Monday, November 4, 2024
HomeCyber Security NewsGPS spoofing Attack that Trigger Fake turn-by-turn Navigation and Guide You to...

GPS spoofing Attack that Trigger Fake turn-by-turn Navigation and Guide You to Ghost Location

Published on

Malware protection

GPS spoofing Attack allows an attacker to manipulate the road navigation systems by spoofing the GPS inputs. GPS systems used by billions of people around the world relying on mobile devices today.

GPS-dependent applications are ever-increasing and it is becoming an attractive target for hackers.

Researchers from Virginia Tech University shows how a $223 device can spoof GPS signals that trigger the fake turn-by-turn navigation to guide the victim to a wrong destination without being noticed.

- Advertisement - SIEM as a Service

The GPS spoofing attacks are critical as the navigation systems are actively used by
billions of drivers on the road and play a key role in autonomous vehicles.

Four Step GPS spoofing Attack

Researchers derived a four-step attack method to show how the hackers can manipulate the road navigation systems.

A Portable GPS Spoofer worth 223 US Dollars, that includes HackRF, a Raspberry Pi, a portable power source and an antenna.

For measurement, they derived two possible methods that attackers can manipulate the GPS signals.

Placing spoofer in the victim’s car

Researchers started testing by placing the spoofer in the victim’s car and by having XIAOMI MIX2 with Android 8.0 in the dashboard as a GPS device. With this attack, the take over time from the trunk is 48 seconds and from the backseat 35 seconds.

Two different cars

By placing the spoofer and GPS device in two different cars the take over time 41.2 seconds and the effective spoofing range is 40–50 meters.

“To further examine the sustainability of the signal lock-in, we fix the location of the spoofer’s car and let the victim’s car drive in circles (about 10 mph) while keeping
a distance for 15 meters. After driving non-stop for 15 minutes, we did not observe any disconnections, which confirms the sustainability.”

Searching Algorithm

Researchers derived a stealthy algorithm that crafts the GPS inputs to the target device such that the triggered navigation instruction and displayed routes on the map remain consistent with the physical road network.

Real-world Test

The algorithm implemented for real-world scenarios, according to the driving tests on the road confirm the attack feasibility.

“We conduct a user study to demonstrate the attack feasibility with human drivers in the loop. The results provide key insights into how common driving habits make users vulnerable.”

“Researchers said our attacks is more suitable to run in the cities where the road networks are dense. We use the maps of Manhattan(NY) and Boston(MA). To examine the attack performance we randomly select 600 real-world taxi trips. Our attack success rate is (95%).”

More technical details can be found in the paper “All Your GPS Are Belong To Us:
Towards the Stealthy Manipulation of Road Navigation Systems” published by researchers.

Also Read

Three Critical Attack Flaw Discover Against LTE Networks Standard that Hijack Network Connections.

Most Important Consideration for Industrial Control System(ICS) Cyber Defense.

Thermanator Attack – Attackers can Steal Password and PINs Typed on Keyboards by Reading Thermal Residue.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...