Categories: Cyber Security News

GPS spoofing Attack that Trigger Fake turn-by-turn Navigation and Guide You to Ghost Location

GPS spoofing Attack allows an attacker to manipulate the road navigation systems by spoofing the GPS inputs. GPS systems used by billions of people around the world relying on mobile devices today.

GPS-dependent applications are ever-increasing and it is becoming an attractive target for hackers.

Researchers from Virginia Tech University shows how a $223 device can spoof GPS signals that trigger the fake turn-by-turn navigation to guide the victim to a wrong destination without being noticed.

The GPS spoofing attacks are critical as the navigation systems are actively used by
billions of drivers on the road and play a key role in autonomous vehicles.

Four Step GPS spoofing Attack

Researchers derived a four-step attack method to show how the hackers can manipulate the road navigation systems.

A Portable GPS Spoofer worth 223 US Dollars, that includes HackRF, a Raspberry Pi, a portable power source and an antenna.

For measurement, they derived two possible methods that attackers can manipulate the GPS signals.

Placing spoofer in the victim’s car

Researchers started testing by placing the spoofer in the victim’s car and by having XIAOMI MIX2 with Android 8.0 in the dashboard as a GPS device. With this attack, the take over time from the trunk is 48 seconds and from the backseat 35 seconds.

Two different cars

By placing the spoofer and GPS device in two different cars the take over time 41.2 seconds and the effective spoofing range is 40–50 meters.

“To further examine the sustainability of the signal lock-in, we fix the location of the spoofer’s car and let the victim’s car drive in circles (about 10 mph) while keeping
a distance for 15 meters. After driving non-stop for 15 minutes, we did not observe any disconnections, which confirms the sustainability.”

Searching Algorithm

Researchers derived a stealthy algorithm that crafts the GPS inputs to the target device such that the triggered navigation instruction and displayed routes on the map remain consistent with the physical road network.

Real-world Test

The algorithm implemented for real-world scenarios, according to the driving tests on the road confirm the attack feasibility.

“We conduct a user study to demonstrate the attack feasibility with human drivers in the loop. The results provide key insights into how common driving habits make users vulnerable.”

“Researchers said our attacks is more suitable to run in the cities where the road networks are dense. We use the maps of Manhattan(NY) and Boston(MA). To examine the attack performance we randomly select 600 real-world taxi trips. Our attack success rate is (95%).”

More technical details can be found in the paper “All Your GPS Are Belong To Us:
Towards the Stealthy Manipulation of Road Navigation Systems” published by researchers.

Also Read

Three Critical Attack Flaw Discover Against LTE Networks Standard that Hijack Network Connections.

Most Important Consideration for Industrial Control System(ICS) Cyber Defense.

Thermanator Attack – Attackers can Steal Password and PINs Typed on Keyboards by Reading Thermal Residue.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

11 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

11 hours ago

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…

14 hours ago

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities, including…

17 hours ago

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…

18 hours ago

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…

18 hours ago