🤖 AI Summary
This work proposes SpAmming, a novel hybrid attack paradigm addressing the limitations of existing GNSS anti-spoofing and anti-jamming mechanisms against emerging composite threats. Exploiting the CDMA multiplexing characteristics of GNSS, SpAmming leverages software-defined radio platforms to generate carefully crafted spoofing signals that integrate fake signal transmission, Doppler shift manipulation, and code-phase offsetting. This approach simultaneously achieves effective interference while evading conventional detection schemes. Experimental results demonstrate that SpAmming can successfully disrupt receiver signal acquisition during cold start and significantly degrade performance under hot-start and steady-state positioning conditions. Its impact is further amplified when coordinated with other attacks, underscoring its high level of stealth and disruptive potential.
📝 Abstract
GNSSs are vulnerable to attacks of two kinds: jamming (i.e. denying access to the signal) and spoofing (i.e. impersonating a legitimate satellite). These attacks have been extensively studied, and we have a myriad of countermeasures to mitigate them. In this paper we expose a new type of attack: SpAmming, which combines both approaches to achieve the same effects in a more subtle way. Exploiting the CDMA multiplexing present in most GNSSs, and through a spoofing attack, this approach leads the receiver to lose access to the signal of a legitimate satellite, which would be equivalent to a denial of service; but in this case the existing countermeasures against jamming or spoofing would not allow safeguarding its effectiveness, as it is neither of them. An experimental proof-of-concept is presented in which its impact is evaluated as a function of the previous state of the receiver. Using an SDR-based system developed at the Space Security Centre, the attack is executed against a cold-started receiver, a warm-started receiver, and a receiver that has already acquired the PVT solution and is navigating. Different attack configurations are also tested, starting from a raw emission of the false signal, to surgical Doppler effect configuration, code offset, etc. Although it is shown to be particularly successful against cold-started receivers, the results show that it is also effective in other scenarios, especially if accompanied by other attacks. We will conclude the article by outlining possible countermeasures to detect and, eventually, counteract it; and possible avenues of research to better understand its impact, especially for authenticated services such as OSNMA, and to characterize it in order to improve the response to similar attacks.