Friday, March 29, 2024

GPS spoofing Attack that Trigger Fake turn-by-turn Navigation and Guide You to Ghost Location

GPS spoofing Attack allows an attacker to manipulate the road navigation systems by spoofing the GPS inputs. GPS systems used by billions of people around the world relying on mobile devices today.

GPS-dependent applications are ever-increasing and it is becoming an attractive target for hackers.

Researchers from Virginia Tech University shows how a $223 device can spoof GPS signals that trigger the fake turn-by-turn navigation to guide the victim to a wrong destination without being noticed.

The GPS spoofing attacks are critical as the navigation systems are actively used by
billions of drivers on the road and play a key role in autonomous vehicles.

Four Step GPS spoofing Attack

Researchers derived a four-step attack method to show how the hackers can manipulate the road navigation systems.

A Portable GPS Spoofer worth 223 US Dollars, that includes HackRF, a Raspberry Pi, a portable power source and an antenna.

For measurement, they derived two possible methods that attackers can manipulate the GPS signals.

Placing spoofer in the victim’s car

Researchers started testing by placing the spoofer in the victim’s car and by having XIAOMI MIX2 with Android 8.0 in the dashboard as a GPS device. With this attack, the take over time from the trunk is 48 seconds and from the backseat 35 seconds.

Two different cars

By placing the spoofer and GPS device in two different cars the take over time 41.2 seconds and the effective spoofing range is 40–50 meters.

“To further examine the sustainability of the signal lock-in, we fix the location of the spoofer’s car and let the victim’s car drive in circles (about 10 mph) while keeping
a distance for 15 meters. After driving non-stop for 15 minutes, we did not observe any disconnections, which confirms the sustainability.”

Searching Algorithm

Researchers derived a stealthy algorithm that crafts the GPS inputs to the target device such that the triggered navigation instruction and displayed routes on the map remain consistent with the physical road network.

Real-world Test

The algorithm implemented for real-world scenarios, according to the driving tests on the road confirm the attack feasibility.

“We conduct a user study to demonstrate the attack feasibility with human drivers in the loop. The results provide key insights into how common driving habits make users vulnerable.”

“Researchers said our attacks is more suitable to run in the cities where the road networks are dense. We use the maps of Manhattan(NY) and Boston(MA). To examine the attack performance we randomly select 600 real-world taxi trips. Our attack success rate is (95%).”

More technical details can be found in the paper “All Your GPS Are Belong To Us:
Towards the Stealthy Manipulation of Road Navigation Systems” published by researchers.

Also Read

Three Critical Attack Flaw Discover Against LTE Networks Standard that Hijack Network Connections.

Most Important Consideration for Industrial Control System(ICS) Cyber Defense.

Thermanator Attack – Attackers can Steal Password and PINs Typed on Keyboards by Reading Thermal Residue.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles