Overview
This study investigates spoofing attacks against Galileo's Open Service Navigation Message Authentication (OSNMA) by manipulating time synchronization. It identifies a condition termed artificially manipulated time synchronization (ATS) that enables attackers to jointly manipulate Galileo signals and a receiver's local reference time (LRT) while maintaining the required time synchronization (TS).
Exploiting the ATS condition, the research proposes a TS-compliant spoofing framework comprising three distinct attack types: TS-compliant replay (TSR), TS-compliant forgery (TSF), and TS-compliant dual-frequency forgery (TSDF) attacks. These attacks are designed to first compel a receiver to satisfy the TS requirement by manipulating its LRT, and then transmit specific signals to spoof the receiver to locations and times chosen by the attacker.
Research Context
Galileo introduced the Open Service Navigation Message Authentication (OSNMA) specifically to defend against spoofing attacks. Spoofing involves transmitting false satellite navigation signals to deceive a receiver into calculating an incorrect position or time.
Approach
The core principle behind the proposed attacks involves a two-step process. First, the attacker forces the receiver to meet the time synchronization requirement by manipulating its local reference time (LRT). Second, carefully designed signals are transmitted to direct the receiver to attacker-selected locations and times.
Three specific attack types were developed:
- TS-compliant replay (TSR) attack: This method reuses previously recorded E1 signals.
- TS-compliant forgery (TSF) attack: This involves transmitting forged E1 signals that contain valid OSNMA data.
- TS-compliant dual-frequency forgery (TSDF) attack: This targets dual-frequency receivers that support cross-band authentication by simultaneously forging both E1 and E5b signals.
Findings
Real-world experiments were conducted to validate the effectiveness of the proposed attacks. The experiments utilized two commercial Galileo receivers and two open-source software-defined radio (SDR) receivers that support OSNMA.
The results indicated that all three proposed attacks—TSR, TSF, and TSDF—were successful. Specifically, the attacks were able to:
- Successfully pass OSNMA authentication.
- Spoof the receivers to attacker-selected locations.
- Spoof the receivers to attacker-selected times.
Why This Matters
The findings indicate a vulnerability within the Galileo OSNMA system under specific time synchronization manipulation conditions. The ability of these attacks to bypass authentication and spoof receivers to arbitrary locations and times suggests potential security implications for applications relying on Galileo OSNMA for positioning and timing integrity.