When the layperson thinks about GPS, they typically visualize themselves conveniently driving with a nice, clear Google Map displayed on their smartphone to show them precisely where they are at all times. In fact, that’s how the vast majority of consumers directly interact with this type of technology—but like most digital things, there’s a bit more to the story. And it ain’t all good.
Where did GPS begin?
The network once known as Navstar GPS has been operational since 1978 and was first developed by the U.S. Department of Defense for obvious military use. The availability of that technology became a clear advantage for America’s military, as command centers can pinpoint the location of their various vehicles and weapons. There are probably lots of other military uses for such technology as well, but you’ll likely never know about it. The GPS network started with 24 satellites and has now expanded to 31 satellites out in orbit, with many little improvements made to the GPS system over the years.
In the 1980s, the U.S. Department of Defense made this technology available to civilians, but by the 21st century, it became feasible to make the system easily accessible to consumers through automotive GPS consoles and smartphones. And that’s how most of us today understand it.
What’s this about an electric grid?
Did you know that a lot of power grids use GPS to properly allocate electricity distribution? Well, you do now. Different parts of the power grid need varying amounts of electricity at varying times. The use of residential electricity spikes in the summer when people have their air conditioners on, while residential, commercial, and industrial areas use more electricity in the day time when people are likely awake and active. Electrical utilities benefit from this ability to monitor and manage the differing electrical consumption rates in different areas at different times.
So, what does GPS have to do with security?
Ever so gradually, more electricity is being produced by lots of little things like solar panels and wind turbines, rather than by a few big things like huge, centralized power plants. That technological shift makes the correlation of phasor measurement units (PMUs) with GPS atomic clocks increasingly necessary. Yep, that’s where GPS comes into the picture. It’s amazing how many uses can be invented for a technology that was originally created for an entirely different purpose. I don’t think internet inventor Tim Berners-Lee envisioned us sharing cat memes on web forums—or maybe he did.
Unfortunately, the recent implementation of GPS into our power grid has rendered our electrical infrastructure vulnerable to GPS spoofing attacks. These situations usually occur when cyber attackers deploy transmitters to broadcast counterfeit GPS signals. It’s easy to imagine how a malicious party with a lot of resources and technical know-how would want to mess up our power grid. If you were in the eastern U.S. or Canada during the August 2003 blackout, you probably remember the chaos that ensued, right? And that was just an innocent mistake, not a real cyberattack. If you don’t remember the incident, here are a few technical details:
“On August 14, 2003, at 3:05 p.m., a 345-kV transmission line in Ohio began to sag from increased flow of electric power. When the line sagged too close to a tree, it caused a short-to-ground and tripped offline. This is something that happens fairly frequently on the massive U.S. electrical grid and is usually easily dealt with. However, the tripping of that line in northern Ohio began a cascade of failures that, in a little more than an hour, led to a near total power loss for more than 50 million people in the northeastern U.S. and parts of Canada.
The report goes on to say, “The blackout is estimated to have cost approximately $6 billion for only four days of power loss. This led the Department of Energy and the North American Electric Reliability Corporation (NERC) to fund and push for an improved ‘smart grid’ with synchrophasor technology as a major component.”
So the gradual implementation of GPS technology into our electrical infrastructure is partly a reaction to the big blackout of 2003 in the first place, which means it certainly has a strong role in overall security.
How does a GPS spoofing attack really work?
GPS spoofing attacks on power grids work by altering timestamps. Researcher Nikolaos Gatsis explains more, “They would make the control center think that the measurements they are getting happened at a different time.”
And as was reported in GPS World, “GPS spoofing is the act of producing a falsified version of the GPS signal with the goal of taking control of a GPS receiver’s position-velocity-time (PVT) solution. This is most effectively accomplished when the spoofer has knowledge of the GPS signal, as seen by the target receiver, so the spoofer can produce a matched, falsified version of the signal. In the case of military signals, this type of attack is nearly impossible because the military signal is encrypted and therefore unpredictable. On the other hand, the civil GPS signal is publicly-known and readily predictable.
The report further states, “In recent years, civil GPS spoofing is becoming recognized as a serious threat to many critical infrastructure applications, all of which rely heavily on the publicly-known civil GPS signal. A number of promising methods are currently being developed to defend against civil GPS spoofing attacks, but it will still take a number of years before these technologies mature and are implemented on a wide scale. Currently, there is a complete absence of any off-the-shelf defense against a GPS spoofing attack.”
What can power companies do?
A study has been conducted on how to security harden our power grid from GPS spoofing attacks. Researcher João Hespanha explains, “Spoofing GPS is very easy, with off-the-shelf hardware and software that you can download from the internet. This means that compromising the measurement of a single PMU is very easy, even without having physical contact with the unit.”
Hespanha also explained how the research team conducted their experiment. “Essentially, we try to make sure the network of PMUs exhibits a behavior that is consistent across time and across sensors. We actually do not require a single PMU to be perfectly consistent across time, but a group of PMUs must exhibit a consistent behavior across time.”
GPS spoofing attacks could compromise up to a third attacks of their nodes, but the security hardening technique Hespanha’s team developed should still work. “Even if a significant number of PMUs become compromised, it is still possible to monitor oscillations in power networks reliably. The trick is to check for consistency across the whole network of PMUs.”
Related Resources:
Searching For Privacy: Is Google Its Own Worst Enemy?
Technologies Exclusive To The Farming Industry