University of Texas Team Hijacks $80 Million Yacht With Cheap GPS Spoofing Gear

Last month, a team from the Department of Aerospace Engineering and Engineering Mechanics at the University of Texas at Austin used $3,000 worth of GPS spoofing gear to hijack an $80 million yacht cruising the Mediterranean -- with the cooperation of an astounded captain.

The successful spoof of GPS signals has widespread implications for all types of transportation that are heavily dependent on GPS for navigation.

The team, led by assistant professor Todd Humphreys at the Cockrell School of Engineering, traveled on the White Rose of Drachs from Monaco to Rhodes, Greece, and conducted the successful and scary GPS spoofing experiment 30 miles off the coast of Italy, according to news release from UT.

From the upper deck of the yacht, graduate students Jahshan Bhatti and Ken Pesyna broadcast faint and fake civil GPS signals from their spoofing device -- a blue box about the size of a briefcase -- toward the ship’s two GPS antennas. The team’s counterfeit signals slowly overpowered the authentic GPS signals until they ultimately obtained control of the ship’s navigation system.

Unlike GPS signal blocking or jamming, spoofing triggers no alarms on the ship’s navigation equipment. To the ship’s GPS devices, the team’s false signals were indistinguishable from authentic signals, allowing the spoofing attack to happen covertly.

After they gained control of the yacht’s navigation system, the team subtly steered it off course. Once a location discrepancy was reported by the ship’s navigation system, the crew initiated a course correction. In reality, each course correction was setting the ship slightly off its course line. Inside the yacht’s command room, an electronic chart showed its progress along a fixed line, but in its wake there was a pronounced curve showing that the ship had turned.

“The ship actually turned and we could all feel it, but the chart display and the crew saw only a straight line,” Humphreys said.

“With 90 percent of the world’s freight moving across the seas and a great deal of the world’s human transportation going across the skies, we have to gain a better understanding of the broader implications of GPS spoofing,” Humphreys said. “I didn’t know, until we performed this experiment, just how possible it is to spoof a marine vessel and how difficult it is to detect this attack.”

Where, oh where, is the backup to GPS -- and when?