from transmitting a false signal at a higher power and hijacking a receiver; since GNSS signals are extremely weak by the time they reach the ground, this presents no great difficulty to a moderately well-equipped attacker.

Galileo’s Signal Authentication System (SAS) aims to fix this. The Galileo ground station pre-selects signal spreading codes, which it then encrypts with a regularly-changing secret key and publishes. A receiver which anticipates needing a verified signal can then download these encrypted codes ahead of time and store them. Galileo satellites then transmit on the E6-C pilot signal, and the receiver records the signal. After transmitting a message block, it then transmits the decryption key on a separate signal, which the receiver uses to recover the spreading codes. The receiver then correlates these spreading codes with the recorded signal to find the satellite’s pseudorange.

It’s a rather complicated system, but it works: earlier this month in Andøya, Norway, the annual Jammertest GNSS testing event took place. For one week, a wide range of organizations tested the resilience of their GNSS systems against various attacks, including jamming, delayed retransmission, and spoofing. Using five Galileo satellites, the European Space Agency was able to obtain a stable lock on their receiver even during spoofing.

In principle, this method could be extended to other GNSS systems. There’s certainly motivation to do so; very large-scale attacks have been demonstrated recently.

We Declare The Grandmaster Of Pokemon Go GPS Cheats

July 26, 2016 by 48 Comments

Since Pokemon Go blew up the world a couple of weeks ago we’ve been trying to catch ’em all. Not the Pokemon; we’ve been trying to collect all the hardware hacks, and in particular the most complete GPS spoofing hack. We are now ready to declare the first Grandmaster GPS spoofing hack for Pokemon Go. It broadcasts fake GPS signals to your phone allowing the player to “walk around” the real world using a gaming joystick.

Just about everything about this looks right to us. They’re transmitting radio signals and are doing the responsible thing by using an RF shield box that includes a GPS antenna. Hardware setup means popping the phone inside and hooking up the signal generator and GPS evaluation hardware. Google Earth then becomes the navigation interface — a joystick allows for live player movements, coordinates are converted to GPS signals which are transmitted inside of the box.

Now, we did say “just about right”. First off, that RF shielding box isn’t going to stop your fake GPS signals when you leave the lid open (done so they can get at the phone’s touchscreen). That can probably be forgiven for the prototype version, but it’s that accelerometer data that is a bigger question mark.

When we looked at the previous SDR-based RF spoofing and the Xcode GPS cheats for Pokemon Go there were a number of people leaving comments that Niantic, the devs responsible for Pokemon Go, will eventually realize you’re cheating because accelerometer data doesn’t match up to the amount of GPS movement going on. What do you think? Is this app sophisticated enough to pick up on this type of RF hacking?

Continue reading “We Declare The Grandmaster Of Pokemon Go GPS Cheats” →

Pokemon Go Cheat Fools GPS With Software Defined Radio

July 19, 2016 by 59 Comments

Using Xcode to spoof GPS locations in Pokemon Go (like we saw this morning) isn’t that much of a hack, and frankly, it’s not even a legit GPS spoof. After all, it’s not like we’re using an SDR to spoof the physical GPS signal to cheat Pokemon Go.

To [Stefan Kiese], this isn’t much more than an exercise. He’s not even playing Pokemon Go. To squeeze a usable GPS signal out of his HackRF One, a $300 Software Defined Radio, [Stefan] uses an external precision clock. This makes up for the insufficient calibration of the HackRF’s internal clock, although he points out that this might also be fixed entirely in software.

Continue reading “Pokemon Go Cheat Fools GPS With Software Defined Radio” →

Pokemon Go GPS Cheat (If You Don’t Fear Getting Banned)

July 19, 2016 by 75 Comments

Pokemon Go inherits a certain vulnerability to GPS location spoofing from it’s predecessor Ingress, but also the progress that has been made in spoof detection. Since taking advantage of a game’s underlying mechanisms is part of the winner’s game, why not hook up your smartphone to Xcode and see if you can beat Niantic this time? [Dave Conroy] shows you how to play back waypoints and activate your Pokemon Go warp drive.

Continue reading “Pokemon Go GPS Cheat (If You Don’t Fear Getting Banned)” →

Spoofing GPS And Getting Your Own UAV

July 1, 2012 by 92 Comments

A couple folks over at the Radionavigation Lab at UT Austin successfully spoofed GPS to take control of a small helicopter drone this weekend. Of course, this attracted the attention of the Department of Homeland security, so you’d better stock up on GPS spoofing equipment while there’s still time.

The DHS, CIA, and US Military have a huge interest in spoofing GPS; Iran stole a drone late last year using the same method. The UT Austin team used only about $1000 worth of equipment to take control of an autonomous drone and pilot it away under unauthorized control. Of course with matters of homeland security, the open-source hacker scene has yet to publish how this spoofing attack was actually done, but here’s a paper covering what is needed to remotely control up to four GPS-guided drones.

While waiting on the details of this build to be made public, feel free add your own insight in the comments as to how this attack was actually performed.