Friday, March 29, 2024

GPS spoofing Attack that Trigger Fake turn-by-turn Navigation and Guide You to Ghost Location

GPS spoofing Attack allows an attacker to manipulate the road navigation systems by spoofing the GPS inputs. GPS systems used by billions of people around the world relying on mobile devices today.

GPS-dependent applications are ever-increasing and it is becoming an attractive target for hackers.

Researchers from Virginia Tech University shows how a $223 device can spoof GPS signals that trigger the fake turn-by-turn navigation to guide the victim to a wrong destination without being noticed.

The GPS spoofing attacks are critical as the navigation systems are actively used by
billions of drivers on the road and play a key role in autonomous vehicles.

Four Step GPS spoofing Attack

Researchers derived a four-step attack method to show how the hackers can manipulate the road navigation systems.

A Portable GPS Spoofer worth 223 US Dollars, that includes HackRF, a Raspberry Pi, a portable power source and an antenna.

For measurement, they derived two possible methods that attackers can manipulate the GPS signals.

Placing spoofer in the victim’s car

Researchers started testing by placing the spoofer in the victim’s car and by having XIAOMI MIX2 with Android 8.0 in the dashboard as a GPS device. With this attack, the take over time from the trunk is 48 seconds and from the backseat 35 seconds.

Two different cars

By placing the spoofer and GPS device in two different cars the take over time 41.2 seconds and the effective spoofing range is 40–50 meters.

“To further examine the sustainability of the signal lock-in, we fix the location of the spoofer’s car and let the victim’s car drive in circles (about 10 mph) while keeping
a distance for 15 meters. After driving non-stop for 15 minutes, we did not observe any disconnections, which confirms the sustainability.”

Searching Algorithm

Researchers derived a stealthy algorithm that crafts the GPS inputs to the target device such that the triggered navigation instruction and displayed routes on the map remain consistent with the physical road network.

Real-world Test

The algorithm implemented for real-world scenarios, according to the driving tests on the road confirm the attack feasibility.

“We conduct a user study to demonstrate the attack feasibility with human drivers in the loop. The results provide key insights into how common driving habits make users vulnerable.”

“Researchers said our attacks is more suitable to run in the cities where the road networks are dense. We use the maps of Manhattan(NY) and Boston(MA). To examine the attack performance we randomly select 600 real-world taxi trips. Our attack success rate is (95%).”

More technical details can be found in the paper “All Your GPS Are Belong To Us:
Towards the Stealthy Manipulation of Road Navigation Systems” published by researchers.

Also Read

Three Critical Attack Flaw Discover Against LTE Networks Standard that Hijack Network Connections.

Most Important Consideration for Industrial Control System(ICS) Cyber Defense.

Thermanator Attack – Attackers can Steal Password and PINs Typed on Keyboards by Reading Thermal Residue.

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles