A look at radio direction finding tools to help mitigate GNSS jamming/spoofing issues

A look at radio direction finding tools to help mitigate GNSS jamming/spoofing issues

Speakers: David Robinson, Kakaon

Conference: CrikeyCon

YouTube: https://www.youtube.com/watch?v=AJ5faf_5J0k

Overview

In an increasingly interconnected and digitally reliant world, the aviation industry faces growing threats to its fundamental navigation systems. David Robinson's talk at CrikeyCon, "A look at radio direction finding tools to help mitigate GNSS jamming/spoofing issues," critically examines the aviation sector's over-reliance on Global Navigation Satellite Systems (GNSS), commonly known as GPS, and the severe vulnerabilities this presents. Robinson, a security expert based in Wellington and organizer of Kakaon, highlights how easily and affordably these vital systems can be jammed or spoofed, leading to potentially catastrophic outcomes for both air traffic control (ATC) and pilots.

The presentation serves as a stark warning, detailing not only the current state of affairs where alternative navigation methods are being decommissioned, but also proposing a range of innovative and rediscovered technologies that can bolster aviation resilience. By exploring solutions like advanced radio direction finding, passive radar, and the re-implementation of robust systems like eLoran, Robinson advocates for a diversified, multi-layered approach to navigation. This article delves into the technical specifics of these threats and proposed countermeasures, emphasizing the urgent need for the industry to act before incidents are "written in blood."

Background

▶ Watch: Introduction to hostile radio navigation challenges (0:00)

Historically, aircraft navigation relied on a diverse set of methods, each with its own strengths and limitations. Dead reckoning, an early technique, involved calculating position based on speed, direction, and elapsed time, but failed to account for environmental factors like wind, making it unreliable, especially over vast oceans. Early radio-based systems, such as Automatic Direction Finding (ADF), VHF Omnidirectional Range (VOR), and Loran, provided more accurate positional data by triangulating signals from ground-based transmitters. However, these systems were costly to install, maintain, and calibrate, requiring extensive infrastructure. Their effectiveness was also limited over oceans due to the difficulty of placing fixed transmitters, leading to their gradual decommissioning in favor of more modern, seemingly cheaper alternatives.

Today, the vast majority of aircraft navigation is predicated on Global Navigation Satellite Systems (GNSS), which includes GPS (US), Glonass (Russia), BeiDou (China), and Galileo (Europe). These systems offer unparalleled accuracy and global coverage, leading to a significant reduction in the ground-based radio navigation infrastructure. The aviation industry, known for its slow adoption cycles due to stringent safety certifications, has largely standardized on GPS. Complementing GNSS are Inertial Navigation Systems (INS), internal to the aircraft, which use gyroscopes and accelerometers to track movement. While effective, INS systems are prone to drift, accumulating errors of approximately half to one nautical mile per hour. This drift can lead to significant navigational errors over long flights, as tragically exemplified by the 1979 Mount Erebus crash in Antarctica, where an incorrectly initialized INS led a sightseeing flight into a mountain. While GPS can be used to reset INS drift mid-flight, this solution becomes compromised if the GPS signal itself is unreliable. Instrument Landing Systems (ILS) provide precise radio guidance for landing at airports but are localized solutions.

Air traffic control (ATC) historically relied on primary radar, which uses spinning dishes to send out signals that bounce off aircraft, providing their location. However, primary radars are also being decommissioned due to cost, with New Zealand, for instance, having only two primary radars remaining, one of which has been intermittently offline for maintenance. ATC increasingly relies on aircraft-broadcasted location data, primarily through Automatic Dependent Surveillance-Broadcast (ADSB), which transmits an aircraft's position derived from its internal GNSS or INS. Additionally, Multilateration (MLAT) uses multiple ground receivers to calculate an aircraft's position based on the time difference of arrival of digital transponder signals. While MLAT offers an independent means of tracking, it requires expensive, low-latency links between base stations and has limited coverage, as seen in New Zealand where it's primarily confined to the Queenstown airport area. This widespread shift towards GNSS-dependent systems for both aircraft and ATC has created a critical single point of failure, leaving the entire aviation ecosystem vulnerable to radio frequency attacks.

Key Findings

▶ Watch: The growing threat of GPS jamming and spoofing (6:00)

The central discovery highlighted in the talk is the alarming vulnerability of the aviation industry to GNSS jamming and spoofing. David Robinson asserts that these attacks are not only increasingly prevalent but also remarkably easy and inexpensive to execute. Reports from regions such as Russia, Ukraine, Crimea, and Southeast Asia consistently show widespread GPS signal degradation and manipulation, forcing planes to fly less optimal routes, impacting fuel consumption, and in some cases, leading to the cessation of air services to certain airports and communities.

Aircraft systems are beginning to detect these anomalies through sudden, inexplicable jumps in reported location or significant shifts in time, sometimes by as much as 30 seconds to five minutes, indicating a compromised GNSS signal. Jamming, which involves broadcasting high levels of noise on relevant frequencies, is particularly straightforward because the legitimate GNSS signal, originating from satellites 20,000 km away, is inherently weak—often below the ambient noise floor. Spoofing, a more sophisticated attack, involves broadcasting a valid but false GNSS signal, tricking receivers into calculating an incorrect position or time. Robinson demonstrated in previous talks that basic GPS spoofing could be achieved with less than $500 worth of software-defined radio (SDR) kits, Raspberry Pis, and batteries, underscoring the low barrier to entry for adversaries.

This ease of attack, combined with the industry's increasing reliance on GNSS and the simultaneous decommissioning of traditional navigation aids like VORs and primary radars, creates a critical security gap. ATC's growing dependence on ADSB, which relies on the aircraft's own potentially compromised GNSS data, means that if a plane's navigation is spoofed, ATC may also be fed incorrect information. The talk concludes that a diversified approach to navigation, incorporating resilient and independent technologies, is not merely an enhancement but an urgent necessity to prevent future incidents.

Technical Deep Dive

▶ Watch: Direction finding as a mitigation technique (11:00)

The core of David Robinson's technical deep dive revolves around understanding the vulnerabilities of current aviation navigation and exploring alternative, more resilient technologies.

GNSS Vulnerabilities: Jamming vs. Spoofing

GNSS signals, such as those from GPS, Glonass, BeiDou, and Galileo, originate from satellites approximately 20,000 km away. The signal strength received on Earth is extremely weak, often below the ambient noise floor, making it highly susceptible to interference.

• Jamming involves broadcasting a powerful radio signal on the same frequencies used by GNSS. This noise simply overwhelms the weak satellite signals, preventing receivers from acquiring and processing them. The effect is a loss of position, navigation, and timing (PNT) data.
• Spoofing is more insidious. Instead of merely blocking the signal, a spoofer transmits a carefully crafted, legitimate-looking GNSS signal that appears to originate from the satellites but contains incorrect time or location data. This tricks the receiver into calculating a false position, potentially leading an aircraft off course without the pilot's immediate awareness. The speaker notes he demonstrated GPS spoofing with less than $500 worth of SDR equipment back in 2017.

The consequences of these attacks are severe, ranging from less optimal routes and increased fuel burn to the cessation of air services and, in the worst-case scenario, catastrophic accidents. The Korean Airlines flight 007 incident in 1983, where an INS-reliant aircraft strayed into Soviet airspace and was shot down, underscored the need for reliable, independent navigation, pushing the US to make GPS available for civilian use.

Proposed Resilient Navigation Technologies:

1. Direction Finding (DF):

Traditionally, direction finding involved large, directional antennas that were physically swept to determine the strongest signal bearing. Modern DF systems, such as the KrakenSDR, represent a significant advancement. This system utilizes five synchronized software-defined radios and five antennas arranged in a circular array. By analyzing the subtle differences in the arrival time and phase of a radio signal across these antennas, the KrakenSDR can precisely calculate the bearing to the signal source. The user interface displays a clear peak indicating the direction, and an accompanying Android app can plot these bearings on a map.

• Mechanism: The five antennas are optimally spaced based on the target frequency. The system's digital signal processing (DSP) applies complex mathematical algorithms to the received signals to derive a bearing.
• Advantages: Unlike MLAT, DF does not require a digital signal with clear bit transitions; it can track any emitted radio frequency, including analog audio, ADSB messages, or ACARS (Aircraft Communications Addressing and Reporting System) "text messages for pilots." Multiple DF sites can cross-reference bearings to triangulate a precise location. For aircraft, DF could enable navigation fixes from known ground-based transmitters like TV and radio towers, which are high-powered, difficult to hide, and maintained by third parties. For ATC, DF can track ADSB and Mode S transponder messages, or even pinpoint the source of hoax audio messages on ATC frequencies.
• Challenges: For optimal performance, a distinct array is required for each monitored frequency. Its utility is primarily over land and coastal areas where ground-based transmitters are present. For ATC, DF primarily works in the horizontal plane; a separate, vertically oriented array would be needed for altitude determination. While hobbyist kits are under $1,000, aviation-grade systems could cost $10,000 to $100,000 per site.

1. Passive Radar:

Unlike conventional primary radar, which actively transmits and receives signals, passive radar leverages existing ambient radio frequency transmissions (e.g., FM radio, TV broadcasts, cellular base stations).

• Mechanism: A passive radar system employs two synchronized radios (e.g., HackRF devices linked by a common clock). One radio continuously monitors the ambient RF spectrum to establish a baseline. The second radio detects reflections of these same ambient signals off moving objects like aircraft. As an aircraft flies through the radio waves, it reflects them, causing changes in wavelength (Doppler shift) and polarization. Sophisticated physics and mathematical processing of these changes allow the system to determine the aircraft's location, speed, and direction. The speaker uses the analogy of a police radar gun detecting speed via Doppler shift.
• Advantages for ATC: A single passive radar receiver can provide location, distance, and direction. It requires fewer radios (two) than DF (five) and capitalizes on existing, expensive broadcast infrastructure. Multiple passive radar sites and frequencies can be combined for enhanced accuracy.
• Challenges: A significant hurdle for passive radar is ITAR (International Traffic in Arms Regulations), which restricts the export of certain technologies. The KrakenSDR team, for instance, was compelled to remove their passive radar code from GitHub due to ITAR concerns, although other open-source implementations still exist.

1. eLoran:

Enhanced Long Range Navigation (eLoran) is a modern evolution of the legacy Loran system, which was decommissioned in many regions due to the advent of GPS.

• Mechanism: Similar to GPS, eLoran relies on a network of powerful ground-based transmitters that broadcast synchronized time signals. Receivers determine their position by measuring the time difference of arrival (TDOA) of these signals from multiple towers.
• Advantages: eLoran signals are significantly stronger than GNSS signals, making them much harder to jam or spoof. It offers a navigation accuracy of about 10 meters, sufficient for most en-route navigation but not for precision landing.
• Challenges: Despite US legislation in 2017-2018 mandating its re-implementation due to GNSS jamming incidents in areas like the Black Sea, progress has been slow. Its coverage is limited to approximately 1,200 km from the coast, though this addresses many areas where jamming is prevalent.

1. Terrain Fingerprinting:

This emerging technology, particularly relevant for drones and potentially future manned aircraft, uses visual data to ascertain position.

• Mechanism: Aircraft (or drones) equipped with cameras capture images of the terrain below. These images are then processed to create a unique "fingerprint" which is matched against a vast database of pre-existing terrain fingerprints (e.g., satellite imagery). By finding a match, the system can determine its precise location.
• Advantages: It is entirely independent of radio signals, making it immune to GNSS jamming or spoofing. It's particularly useful in "urban jungles" where GNSS signals suffer from reflections off buildings. Large-scale terrain manipulation to deceive such systems would be extremely difficult and noticeable.
• Challenges: Requires clear line of sight to the ground, limiting its use over clouds or the open ocean (which lacks distinctive features).

The talk underscores that while each of these technologies has its own strengths and weaknesses, a combination of them would provide a far more robust and resilient navigation capability than the current over-reliance on GNSS.

Demo / Proof of Concept

▶ Watch: Passive radar: A promising alternative navigation system (16:00)

While David Robinson's talk did not feature a live, interactive demonstration, he presented visual evidence and references to previous work to illustrate the functionality of the proposed technologies.

For Direction Finding (DF), the speaker showed a screenshot of the KrakenSDR user interface. This image clearly depicted a graphical representation of signal strength versus bearing, highlighting a distinct peak indicating the direction of a detected radio transmitter. He also mentioned an Android application that could plot these bearings directly onto a map, providing a visual proof of concept for real-time location tracking. The speaker further referenced his earlier talks from 2017, where he demonstrated the practical feasibility of GPS spoofing using readily available, low-cost hardware like software-defined radio kits, Raspberry Pis, and batteries, costing "less than $500." This serves as a powerful testament to the ease with which GNSS signals can be manipulated.

Regarding Passive Radar, Robinson presented a real-time image from such a system. The image displayed a radar-like plot, with a prominent bright line in the center representing the actual transmitter source. Crucially, the image also showed a smaller, distinct line (indicated by a red arrow) changing its position along the x-axis over time. This dynamic movement visually confirmed the system's ability to detect and track a moving aircraft by analyzing the reflections of ambient radio waves, providing a compelling demonstration of its operational capability.

These visual aids and references, though not live demos within the current talk, effectively served as proof of concept for the feasibility and utility of these alternative navigation and surveillance methods.

Defensive Implications

▶ Watch: Conclusion: The need for diverse navigation methods (23:00)

The increasing prevalence and ease of GNSS jamming and spoofing present critical defensive implications for the aviation industry. David Robinson's talk makes it clear that the current trajectory of decommissioning traditional navigation aids while becoming ever more reliant on GNSS creates a dangerous "Swiss cheese model" of vulnerabilities.

Defenders—including aviation regulators, airline manufacturers, component suppliers, and air traffic control organizations—must urgently pivot towards a strategy of diversified navigation. This means moving away from a near-total dependence on GNSS and actively re-implementing or adopting multiple, independent navigation and surveillance systems.

Key defensive actions include:

1. Re-evaluating the decommissioning of legacy systems: While expensive, systems like VOR and primary radar offer independent PNT data. A balanced approach might involve maintaining a core network of these systems, especially in critical or high-risk areas, rather than complete removal.
2. Investing in and deploying modern radio direction finding (DF) capabilities: ATC should deploy networks of advanced DF systems like the KrakenSDR to monitor ADSB, Mode S transponders, and even voice communications. This would provide an independent means of aircraft localization, especially when GNSS signals are compromised. The ability to quickly pinpoint the source of hoax messages also enhances operational security.
3. Exploring passive radar for independent surveillance: Given its ability to detect and track aircraft using existing ambient RF signals, passive radar offers a cost-effective and resilient surveillance layer. Addressing regulatory hurdles like ITAR for widespread adoption is crucial.
4. Advocating for the re-implementation of robust systems like eLoran: Policy makers and industry bodies should push for the actual deployment of eLoran, particularly in coastal regions where jamming is most common. Its strong, difficult-to-jam signal provides a vital backup for GNSS.
5. Encouraging research and development into novel, non-RF dependent navigation: Technologies like terrain fingerprinting, especially for drone operations in complex urban environments, offer a glimpse into future resilient navigation. While primarily for land-based operations, such innovations could find broader applications.
6. Implementing robust GNSS integrity monitoring on aircraft: While not a complete solution, aircraft systems must be capable of detecting GNSS anomalies (sudden jumps in position, time shifts) and alerting pilots, allowing them to switch to alternative navigation methods.
7. Establishing clear protocols for pilots and ATC during GNSS outages: Training and procedures must be in place to ensure safe operations when GNSS is unavailable or untrustworthy, leveraging any available alternative navigation sources.

Ultimately, the defensive strategy must embrace redundancy and diversity, ensuring that no single point of failure can cripple an aircraft's ability to navigate or ATC's ability to track it. The speaker's closing remarks emphasize the critical need for regulators and manufacturers to act proactively, "before it's written in blood."

Key Takeaways

• Critical Over-reliance on GNSS: The aviation industry's deep dependence on Global Navigation Satellite Systems (GNSS) like GPS for navigation and surveillance creates a dangerous single point of failure, exacerbated by the decommissioning of traditional ground-based aids.
• Prevalence and Ease of Jamming/Spoofing: GNSS signals are inherently weak and easily disrupted or manipulated through jamming (noise interference) or spoofing (broadcasting false signals) using inexpensive, readily available equipment, posing a significant and growing threat to aviation safety.
• Vulnerability of Current ATC Systems: Air Traffic Control's increasing reliance on aircraft-broadcasted ADSB data means that if an aircraft's GNSS is compromised, ATC may also be fed incorrect information, compromising their ability to safely manage air traffic.
• Emerging and Re-emerging Resilient Technologies: Promising alternatives exist, including modern radio Direction Finding (DF) systems (e.g., KrakenSDR), Passive Radar (leveraging ambient RF signals), the robust eLoran system (a stronger, harder-to-jam signal), and Terrain Fingerprinting for visual-based navigation, offering diverse and independent means of navigation and surveillance.
• Urgent Need for Diversification: A multi-layered, diversified approach to navigation, incorporating a combination of these resilient technologies, is crucial to mitigate the risks of GNSS attacks and enhance the overall safety and security of air travel, moving away from the "Swiss cheese model" of vulnerabilities.
• Call to Action for Industry and Regulators: Aviation regulators, manufacturers, and component suppliers must prioritize the implementation of these alternative navigation solutions to build resilience into the system, rather than waiting for catastrophic incidents to force change.

About the Speaker(s)

David Robinson, who presents this insightful talk, is a security professional based in Wellington, New Zealand. He is actively involved in the local cybersecurity community, notably as the organizer of Kakaon, a security conference. His background in security and his previous work on topics such as GPS spoofing (which he discussed in talks as early as 2017) position him as an expert on the vulnerabilities of navigation systems and the practical implications of radio frequency attacks.