Today, it is possible to spoof a GPS receiver to any arbitrary location. Check out the video we created to demonstrate how trivial it is to spoof GPS signals today! The increasing availability of low-cost radio hardware platforms make it feasible to execute such attacks with less than few hundred dollars worth of hardware equipment.
SPREE is the first commercially off the shelf, single-antenna, receiver capable of detecting even strong GPS spoofing attacks. SPREE does not rely on GPS signal authentication and therefore can be used to detect both civilian and military GPS spoofing attacks. SPREE is designed to be standalone and does not depend on other hardware such as antennas, additional sensors or alternative sources of location information (like maps or inertial navigation systems).
In SPREE, we introduce a novel spoofing detection technique called auxiliary peak tracking that limits even a strong attacker (e.g., seamless takeover) from being able to move (spoof) a receiver to any arbitrary location or time. We leverage the presence of authentic signals in addition to the attacker's signals to detect spoofing attacks. Our receiver design consists of two key components: (i) Auxiliary Peak Tracker (APT) and (ii) Navigation Message Inspector (NAVI) module. First, we describe the auxiliary peak tracking module, a novel countermeasure which plays a vital role in constraining even a strong attacker capable of a seamless lock takeover. The key feature of APT is that it acquires and tracks not only the strongest received satellite signal but also the weaker signals that may be present in the environment. Second, we introduce a navigation message inspector (NAVI) which inspects the decoded contents of the navigation message from every satellite and reports any discrepancies. We show that NAVI is capable of detecting attackers who modify the contents of the navigation message. The Auxiliary Peak Tracker protects SPREE from attackers who are not synchronized (non-coherent) to the legitimate GPS signals currently being received and the Navigation Message Inspector prevents attackers from modifying the contents of the navigation message. The combination of auxiliary peak tracking and the navigation message inspector enables SPREE to detect all types of spoofing attacks reliably.
Yes, we released not only our modifications but also the raw GPS signal traces including some of our own spoofing traces that we used to evaluate SPREE to the community for further research and development. You can download the technical paper here. The source code is on bitbucket with all the instructions you might need. And for the test datasets, send us an email and we will promptly send you the download link.
This work was partially supported by the Zurich Information Security and Privacy Center (ZISC). SPREE is based on GNSS-SDR and we would like to thank the authors of GNSS-SDR for their support.
Feel free to email us with any questions or clarifications. We will be glad to help you out.