GPS Spoofing

[United744]

GPS can show you to be anywhere, instantaneously. Airbus deal with this slightly differently as they at least had the sense to know that GPS can't shift position at Mach 20, which spoofing would cause, at least initially. Airbus aircraft now warn when this condition is encountered.

Boeing treat GPS differently. Seems they considered it too reliable, and don't even allow for it to be completely failed. That is a serious problem.

[ccapilot]

So, back to the original question, is it possible to add a "GPS INTERFERENCE" and a "GPS SPOOFING" scenarios to the list of external malfunctions?
That would be highly appreciated as it is something that we have to deal with very regularly nowadays. I hope this can be implemented, thanks

[Hardy Heinlin]

That would be a feature that requires more research regarding the system interactions, and that would be some work I can't do free of charge, unfortunately.

[Mawea]

Hi Hardy,
will spam/spoof you with info if you like, check your mail
Cheers

[Jeroen Hoppenbrouwers]

Older girls like the 744 don't really bother much with GPS jamming or spoofing. When jammed, the thing goes inop just as when it would fail or the antenna cable would break. It may also indicate reduced redundancy and therefore decreased accuracy, leading to dropping out of RNP. When spoofed, it warps to a new position and causes map shift. I am not sure whether the 744 uses GPS UTC time to adjust the captain's clock. If it does, stuff happens all over in terms of waypoint ETAs and other things and invalid CPDLC messages from the past or the future. But I would not touch this too much as we don't truly know what would happen.

So the simple effects could probably be variants of existing malfunctions. Or just be equated to these.

GPS failure not-severe/severe can be a good one.
Currently not-severe is GPS-L fails, severe is both GPS fail.
With nearly all logic concerning nav system priorities already in place, what would happen if GPS severe would include a chance of "GPS-R jumps to an airport within 250 nm and sticks there for the next 30 minutes"?

[Hardy Heinlin]

Indeed, for GPS jamming there is already a malfunction in the Nav section on the Malfunction pages. If you select "severe", both GPS units will fail.

If I were to add spoofing I would also have to implement another Instructor page for the design of spoofing patterns or fixed spoofing locations and some trigger conditions. It's obviously more complicated than a simple IRS map drift.

[Jeroen Hoppenbrouwers]

Yes and no. To simulate expected GPS spoofing/jamming in known areas, yes you would probably need to design something. The typical current pilot instruction is to disable GPS before getting close to that area, which on a bird like the 744 is painless.

To simulate unexpected GPS jamming, any current malfunction trigger would be fine. For any set training scenario I think there are plenty of ways to trigger a GPS jam around the same spot. I don't know whether many people would fly set scenarios without an instructor present and without peeking ahead what is going to happen?

GPS spoof options could be very complex, but you don't really want to offer all options known to mankind today. A good standard way to simulate a spoof is to do what probably the Israelis do: hard-lock every GPS around the country to Beirut airport at 20:00z on May 1st, or something. That is why I suggested a lock to the nearest airport.

Hoppie

[Tom Gorzenski]

GPS spoof options could be very complex, but you don't really want to offer all options known to mankind today. A good standard way to simulate a spoof is to do what probably the Israelis do: hard-lock every GPS around the country to Beirut airport at 20:00z on May 1st, or something. That is why I suggested a lock to the nearest airport.

That's exactly what I was hoping for.

[Jeroen Hoppenbrouwers]

The spoofers got better. They now can spoof the ephemeris tables, which ruins the system's awareness of where the satellites are, so even when the airplane leaves the spoofed area there will be significant effects that can linger for hours. I have seen many solutions pop up that detect spoofing by comparing GPS signals to other systems, such as IRS, or tracking position and speed and time to detect physically implausible changes. Most of these run on EFBs as avionics are extremely hard to give a new function due to certification requirements. Silly enough this means that the newer airplanes that have been GPS-native from design inception are the ones hit the hardest.

[Tom Gorzenski]

Fortunately, older planes like 744 or 767 do not suffer from GPS spoofing that much as e.g. 787 with its Hybrid IRS. But still a simple GPS spoofing scenario (malfunction), in addition to jamming (that can be easily simulated today with "severe GPS failure" in Malfunction/Nav menu), would be an interesting thing to have in the PSX, especially that it happens every day in e.g. NE part of Poland, over Baltic Sea, and in Middle East - please see:
https://gpswise.aero/map
Nothing fancy is suggested. Not to even mention really serious stuff like that one:
https://en.wikipedia.org/wiki/Iran%E2%80%93U.S._RQ-170_incident
https://theaviationist.com/2011/12/15/gps-spoofing/

[Tom Gorzenski]

I would suggest adding 'GPS Jamming/Spoofing' to Malfunctions/Nav, where 'Else' = jamming and 'Severe' = spoofing. In addition to items such as 'When airspeed is', 'When altitude is', 'When heading is', 'At distance to DEST', 'At simulated ATC', 'At random' and 'Manual Activation', there would be two additional ones:
'At distance to _____ equal or less than ____ NM', where one can select any airport and distance. Instead of selecting a specific airport, one can select 'Random' and a random airport along the 500 NM wide corridor aligned with the active route would be selected.
In case of jamming, both GPS fail to operate when within the selected distance from that airport but resume navigation when the aircraft leaves that zone.
In case of spoofing, both GPS report aircraft position at the selected airport location, and GS = 0, to their respective FMC, when within the selected distance from that airport but resume normal operations when the aircraft leaves that zone, or not (50% chance").

[Jeroen Hoppenbrouwers]

Would there be a delay between the two GPS units in their response to the jamming/spoofing being activated? If so, how many seconds?

[United744]

Would there be a delay between the two GPS units in their response to the jamming/spoofing being activated? If so, how many seconds?

Only processing time? They are receiving the same signals, so unless the spoofed signal just happened to hit one antenna and not the other (in terms of receiver sensitivity) then both would go mad at the same time. I can't imagine a scenario where only one receiver could be affected by a spoofing signal (AFAIK the receivers and software are identical).

If the hardware/software of the two receivers were different, then I could imagine a scenario where a targeted attack against the hardware/software is possible to compromise system integrity. I'm sure such experiments in this area are happening.

[Jeroen Hoppenbrouwers]

More about "which satellites are they listening to". This may be my Iridium background -- if I have four Iridium transceivers then it is not necessarily so that they all tune to the same satellite. I do see many seconds difference between them switching over, for example. If GPS always tries to use all satellites they hear, that would be different.

[IefCooreman]

Fortunately, older planes like 744 or 767 do not suffer from GPS spoofing that much as e.g. 787 with its Hybrid IRS. But still a simple GPS spoofing scenario (malfunction), in addition to jamming (that can be easily simulated today with "severe GPS failure" in Malfunction/Nav menu)

Well... "not that much" is still enough to be interesting if you go into the details.

Spoofing can alter the reference altitude used by the GPWS (you cannot deselect the separate internal GPS). Basically, the GPWS will end up shouting at you in cruise endlessly (terrain override required). Sometimes it will recover after the spoofing, sometimes not.

I'm not that familiar anymore with the 747, but on other fleets there are unpublished limitations to the takeoff TOGA position update. With GPS available, GPS position is used and no update is done on TOGA application. If GPS is de-activated, the FMC is supposed to do a "position reset" to the runway position. However in certain instances, that position update will not happen, and you risk taking off with a gigantic map shift.

(and ps no, gps L & R generally don't go out at the same time, a time lapse of 10...30 seconds seems realistic)

[Alex268]

We still experience spoofing and interfere on the -400. We also turn off GPS updating and Terrain Inhibit as we sometimes get "Caution Terrain" at FL400. Sometimes we get back both GPS's, sometimes only the left or Right, and sometimes none. Luckily we fly with engineers on-board and they reset the circuit breakers for the GPS L/R in flight, especially if we are proceeding towards certain NAT Tracks. When we get spoofed, especially flying over Iran, Jordan, Egypt and Turkey enroute, the GPS coordinates and distance can show sometimes over 100 nm in another direction. Sometimes the clock changes time and date on the FMC. GPS interference is different as you "lose" the GPS and they go blank on the POS page and if you have the POS button pressed on EFIS control panel, the GPS symbol (tie fighters) disappear. However, the scary part of spoofing is that you think you have the GPS back when you see them appear again in the CDU, but that's when you need to verify the coordinates, tracks and distances. Also good to use the POS button on the EFIS Control Panel as this will show dispaly raw data bearings to station etc. in the event of Map Shifts.

And with regards to the captains clock, the time itself doesn't change from what ive observed as close as a week ago. Just the time on the FMC, and the ETA's etc.

[Jeroen Hoppenbrouwers]

Yesterday I learned a lot more about all this and the scary part is that the weaponization has now extended to TCAS, ACARS, and ADS-B-IN. It won't bring you down, but it can create havoc on the flight deck (imagine 20 non-physically-limited TCAS intruders) which at a certain moment will lead operators to just avoid that whole area. Detours of 1000 nm may result.

GPS spoof and jam detection is now well possible but the big question still is: what to do when the electronics are sure you're being spoofed? Popup "GPS SPOOFING" is simple, but what then? Pilots want to know what to do. And this isn't trivially decided. Some airplanes can cope, others cannot. It's too late to avoid. What now? Oceanic ahead? Africa ahead? Etc.

[Hardy Heinlin]

IRS nav and greater traffic separation?

[Jeroen Hoppenbrouwers]

Some airplanes cannot simply go IRS any more. It is being retrofitted ... but this takes years.
Greater traffic separation means a lot of work for ATC. They usually can take one plane out of line, but not everybody at once.
Many ways of responding to known jamming or spoofing are available, but exactly what to do right now, is always a judgement question. In some narrow corridors with lots of traffic, ground beacons have been installed now... and there are FIRs where the controllers rely on FlightAware ADS-B to see their traffic ...

[andrej]

Some airplanes cannot simply go IRS any more. It is being retrofitted ... but this takes years.
Greater traffic separation means a lot of work for ATC. They usually can take one plane out of line, but not everybody at once.
Many ways of responding to known jamming or spoofing are available, but exactly what to do right now, is always a judgement question. In some narrow corridors with lots of traffic, ground beacons have been installed now... and there are FIRs where the controllers rely on FlightAware ADS-B to see their traffic ...

Hoppie,
what should I imagine under the "retrofit of IRS"? Meaning, that they are removing any link to GPS / hybrid-IRS systems and changing it to a pure "vanilla" IRS?

Isn't it ironic, well better now than never, that ground beacons are being installed again? On the other hand, how pragmatic and rational are all those that made the initial decision to remove ground beacons (I presume mainly VOR / NDBs) at the first place. I would think that from a strategic point of view, keeping minimum operational VORs is essential in any country.

Is it possible to jamm / spoof ADS-B signals as well? How about VORs / NDBs? If yes, then the industry has to rely on IRS navigation only.

So the industry "saved" money, just in order to waste it again, to re-invent the wheel.