Iran spy drone GPS hijack boasts: Rubbish, say experts

Rock the Casbah!

This entire drone loss/capture thing has been quite interesting

The U.S. are playing it down, whilst the Republican Guard use it as a mighty propaganda tool.

I wouldn't be surprised if the Iranians did cause it to crash with some sort of jamming device, they're a fairly canny bunch and quite self sufficient militarily.

Due to sanctions the Iranians have had to develop a lot of home brewed tech (A little like South Africa during the Apartheid / Sanctions era) however we know the Iranians do get more than a little help from the Russians and Chinese in respect to military technology, as long as it doesn't break the UN sanction laws.

Needless to say the Russians and Chinese are probably jumping up and down to get a look at the RQ-170 "if" it's genuine.

Looking at the drone on the video, it's hard to make out whether it's genuine or not, however a lot of sceptics claim that the drone on display is a fake. One comment I recall was it "looks like a carnival float"

One site I visited had extracted decent resolution pics from the HD video of the Iranians showing the drone off.

Notable observations were the fact that the wings swoop the wrong way, the video seemed to been filmed in a gym (wooden floors, high windows and small double doors in the video) and also that the top access panel seemed to have been "drawn with a sharpie" or marking pen as we know them.

But the most noted observation was the condition of the craft itself. Remarkably good indeed, although there was signs of scraping along the leading wing edges and tape on the wing joints, where some believe the wings may have been shorn off in the "crash", or perhaps removed to fit the RQ-170 into the building where it was filmed.

Lastly why did the Iranians go to such lengths to conceal the underside of their captured prize?

On the tech side, the RQ-170 is not a new aircraft, from what I've read it's been in use for a number of years, so it's not as if the Ayatollah's men are in possession of something that is blazing with the latest U.S. technology, or are the Pentagon trying to water down the importance of their drone?

.

Ofcourse its "rubbish"

Because if you say it isn't rubbish you're basically admitting "defeat" and we can't have that, can we?

Learned absolutely nothing here. Same as in Iraq and Afghanistan when locals (for crying out loud) shared stories how they managed to bring down aircrafts and helicopters. "Nonsense", the boffins said deeming it "impossible" and then the pictures came out.

The first situation (not ridiculing it right away) could have some negative effects (morale perhaps?) but then again most people and countries realize that they're not invincible nor immortal. So I'd say its neglectable.

The second scenario on the other hand seems much worse to me. Experts and such are totally convinced that the news is fake and use strong words to brush it all away. And then it turns out to be true.

Maybe I'm seeing things a bit too simplistic, but to me it makes those "experts" look like a bunch of idiots right then and there. And I'd immediately start to question every other thing coming out of their mouth.

Personally I think that scenario is much more damaging; it doesn't necessarily affect morale (perse) but sure puts dents in ones credibility. And sometimes that's just what you need to keep morale up.

"Experts"?

Uh-huh.

Translation: "Doubts that Iran managed to bring down an advanced US drone over the country last month using an advanced GPS spoofing attack have been injected into the mainstream media by US government-led propagandists, in a damage limitations exercise (a.k.a. the "war of perception").

Conspiracy theory?

Think again:

{quote}

A secret CIA report, brought to light last month by Wikileaks, reveals the cynical battle plans for the "war of perception" being waged over public opinion in Europe about NATO's war in Afghanistan. The four-page document is well worth reading, mainly to see exactly how cyncial the powers-that-be are when assessing the public.

The report's subheadings tell the story: 'Public Apathy Enables Leaders To Ignore Voters ... But Casulaties Could Precipitate Backlash', 'Tailoring Messaging Could Forestall of At Least Contain Backlash', 'Appeals by President Obama and Afghan Women Might Gain Traction'.

{/quote}

http://rabble.ca/blogs/bloggers/derrick/2010/04/wikileaks-cia-recommends-france-use-afghan-womens-rights-boost-war

And satellites are usually located *above* the aircraft

while spoofer transmitters are almost always (unless airborne) located below it. I suspect the drone's GPS antenna pattern is optimized for reception of satellites, rather than ground transmitters...

Trojan Drone

aka 21st century Trojan Horse.

http://en.wikipedia.org/wiki/Trojan_Horse

How it *might* be done.

For starters you'd need a radio base *above* the drone (It's GPS aerial/s are likely above the fuselage for best access to the sky). Note the receiver power levels (IIRC -160dBmw, that's about 2^53 below the reference power level) so "swamping" it from say a couple of Km above it is not going to take too much *real* power. Think car battery, not truck engine.

Switch on the jamming and cut off the drone from GPS reception.

Switch on the GPS simulator channels (You'll need at least 4 of them, on 2 channels) with a position *plausibly* close to where the drone thinks it is (from its internal IMU package) and start walking.

Note the initial data string, tap positions and shift register length for the military code have (AFAIK) *never* been published. It has been stated (in the USG design docs) that each satellite uses a different section (IE different point in the sequence) of the *same* code with the same taps. The code per satellite repeats over roughly 1 week at 10.24MHz and is roughly 1/10 of the full capacity of the shift register generator. You have to think in terms of early 1970s TTL chips. Calculating its likely length is none of my business.

The military code *can* be encrypted but I'm not sure how often it is (like Selective Availability for the C/A code it is *optional*). There is at least one paper in the open literature about it but the USG has never officially released it. Give how widespread GPS is the key is likely to be transmitted in the more frequently repeated parts of the 300 bit frames that make up the full 12.5min GPS data stream, allowing potential lock up in 6 secs rather than 12.5 (which is a *long* time in guided weapons).

With fast enough logic it might not even be necessary to have your own atomic clock. Use the *real* GPS stream to work out your position, calculate the numeric offsets needed to push your target in the right direction and re-encode for for the drone to receive it.

In an era of GHz logic a country with sufficient resources could get something like this made on a reasonable budget in the way the EFF finally built a DES cracker to *prove* once and for all DES was no longer secure. A fairly modest 2Ghz processor could run 200 instructions to process each bit sent.

Easier than just shooting it down or jamming the GPS and hoping it goes into some sort of emergency landing safe mode. No.

Within the financial and intellectual resources of a nation state with a substantial oil revenue. Definitely.

It was said no way could Afghanistani Jihadists read drone video (despite it not being encrypted). This proved incorrect.

Sun Tzu noted that those that show contempt for their enemies are likely to underestimate them until they ultimately loose.

Let's underestimate the opposition again!

So... By its own admission the US lost a spy drone over Iran.... but continues to make the Iranians out to be technologically incompetent despite their recognised successes in satellite launching, stem cell research etc etc.

Might be good enough for people who don't want to think, but it's not an attitude that will be very helpful going forwards.

What about Iran's BFF?

Russia.

" Moscow also wants to improve diplomatic and military ties with some of Iran’s rivals. The Russian Ministry of Defense is interested in purchasing sophisticated weapons from abroad that its arms industry either does not produce or produces poorly. IT HAS ALREADY BEGUN BUYING UNMANNED AERIAL VEHICLES FROM ISRAEL." (2010)

Just sayin'.

Can we stop the BS

So the CSM says "someone told us something" and some people say it's not true. Did the Iranians ever mention GPS spoofing? NO, how about the US? NO. All we have is someone claiming to have spoken to some Iranian dude in a pub.

The more important thing is China and Russia have ...

a working, almost undamaged drone with some of the most sophisticated sensors on board now sits in Tehran.

Regardless of whether a desk-bound pilot or some Russian jamming equipment brought it down, it is Iranian hands and will likely be made available to the highest bidder. Likely something to advance their nuclear ambitions.

I saw reports that over 30 drones have crashed in the past two years which demonstrates a systemic weakness.

The U.S. is embarrassed over this loss and no doubt much of the chatter is an attempt to play down the significance of this loss and therefore is as reliable as Iranian claims.

@Brainwrong

...Sadly the most likely circumstance, it's guidance computer was likely coded in Ruby, making it that much easier to induce a bug :D

integration drifts

Some are claiming here the integration drift of INS's would not be enough to divert a drone being fed modified GPS signals. This all depends on the quality of the INS sensors which might be a cost issue too. But what people forget in the calculation is the cumulative effect of a maximum (false) GPS correction on all parameters (velocity, acceleration, speed) one that doesn't trigger any alarm.

I think one would find that within a few hours or less of constant false GPS signals the cumulative drift would be significant enough to get lost. The drones are likely not designed to withstand a really long duration accurate false GPS signal. How likely it is Iran was able to feed the drone false but convincing GPS for any length of time remains open to debate of course. For sure they will not weaken their defenses by telling how they did it or if they did it at all!

Sgt. Duffer and the Storm

Agree with LarsG, there are many plausible Sgt. Duffer scenarios that explain this. As he says, fuelling error, or something like a legitimate, but wrong, command and control signal from the US controllers easily explain this.

It is even plausible that a real mission went awry, for example, maybe the drone was deliberately landed in an attempt to re-supply a special-forces unit, but was intercepted by Iranian ground-forces.

Lots of other "natural" explanations work too --- hit by lightning or buffeting from turbulence causing some sort of system disconnection, for example.

If it did crash, as long as it lands in relatively flat terrain a fairly unscathed body is not that surprising either. The drone will probably be designed to glide --- as this saves on fuel for high altitude, long-duration missions. And it is surely designed to be rugged enough to experience a hard-landing without disintegrating into thousands of pieces. It will be designed such that it can land on an improvised/poor run-way when being used by a unit in the field, for example.

On the other hand, it would be foolish to assume that the Iranians hadn't figured out some method of causing a malfunction. And it would be equally foolish to assume that a propaganda statement (from either side) actually contained any truthful information about what this exploit was.

What the Paper Actually Claims

"We will show, for example, that any number of receivers can easily be spoofed to one arbitrary location".

The problems considered in this paper are harder than simply persuading a naive GPS user (one that is not attempting to determine if it is being spoofed) that it is somewhere other than it actually is. They include such problems as doing so without losing lock, and spoofing a number of spatially-separated receivers such that their apparent mutual separation conforms with reality. They conclude that "spoofing detection based on lock loss has two disadvantages: (i) strong attackers can achieve a seamless satellite-lock takeover, and (ii) lock loss can occur due to natural causes" and so propose the use of multiple, separated receivers as the basis of a spoofing-detection mechanism.

The actual content of this paper, therefore, does not justify the claim in the Register article's headline.

So the question has been answered...

as to what happens when a drone gets a BSoD over enemy airspace...

GPS 'n stuff

I've started working on very precise GPS systems as part of a safety system. It's been an awakening. GPS is not that good.

I use GPS & GLONAS combined and I see constantly how the receivers pitch the location all over the place. "20cm" units can have 5 metre excursions no problem as the constellation changes and the system has to start recalculating based on a new constellation.

Hijacking the drone doesn't need 75ns accuracy. It simply needs a local transmitter that transmits high power signals with a known phase relationship - which is varied to suit the purpose.

The receiver will keep on adjusting to the new constellations and in the meantime use inertial navigation to tide over the outages.

All that's needed is the occasional burst of multispectral/phase signal to allow the drone to resync and point its inertial system in the required direction. That's why the landing was flubbed. Precise control is not possible - though why it didn't use a microwave ground sensor I have no idea.

Disingenious TR Article

Assuming there are not even five competent electrical engineers in Iran is quite stupid. Delaying a GPS signal by 75 ns can be done with some standard parts either ripped out of commercial electronic devices or bought in a country not under embargo.

Just "losing track" of (say) twenty microwave transistors and twenty FPGAs would not be noticed in any Chinese or Vietnamese factory. Actually Iranian agents could buy it in Germany and send it by parcel to Iran with a high chance of success. Also, Chinese oscilloscopes can nowadays surely perform 1 Gigasamples/second.

Finally, Iranian engineers are surely able to use a modern oscilloscope, a soldering iron and I am sure they understand the concept of a "nanosecond".

Thinking About GPS Spoofing

Apparently the GPS signal is not enciphered, so the practical problems boil down to this:

A) A Microwave signal generator which produces the GPS signal and can be modulated to any desired GPS timestamp.

B) An antenna+amplifier which will (locally) overpower the true signal from the satellites by a factor of ten. That will make sure the automatic gain control of the receivers will reduce receiver amplification and consequentially "see" only the bogus signal

C) A control computer which will generate all the "proper" timestamps for the different "bogus" satellites which are simulated by A) and B).

D) To test/debug the spoofing system the team ventures out into the next supermarket to buy a commercial GPS receiver. They have all the time they need to perfectionize/debug the spoofing system

E) Then the whole thing is mounted into an F-14 stripped of all non-essential heavy stuff (guns, external tanks, second seat etc) to perform jamming onto drones which are optically acquired.

That all sounds more like a graduate student project of a proper university than "leading-edge Science". One has to assume Iran does indeed have this ability.

Regarding a possible Inertial Navigation System, I guess the Americans simply omitted it, as that would reduce payload seriously and of course generate significant cost. I guess they simply did not think rigorously about GPS spoofing.

Locating "Stealth" Drones Electronically

I guess what the Americans also sharply underestimate is Iran's capability to locate their "stealthy" drones by the electronic emissions of the control uplink to communications satellites.

All antennae do have sidelobes and even if a microwave antenna is pointed upwards, it will emanate significant energy sideways. That energy can be picked up by sensitive (ie. large) antennas on hilltops or in elint aircraft. Two bearings make a fix and then a fighter jet will be sent to investigate.

Surely the drone could be programmed to be completely silent while in or near "hostile" airspace, but considering previous mishaps I would say chances are they did lots of chattering with the drone via satcom.

SPB Request

Maybe the SPB could do some high-level research into GPS spoofing and report back to us?

Interesting...

...how everyone seems to think it's extremely unlikely for a US-controlled aircraft to miss the target...

magnetism

any reason the drone can`t compare current position with magnetic north, thus giving a little added extra feedback? Or am I missing the point? Did the drone "if compromised" think it was somewhere it wasnt?

Err, I seem to remember back when Iraq-USA were buddys, that Iraq protected the Gulf state from the Iranians. Someone like to forward a history lesson as to why they were a problem back then, and possibly a problem now. Not sure I`m up to date as to why Iran is seen as a problem. I`m guessing they are a little hard on their female population, buts thats just a guess, any other reason not to like them? Do they not conform to some form of imposed market model or something?

A thought...

...based on *no* knowledge of the plane in question whatsoever.

It occurs to me that while it is probably theoretically possible - using a single transmitter of sufficient complexity - to recreate a valid fix on a single receiver, this falls over if multiple receivers on the same craft are used: consider for example a receiver at the end of each wingtip, and therefore several metres apart.

In that case, in normal operation, suppose that two satellites in the constellation are aligned with the wings (by chance) but on opposite horizons. For one wing tip, satellite 'A's signal will arrive before that of satellite 'B' but for the other, the opposite will hold. Each will calculate a close but slightly different position - ideally, the 'true' position of its own wingtip.

But this occurs because multiple satellites are used. If a single transmitter is used - or, significantly, multiple transmitters which are not in a similar orbital constellation and speed - then while one receiver can be spoofed, the other will *always* be in an error condition; because the signal it sees is simply the same signal as the other, delayed by some nanoseconds depending on orientation. The two receivers will always produce the *same* position.

To be fair this is based on a number of assumptions:

- that two receivers (or more) are installed

- that they are capable of sufficient resolution

- that they are sufficiently far apart to discriminate

But with such assumptions, it would seem that it is easy to tell when someone is trying to spoof you and to take appropriate action (e.g. fly on EMU/scream for help/aim at the ground).

Or am I ignorant of some critical fact?

Simpler explanation

After reading many of the highly technical and quite interesting explanations given here, I have a simpler suggestion: some klutz spilled his coffee on the keyboard back at the monitoring station. Or some variation therof.

Celestial Navigation

As the drones appear to be made for high-altitude operation, an obvious option should be celestial navigation. It is of course not as precise as GPS, but certainly much better than an internal navigation system, which adds up errors all the time. Also, it is quite hard to spoof the sun, moon and the stars...

The soviets always built special windows into their long-range a/c to facilitate that.

Buzz bomb

I keep imagining an Iranian air force jet flying alongside the drone and simply tipping it over with its wing tips.

In summary.

So, we have an uncorroborated Iranian story, full of holes a twelve-year-old could identify. We then have experts confirm out the holes. Naturally, we then have the usual crowd of anti-Yanks posting any possible way they can carry on believing.

A note on GPS antennas

Most high data rate sat systems are either in geosynchronous orbit (IE *fixed* in the sky) or needing to communicate with 1 sat at a time (LEO comms constellations like Iridium and Orbcomm).

The usual answer is a *steerable* dish in azimuth and direction to track the *single* target while the platform moves, while receiving or sending a signal across a *very* narrow angle of sky.

GPS does not have this luxury. Signals could come from anywhere across the whole visible *hemisphere* of sky, 180deg in *either* direction.

And a GPS receiver has to track *four* satellites for a fix. Not 1 or 2.

The *simplest* solution is a special *passive* aerial with good coverage in a blister on the top side of the vehicle. Phased arrays have trouble down to the horizon ("endfire") and add complexity. Multiple blisters worsen aerodynamics (and presumably stealth characteristics).

Tests have been done for using GPS for *attitude* determination on satellites (JPL and IIRC SSTL have done so), which is a similar problem.

Obviously depending on how seriously people take this capability future designs may choose to go with other aerial and receiver options.Modern DSP based GPS receivers can have enough "channels" to track *all* visible satellites continuously.

BTW the CSM article *names* a General supposedly involved in the programme (who was reportedly dead of a heart attack shortly afterward) who should be senior enough to speak with some authority on the project. It's not entirely an anonymous informant.