Spoofing on the high seas

Spoofing is the name given to taking over a boat or plane by gaining control of the vessel’s GPS and making it think that it’s somewhere it is not. Recently, a research team from a Texas university successfully spoofed a 213ft superyacht using a custom-made GPS device.

Led by assistant professor Todd Humphreys of the Department of Aerospace Engineering and Engineering Mechanics at the Cockrell School of Engineering, the team was able to successfully spoof the $80 million private yacht using the world’s first openly acknowledged GPS spoofing device.

The purpose of the experiment was to measure the difficulty of carrying out a spoofing attack at sea and to determine how easily sensors in the ship’s command room could identify the threat.

"With 90 per cent of the world’s freight moving across the seas and a great deal of the world’s human transportation going across the skies, we have to gain a better understanding of the broader implications of GPS spoofing," Humphreys said. "I didn’t know, until we performed this experiment, just how possible it is to spoof a marine vessel and how difficult it is to detect this attack."

In June, the team was invited aboard the yacht, called the White Rose of Drachs, while it travelled from Monaco to Rhodes. The experiment took place about 30 miles off the coast of Italy as the yacht sailed in international waters.

From the White Rose’s upper deck, graduate students Jahshan Bhatti and Ken Pesyna broadcasted a faint ensemble of civil GPS signals from their spoofing device -- a blue box about the size of a briefcase -- toward the ship’s two GPS antennas. The team’s counterfeit signals slowly overpowered the authentic GPS signals until they ultimately obtained control of the ship’s navigation system.

Unlike GPS signal blocking or jamming, spoofing triggers no alarms on the ship’s navigation equipment. To the ship’s GPS devices, the team’s false signals were indistinguishable from authentic signals, allowing the spoofing attack to happen covertly.

Chandra Bhat, director of the Center for Transportation Research at The University of Texas at Austin, believes that the experiment highlights the vulnerability of the transportation sector to such attacks.

"The surprising ease with which Todd and his team were able to control a (multi-million) dollar yacht is evidence that we must invest much more in securing our transportation systems against potential spoofing," Bhat said.

It’s important for the public and policymakers to understand that spoofing poses a threat that has far-reaching implications for transportation, Humphreys said.

"This experiment is applicable to other semi-autonomous vehicles, such as aircraft, which are now operated, in part, by autopilot systems," Humphreys said. "We’ve got to put on our thinking caps and see what we can do to solve this threat quickly."