Hackers are taking over planes’ GPS — experts are lost on how to fix it

It’s one of the most terrifying events imaginable.

There have been over 50 recent reports of frightening cyberattacks that have altered planes’ in-flight GPS, leading to what experts described as “critical navigation failures” onboard the aircraft.

More frightening still, industry leaders thought that this type of hacking was not possible and are at a loss over how to fix the now glaring security failure. Since late August, they have been observed throughout the Middle East, particularly over Israel, neighboring Egypt, and Iraq.

In September, the FAA issued a warning on the “safety of flight risk to civil aviation operations” over the spate of attacks, according to OpsGroup, an international collection of pilots and technicians who first brought attention to the terror.

The attack, called GPS spoofing — when a navigation system is given counterfeit coordinates — isn’t new and applies to all modes of transportation. Ten years ago, a group of college students at the University of Texas bragged that they moved an $80M yacht off its course as a school project. In 2015, a security researcher also hacked a United Airlines flight and modified its course as a warning over security flaws.

But the tactic has now become so sophisticated that nefarious hackers, still at large, have recently learned how to override an airplane’s critical Inertial Reference Systems (IRS). That crucial piece of technology is commonly called the “brains” of a craft by manufacturers.

One flight, a Gulfstream G650 from Tel Aviv on October 25th, “experienced full nav[igation] failure” as its system had marked the plane 225 nautical miles from the actual course. And a Boeing 777 endured spoofing over Cairo airspace and was falsely thought to be stationary for a half hour on Oct. 16 as well, according to the group.

Before these rampant attacks began at the very end of August, spoofing the IRS was “previously thought to be impossible,” OpsGroup wrote in a November update, which added several more cases of spoofing to the already lengthy list.

“The industry has been slow to come to terms with the issue, leaving flight crews alone to find ways of detecting and mitigating GPS spoofing…What will you do at 2 a.m. over the Middle East when the aircraft starts drifting off course and saying ‘Position Uncertain?’ With almost zero guidance, we’re largely on our own to figure things out.”

Another aviation expert and former flight operations captain, Patrick Veillette, warned that the current global climate — the pattern of attacks began shortly before Gaza’s October assault on Israel — is an added global risk. Israel also admitted that “GPS was restricted in active combat zones in accordance with various operational needs” in mid-October.

“Nefarious (though yet to be identified) forces are likely behind this,” Veillette wrote. “And the consequences could turn into an international crisis and possibly the loss of an innocent civilian aircraft in a region that is already a high-risk area near an active conflict zone.”

Adding more fuel to the tension, Professor Todd Humphreys, who led the yacht spoofing at UT a decade ago, believes he’s traced the source of these hacks back to Iran.

“Using raw GPS measurements from several spacecraft in low-Earth orbit, my student Zach Clements last week located the source of this spoofing to the eastern periphery of Tehran,” Humphreys, who warned congress about the dangerous potential of spoofing in 2012, told Vice’s Motherboard.

“GPS spoofing acts like a zero-day exploit against aviation systems…[aviators are] completely unprepared for it and powerless against it.”