how Iran took down a US drone

[Admin]

I thought this was incredibly clever. And it's so simple that anyone with a little no-how can do it at home . . .
http://www.csmonitor.com/World/Middle-East/2011/1215/Exclusive-Iran-hijacked-US-drone-says-Iranian-engineer

I suppose the counter-solution would be for the US Navy to develop an encrypted GPS system . . . and perhaps software that can detect GPS spoofing.

"...GPS spoofing was used to get the RQ-170 Sentinel Drone to land in Iran. According to an Iranian engineer quoted in the article, 'By putting noise [jamming] on the communications, you force the bird into autopilot. This is where the bird loses its brain.' Apparently, once it loses its brain, the bird relies on GPS signals to get home. By spoofing GPS, Iranian engineers were able to get the drone to 'land on its own where we wanted it to, without having to crack the remote-control signals and communications.'"

The techniques were developed from reverse-engineering several less sophisticated American drones captured or shot down in recent years, the engineer says, and by taking advantage of weak, easily manipulated GPS signals, which calculate location and speed from multiple satellites.

[Soeren]

I thought this was incredibly clever.[...]

Yes and it has been an exploiting waiting to happen in years (just like atomic time transmitters), but it's extremely stupid telling their enemy what their weaknesses are - had they kept their silence, they would still have this advantage.

Must have taken a bit of work though - like knowing at what precise location it was supposed to land.

[Gertlex]

Must have taken a bit of work though - like knowing at what precise location it was supposed to land.

Definitely...  I suspect they knew where the drones were taking off from.  But if they didn't, the math sure gets fun.

My impression is that in the drone's brain, it must have seemed like it suddenly found itself in the Bermuda Triangle... that is to say, the sudden change in orientation ought to have sent a warning back to the US C&C say "hey guys! I found a wormhole!".

[knossos]

that is to say, the sudden change in orientation ought to have sent a warning back to the US C&C say "hey guys! I found a wormhole!".

Except they blocked all comm to and from the device with broad spectrum noise forcing it to only rely on it's own sensors for navigation.

[Gertlex]

So how did they send it GPS signals as Admin's link says? (I'm sure it was more complicated than said link describes)

[Redcap]

If the US knew about this possible weakness for years, it does lend to the question of why didn't they do anything about it?

[Admin]

So how did they send it GPS signals as Admin's link says? (I'm sure it was more complicated than said link describes)

You 'simply' broadcast your own false GPS signals from a ground station. GPS is a very weak signal, so it's not hard to drown it out. Mimicking it requires a lot of math, though . . .

Must have taken a bit of work though - like knowing at what precise location it was supposed to land.

Yea, I wondered that too. They probably tracked down the airport in a nearby country.

I'm thinking that a computer vision recognition system to visually identify the correct landing location might make a good defense . . . given the hardware on these spy drones, I'm sure it's just a small software update


On a side note, it's common for spy hardware to have anti-tamper and self-destruct features to prevent reverse engineering in case of capture. It appears that was not the case for these drones . . .

[Redcap]

it's common for spy hardware to have anti-tamper and self-destruct features to prevent reverse engineering in case of capture. It appears that was not the case for these drones

Simple oversights?

Or do they actually have a way of tracking these "stealth" drones that Iran isn't aware of?

If they do, it'd explain why they didn't take any precautions (such as finding a fix for the security hole known for years, or implementing anti-tamper features).

[Gertlex]

So how did they send it GPS signals as Admin's link says? (I'm sure it was more complicated than said link describes)

You 'simply' broadcast your own false GPS signals from a ground station. GPS is a very weak signal, so it's not hard to drown it out. Mimicking it requires a lot of math, though . . .

Well I was referring to the post above me about broad spectrum noise... Though now I'm concluding that they used a coherent fake GPS signal in whatever part of the RF spectrum GPS uses and clogged up the rest of the spectrum with noise.