recommended reading

Researcher reveals GPS vulnerabilities

GPS timing signals that control the base stations in some cellular networks and other gadgets the size of small refrigerators that power the smart electric grid can fall prey to sophisticated spoofing attacks, according to a University of Texas researcher.

Todd Humphreys, an assistant professor at the University of Texas Radionavigation Laboratory, said he successfully spoofed a type of laboratory time reference receiver of the code division multiple access -- network technology Sprint and Verizon use that relies on GPS time -- with a transmitter he built for about $1,000.

Humphreys spoke in Washington last week during a meeting of an advisory board of the multi-agency Space Based Position, Timing and Navigation National Executive Committee.

In an interview, Humphreys said this spoof, which took about an hour, literally dragged the time of the reference receiver backward, inducing a 10-microsecond delay in an hour that could incapacitate the base stations that Sprint and Verizon use.

He also spoofed a type of timing receiver that provides precise signals to synchrophasors, which measure voltages and currents at diverse locations on a power grid so operators can assess the state of the electrical system. Humphreys said in less than an hour he degraded the timing signal so it sent spurious signals.

The North American SynchroPhasor Initiative, a partnership of the Energy Department and the North American Electric Reliability Corp., plans to install synchrophasors in power systems nationwide to help manage the smart grid; in turn the grid will use communications systems to manage distribution of power from generator to home or office.

The CDMA base stations and synchrophasors both use civil GPS timing receivers, which do not have built-in anti-spoofing protection, Humphreys said, noting only the GPS receivers the military uses have the ability to detect and frustrate spoofing attacks.

A spoofing attack against synchrophasors today would not bring down the power system, but Humphreys said, "it would make the smart grid less smart." Attacks against multiple cellular base stations in any city could shut down the network, he added.

Alison Silverstein, project manager for the North American SynchroPhasor Initiative, said her organization was well aware of the vulnerabilities of GPS and has redundant systems in place today, including a supervisory control and a data acquisition system, in case of spoofing attacks. She said her group wants to develop data check and validation methods to ensure the integrity of the information it uses to help run the grid.

"It's not within our capabilities to protect GPS" against spoofing, Silverstein said, adding, "I hope someone is working on it."

Logan Scott, a systems and signal processing consultant in Fort Collins, Colo., said the best way to prevent spoofing is to include data authentication in the civil GPS signal, which requires it be incorporated in satellite signals before they are launched. Scott said this could be done at "almost no cost," and said he suggested that civil signal authentication be incorporated in new GPS satellites in 2006 -- a recommendation that went nowhere.

Humphreys said the need to protect against spoofing becomes more important as the cost of gear drops, making it more attractive to those looking to wreak havoc.

Threatwatch Alert

Password cracking

Researcher Discovers Way to Pilfer McDonald's Users' Passwords

See threatwatch report

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • It’s Time for the Federal Government to Embrace Wireless and Mobility

    The United States has turned a corner on the adoption of mobile phones, tablets and other smart devices, outpacing traditional desktop and laptop sales by a wide margin. This issue brief discusses the state of wireless and mobility in federal government and outlines why now is the time to embrace these technologies in government.

    Download
  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

    Download
  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

    Download
  • Going Agile:Revolutionizing Federal Digital Services Delivery

    Here’s one indication that times have changed: Harriet Tubman is going to be the next face of the twenty dollar bill. Another sign of change? The way in which the federal government arrived at that decision.

    Download
  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

    Download
  • The New IP: Moving Government Agencies Toward the Network of The Future

    Federal IT managers are looking to modernize legacy network infrastructures that are taxed by growing demands from mobile devices, video, vast amounts of data, and more. This issue brief discusses the federal government network landscape, as well as market, financial force drivers for network modernization.

    Download

When you download a report, your information may be shared with the underwriters of that document.