Bigger WTF is why critical systems still use unencrypted gps signal. It is like using plain SMTP emails for banking transactions, and relying on "sender" for authentification.

▲

themafia 2 hours ago | parent | next [-]

They're falling back to the C/A (coarse, civilian) signal. Part of the attack is to drown out the frequency where the P (fine, military) signal is so they can more easily attack the civilian signal.

There's another frequency they could be using that is higher power but hasn't been put into production yet.

▲

stavros 2 hours ago | parent | prev [-]

An even bigger WTF is why GPS data isn't signed with some official key so spoofing is impossible.

▲

15155 2 hours ago | parent | next [-]

Because an attacker can just replay legitimate broadcasts with slightly skewed time and origin and introduce huge errors into the fix.

▲

stavros 2 hours ago | parent [-]

Just because we can't solve all current problems doesn't mean we shouldn't solve any current problems.

If you want to prevent replaying as well, add a counter.

	▲	stinkbeetle 2 hours ago \| parent [-]
		> Just because we can't solve all current problems doesn't mean we shouldn't solve any current problems. Obviously not, but solving problems is always a cost benefit and we went from all spoofing is impossible to some spoofing is possible. What is the benefit of doing this and what is the cost? > If you want to prevent replaying as well, add a counter. It's not clear that would be able to prevent spoofing if the attacker could overwhelm and degrade the real signal.

▲

tatjam 2 hours ago | parent | prev | next [-]

Galileo already contains this function for the navigation message via OSNMA, and GPS CHIMERA is soon to be operational, with the latter actually including crytographic "signatures" in the spreading code itself, so if you use these two constellations you become really harder to spoof.

Of course, they dont protect against jamming.

▲

stinkbeetle 2 hours ago | parent | prev [-]

Why would that make spoofing impossible?

▲

stavros 2 hours ago | parent [-]

Because attackers wouldn't be able to send legitimate-looking data to GPS receivers any more.

▲

stinkbeetle 2 hours ago | parent [-]

Yes that's what spoofing is, but why wouldn't they be able to?

(EDIT: I see the other reply thread is already asking the same thing, didn't intend to ask about the same thing)

	▲	stavros an hour ago \| parent [-]
		Because, due to how cryptography works, nobody other than the entity holding the signing key (ie the one that deployed the satellites) can produce valid signatures for that key.