In global navigation satellite systems (GNSS), a spoofing attack attempts to deceive a GNSS receiver by broadcasting fake GPS or other GNSS signals, structured to resemble a set of normal GNSS signals, or by rebroadcasting genuine signals captured elsewhere or at a different time. GNSS spoofing is a more sophisticated and deceptive practice than GNSS jamming, which merely blocks affected devices from being able to use GNSS systems at all. Spoofing attacks are generally hard to detect as adversaries generate counterfeit signals. These spoofed signals are challenging to recognize from legitimate signals, thus confusing ships' calculation of positioning, navigation, and timing (PNT). This means that spoofed signals may be modified in such a way as to cause the receiver to estimate its position to be somewhere other than where it actually is, or to be located where it is but at a different time, as determined by the attacker. One common form of a GNSS spoofing attack, commonly termed a carry-off attack, begins by broadcasting signals synchronized with the genuine signals observed by the target receiver. The power of the counterfeit signals is then gradually increased and drawn away from the genuine signals. Even though GPS and other GNSS networks are among the most relied upon navigational systems, they have demonstrated critical vulnerabilities towards spoofing attacks. GNSS satellite signals have been shown to be vulnerable due to the signals' being relatively weak on Earth's surface. A reliance on GNSS could result in the loss of life, environmental contamination, navigation accidents, and financial costs. However, since 80% of global trade is moved through shipping companies, relying upon GNSS systems for navigation remains unavoidable. As of 2022, all public-access GNSS systems, such as the US GPS, Russia's GLONASS, China's BeiDou, and Europe's Galileo constellation, are vulnerable to this technique. In order to mitigate some of the vulnerabilities the GNSS systems face concerning spoofing attacks, the use of more than one navigational system at once is recommended. In 2025, Galileo deployed a feature that allows supporting receivers to differentiate between real and forged signals using cryptography. The term GPS spoofing may refer either to a GNSS spoofing attack or to a distinct phenomenon more accurately known as AIS spoofing or first-party spoofing, in which a vessel or aircraft deliberately broadcasts false information about its own position via AIS signals, despite its crew knowing its correct position.
Occurrences The December 2011 capture of a Lockheed RQ-170 Sentinel drone aircraft in northeastern Iran may have been the result of such an attack. GNSS spoofing attacks had been predicted and discussed in the GNSS community as early as 2003. A "proof-of-concept" attack was successfully performed in June 2013, when the luxury yacht White Rose of Drachs was misdirected with spoofed GPS signals by a group of aerospace engineering students from the Cockrell School of Engineering at the University of Texas in Austin. The students were aboard the yacht, allowing their spoofing equipment to gradually overpower the signal strengths of the actual GPS constellation satellites, altering the course of the yacht. In 2019, the British oil tanker Stena Impero was seized by Iranian forces in the Strait of Hormuz, with the vessel, including its crew and cargo, subsequently used as pawns in a geopolitical conflict. Analysis by Lloyd's List Intelligence concluded that the ship had likely been redirected into Iranian waters by GNSS spoofing prior to the seizure. On October 15, 2023, Israel Defense Forces (IDF) announced that GPS had been "restricted in active combat zones in accordance with various operational needs," but has not publicly commented on more advanced interference. In April 2024, however, researchers at University of Texas at Austin detected false signals and traced their origin to a particular air base in Israel run by the IDF.
Russian GPS spoofing
In June 2017, approximately twenty ships in the Black Sea complained of GPS anomalies, showing vessels to be transpositioned miles from their actual location, in what Professor Todd Humphreys believed was most likely a spoofing attack. GPS anomalies around Putin's Palace and the Moscow Kremlin, demonstrated in 2017 by a Norwegian journalist on air, have led researchers to believe that Russian authorities use GPS spoofing wherever Vladimir Putin is located. The mobile systems named Borisoglebsk-2, Krasukha and Zhitel are reported to be able to spoof GPS. Incidents involving Russian GPS spoofing include during a November 2018 NATO exercise in Finland that led to ship collision (unconfirmed by authorities). and a 2019 incident of spoofing from Syria by the Russian military that affected the civil airport in Tel Aviv. In December 2022 significant GPS interference in several Russian cities was reported by the GPSJam service; the interference was attributed to defensive measures taken by Russian authorities in the wake of the invasion of Ukraine. As of 2026, Lloyd's List Intelligence reported that the Black Sea, the Sea of Azov, Russian ports in the Baltic Sea and Arctic Ocean, and the Red Sea near Sudan were the areas where signs of GNSS spoofing were being seen "most intensely and frequently" in ship AIS signals, and that the practice had become more difficult to detect over the past year.
GPS spoofing with SDR Since the advent of software-defined radio (SDR), GPS simulator applications have been made available to the general public. This has made GPS spoofing much more accessible, meaning it can be performed at limited expense and with a modicum of technical knowledge. Whether this technology applies to other GNSS systems remains to be demonstrated.
Prevention
Receiver modification The Department of Homeland Security, in collaboration with the National Cybersecurity and Communications Integration Center (NCCIC) and the National Coordinating Center for Communications (NCC), released a paper which lists methods to prevent this type of spoofing. Some of the most important and most recommended to use are:
… excerpt ends here. Continue reading the full article.
