← CyberWire Daily![GPS: A backbone for critical infrastructure. [T-Minus: Space-Cyber Briefing] — CyberWire Daily cover](https://megaphone.imgix.net/podcasts/d5e58c5e-5b8d-11f1-94d9-9333df73fde9/image/637ef5fa089ca3dbceebd7bda30c7eb8.png?ixlib=rails-4.3.1&max-w=3000&max-h=3000&fit=crop&auto=format,compress)
Loading summary
Transcript106 lines
- [00:02]
A
You're listening to the Cyberwire Network, powered by N2K.
- [00:13]
B
Looking to understand the cybersecurity risks emerging beyond Earth's atmosphere? In the weekly Signals in Space newsletter, T Minus host Maria Vermazes and producer Ethan Cook connect the dots between terrestrial infrastructure and the growing attack surface in space. Each week you'll get the latest space cyber headlines, direct access to the week's T Minus podcast conversation, plus expert insights and resources to help security professionals better understand this rapidly evolving domain. Space systems are becoming critical. Infrastructure Signals in Space helps you stay ahead of the threats shaping the next frontier. Subscribe now to the Signals in Space newsletter. When it comes to mobile application security, good enough is a risk. A recent Survey shows that 72% of organizations reported at least one mobile application security incident last year, and 92% of responders reported threat levels have increased in the past two years. Guard Square delivers the highest level of security for your mobile apps without compromising performance, time to market or user experience. Discover how Guard Square provides industry leading security for your Android and iOS apps at www.guard square.com.
- [01:51]
C
I googled how does GPS work? Yeah, and the the technical definition that I got was a receiver measured the time it takes for a signal to travel from multiple satellites to.
- [02:01]
A
Yes.
- [02:02]
C
Then it measures that. It multiplies the travel time by the speed of light to calculate the precise distance to each satellite and then by analyzing them from at least four different satellites, the receiver then determines the three dimensional position, latitude, longitude and altitude. And time.
- [02:15]
A
And time. The time is really important. Yes, Welcome. Hi, I'm Maria Varmazis and you're listening to T Minus Space Cyber Briefing. In this show, we examine the evolution of cybersecurity in the global and orbital infrastructure that powers, protects and connects our lives. Hi everybody and thank you for joining me today. In last week's show, we spent some time thinking about the future of GPS and how to secure it. This week and next we thought we'd take a little step back and spend some more time looking at GPS in general and why in the heck it matters. In a space cyber context, it matters a lot. Perhaps a lot more than you would think. So let's dive in and by the end of this episode, you'll have a better understanding of where and how attacks against GPS signals fit into the modern threat landscape. Producer Ethan Cook joins me once again to break it all down. All right, so. Hi Ethan. Welcome back. I didn't scare you away last time?
- [03:39]
C
No, you did not. I am here.
- [03:40]
A
I'm back. All right, so we've been talking a lot about gps, good old GPS in our editorial discussions and when we're talking about like booking people for the show, feels very inevitable that we're gonna go back to it a bunch and it's kind of important. Kind of important. Also, I think people think they know a lot about it and maybe have a different idea of what the actual reality is. But anyway, before we get into all that for context for our listeners, I've been in the space world and the GPS world, like pretty hands on pretty heavily the last few years. You've been doing a ton of research as we've been sort of figuring out how we're gonna cover GPS over the next couple episodes. So you're a little newer to it and I'm very interested in hearing as we go through sort of our conversation, what surprised you, things that you thought were one thing but actually were another. I think a lot of people are gonna be with you on that.
- [04:35]
C
Yeah, I've been dusting off those old college research skills. Crazy stuff. Oh yeah?
- [04:41]
A
Yeah. It's. Every time I think I know something about gps, I often find that I was just straight up wrong. So I guess let's take people on that journey with us. Well, let's learn about gps because it's, I mean, it's not just the thing on your phone. It's not just like the old school TomTom or Garmin that you had in your car.
- [05:01]
C
It's not a map feature.
- [05:03]
A
Yeah. So I feel like the best way to start talking about gps. My favorite thing to do is just ask people randomly how does GPS work and just hear their responses. And I feel like it's cheating asking you this because you kind of know how it works now.
- [05:16]
C
But a little bit the week ago explanation would have been a phone connects the satellite, satellite tells me where I am and then magic happens and I go to a location.
- [05:26]
A
That is how everyone describes it.
- [05:28]
C
You know, like a week ago I was like, why do I need to know anything more than that? Like what could ever be relevant to that? Yes. For example, like, I guess a good way to think about that would be if you are, let's say driving using a map feature or navigation feature. It's being able to tell you not only actively where you're moving to and in live real time and the positioning as, but like how far away you are. And estimating is the kind of concept I got as well as in a time sensitive system, being able to be like, let's say for finances, being able to say like, okay, this person is in the correct location, and they're pinging within a sensitive timeframe. That's to make sure that this is an authentic use of gps. That's the rough concepts that I've gotten over the past, like, three days of shotgun research.
- [06:11]
A
So, okay, I hear some things in there that sound right, and a few things that I'm like, I'm not sure that's correct. So I. Okay, well, let's go for it, because so my. My main thing is we're not talking to the satellites with gps. That's. That's the thing that I think everybody thinks is like, we're communicating with them is like, we're just listening to what they're telling us. And that people think that the satellite also tells you how to navigate. And it's like, nope, satellite doesn't tell you any of that. That's all your phone and your phone, plus the cellular networks all working together. There's a lot of stuff happening on the software level on your phone that's doing all that navigation. The GPS is not thinking that part for you. That is a totally different world. All right, so we've just said, like, what? It isn't.
- [06:55]
C
Okay, well, there we go.
- [06:56]
A
So maybe should we start with what the heck GPS actually is?
- [07:01]
C
Yeah, yeah, absolutely. That's a good start. I've learned it's a part of. It's a very small part of a very large ecosystem.
- [07:11]
A
It truly is. So this is Maria's putting on her explaining hat now. So, Professor Maria has entered the building. So there are a lot of different satellite constellations or groups of satellites that exist in what's called, like, geostationary orbit or like, way out there in orbit. Not. Not as close to Earth as lower orbit is where. Yes. So essentially, like, the stuff that we talked about with Starlink or the International Space Station, those are in low Earth orbit. That's pretty close to Earth. That's like a couple hundred kilometers from Earth. All these global navigation satellite systems, and there are many around the world operated by many different countries, of which GPs from the United States is the first. They're way, way, way far out there. But like the United States, we have gps. Europe has Galileo. So that's their own version. And they're all slightly different from how we do things. Russia has one called glonass, India has navic, China has beidou, and Japan has qzss. And like, we all use each other's. We all ping off of each other's. And all of these different global navigation satellite services, or GNSS GNSS's. Like, we can see all of those signals, they all work slightly differently, but they're all just blasting the signal out, just kind of going, here I am, here I am. So there is a lot of physics that goes into this. And yes, the speed of light comes into this. And if people go, what? How does any of that relevant. It's super relevant part about GPS satellites being far away from Earth is actually really important because there's a delay between when the satellites send their signal about where they are and what time they think it is versus when we receive that here on Earth. And that delay is super duper, duper miniscule, but it is there.
- [09:01]
C
It is important. Yeah.
- [09:03]
A
And it's like we humans can't perceive it, but our machines sure can.
- [09:05]
C
Have you ever asked any cyber professional about rtp? And you know the impacts that desynchronizing that could have on just an individual network? Yes, catastrophic would be the answer, depending on how big that network is.
- [09:17]
A
I mean, that right there, what you said, Ethan, is like the whole reason why we on a Space Cyber podcast are talking about gps. Because as cool as GPS is for, in terms of global infrastructure and the things that cybersecurity professionals are going to be really interested in, it's not the location stuff, it's the timing. The timing is so crucial. And yes, as you said, if you mess with that, you monkey with that in any way. A lot of stuff's boned. I don't know how to put it
- [09:41]
C
like it's a catastrophic, you know, impact on a lot.
- [09:46]
A
It is. It truly, truly is. And I, I think when we have our next episode, we're going to get into a lot of the. How that works a little more specifically. So let's look forward for that one. But that is a bit of a preview of what we're going to get into. But yeah, so essentially going back to like, the physics of all this works. The key thing is that again, as you said, the satellite is blasting out a location. The latitude, longitude, altitude and time. That's it. And then from there, we can do a whole bunch of trilateration. Our devices can do that, the receivers on the ground can do that. So that can be our phone that's receiving that. If you're on a boat, your boat's receiver can do that. Equipment, it can do that. Yes, very importantly. And so all that heavy thinking is being done by the device once it receives that key information. And. And so we receive in the United States signals from gps. If you're in Europe, you're probably getting them from Galileo. But we can actually get signals from a whole bunch of different GNSS systems at once. Basically, the key thing is we're getting these signals and that tiny, tiny delay from the radio waves the way that the signals are getting to Earth. Since radio waves are a form of light, we can use the tiny delay with the speed of light to figure out, okay, if the delay is this and it says this and that, we've got a whole bunch of overlapping spheres of where the satellites are. We can sort of figure out position from there. That is a very poor physics explainer.
- [11:12]
C
It's better than trying to go through as what I did, which is read 10 articles or they're throwing out very big words and I'm like, I don't know what's happening here.
- [11:18]
A
Yeah. The moment you see a formula, you're like, oh, no.
- [11:20]
C
I'm like, oh, no.
- [11:22]
A
The physics is beautifully explained on the Internet by people much more in depth on the physics side of things than us. So we'll just hand wave that a little bit. But that whole process is trilateration. Yeah. Not triangulation.
- [11:33]
C
No, trilateration.
- [11:35]
A
Yeah. And crucially, these signals are actually pinged out in a sphere from the gps. So they're kind of, you know, because they're in space, they're not just blasting it down in a line, they're putting out all these signals spherically. So you can actually do some really interesting things with that if you're not just on Earth. But that might be a different show entirely. You know what, we should probably take a quick break.
- [11:55]
C
You know. I agree.
- [12:04]
A
All right, so dust off those pogs and bust out a can of Sobey, because we are going Back to the 90s after this break.
- [12:20]
B
Most environments trust far more than they should, and attackers know it. Threat Locker solves that by enforcing default deny at the point of execution. With ThreatLocker allowlisting, you stop unknown executables cold. With ring fencing, you control how trusted applications behave. And with ThreatLocker DAC defense against configurations, you get real assurance that your environment is free of misconfigurations and clear visibility into whether you meet compliance standards. ThreatLocker is the simplest way to enforce zero trust principles without the operational pain. Its powerful protection that gives CISOs real visibility, real control, and real peace of mind. ThreatLocker makes zero trust attainable even for small security teams. See why thousands of organizations choose ThreatLocker to minimize alert fatigue, stop ransomware at the source, and regain control over their environments. Schedule your demo@threatlocker.com N2K today,
- [13:27]
A
Study and
- [13:28]
C
play come together on a Windows 11 PC. And for a limited time, college students get the best of both worlds. Get the unreal college deal. Everything you need to study and play with select Windows 11 PCs. Eligible students get a year of Microsoft 365 Premium and a year of Xbox game Pass ultimate with a custom color Xbox wireless controller. Learn more@windows.com studentoffer while supplies last ends June 30th terms at aka Ms. CollegePC.
- [14:03]
A
Okay, and we're back. But. But if you imagine these signals from at least three different GPS satellites sort of overlapping like a Venn diagram, you can imagine pretty quickly depending on where you are. You can, you're. You're at the intersection of a whole bunch of different signals and you're using the delay to be like, oh, here, here I am. If you were in the military in the 70s and 80s and 90s especially, that put you way ahead being able to figure out where you were. That's actually why the whole thing was invented was for military use.
- [14:30]
C
As with everything.
- [14:32]
A
As with everything. And this is actually something that surprised me. It started in 1978.
- [14:37]
C
Yeah, you know, it makes sense from like, just like I'm a big history guy, you know, from the time period being how much we were investing in space and the amount of moon launches, et cetera. That satellite, especially with the race with the Soviets at the time being a very, very competitive dynamic, especially with some minor proxy wars going on.
- [15:00]
A
Yeah, Cold War. What the heck is that? Yeah, yeah, it does make sense, doesn't it, given the time. And I mean, we were just starting to see. I mean, we had been to the moon by that point. The space shuttle program was starting to ramp up at that point. And Skylab I think had already happened like, so cool stuff was happening in space at that time in the late 70s and we weren't just going. Satellites are really good for taking pictures from far away and making beep, beep sounds and maybe transmitting things are like, oh, maybe they can do other stuff. So. But yeah, I would not have guessed 1978. That's still way back, further back than I would have guessed.
- [15:37]
C
Yeah, I would probably have. I would have said 80s would be my gut instinct if I had to put a pen down on it. But I could see late 70s being like the tail edge of where I would gone for I think from at least now, from my research. What was interesting was, you know, as with everything the military does, some massive investment, has this very Advanced technology and then inevitably gets a new one. But the previous one has a ton of both commercial and civic uses that can do a ton of wonders for us. The Internet is one of them. For example.
- [16:10]
A
Thank you, darpa.
- [16:11]
C
Yeah, exactly.
- [16:12]
A
I'm pretty sure on my tombstone it's just going to say, thank you, DARPA for the Internet. Because I say it all the time when I. Which is the weirdest thing to put on your tombstone. But I love the Internet.
- [16:19]
C
No, it's quite wonderful. But I think. I didn't realize. I knew that GPS was originally started by the military, but I didn't realize that it was Clinton and Gore who, like, it seems like, opened it up for commercial use.
- [16:33]
A
Isn't that the weirdest thing? So I didn't realize that either. And I was alive at this time. I feel like I should have remembered it.
- [16:39]
C
Technically. So was I. Yeah, technically.
- [16:40]
A
So were you.
- [16:41]
C
I was like three or four.
- [16:42]
A
Yeah, listen, you don't remember. I was old enough to remember this. I was like. But yeah, 1994, GPS got opened up for civilian use. Technically. Like, technically. But nobody was using it in the 90s for. For a couple of reasons. I mean, okay, not. Nobody wasn't really widely used. We didn't have smartphones at that time. So that, I mean, there's that. GPS being opened in 94 by the Clinton administration was what they called selective availability for civilians. And so the accuracy was down to 100 meters, which I think basically told you essentially what state you're in.
- [17:17]
C
You know, you could be in one of the tri state area locations.
- [17:21]
A
Yeah, I'm like, I'm in New England. So I'm in one of the five New England states. It doesn't do much for me. Like, okay, great. That doesn't even.
- [17:27]
C
Center Texas. It still knows that you're in Center Texas.
- [17:30]
A
Yeah, yeah. You're still in Houston. You're still in Houston. You're still in Houston. Yeah, that's really. I mean, it's better than nothing, but certainly was not the accuracy level that the military was getting. But I understand why they didn't open it up. But yeah, it was like one of the last things I think Clinton did on his way out the door in 2000 was saying, you know what? I think actually this would be more helpful if we get rid of the selective availability.
- [17:51]
C
Yeah, let's go crazy with it.
- [17:53]
A
Let's go crazy. And then we civilians got 10 meters of accuracy from GPS signals, which is,
- [17:57]
C
you know, that's a pretty big improvement
- [18:00]
A
from 100 to 10. Do the math.
- [18:02]
C
It works.
- [18:03]
A
Do the math. So, yeah, that. I mean, we still didn't have. We did not have smartphones at that time, but we did have cell phones. Ish. Kind of. In 2000. I mean, I had a cell phone.
- [18:12]
C
They were devices.
- [18:14]
A
I had a Nokia brick. I don't think it had anything. Gps.
- [18:17]
C
It probably still functions, though, if I could find it.
- [18:20]
A
If you probably.
- [18:21]
C
If you found it, it probably still works.
- [18:22]
A
Oh, man. I put. Oh, I did so much work on, like, programming my ringtones in that thing. It was a whole. Yeah. And like, I had a little charm that would light up when the phone was about to get a call.
- [18:33]
C
Incredible.
- [18:34]
A
Yeah, it was. I. I'm sure that was great for my body to. To have that anyway, but. Yeah, yeah, I mean, it did not have a GPS receiver on that phone that I remember back then. But once we started getting smartphones in what, 2006, was that the year officially? IPhone came out? Something like that.
- [18:51]
C
Around then. It had.
- [18:52]
A
Around then.
- [18:52]
C
Yeah. Late to early 2000. Late to mid. Early 2000 era.
- [18:58]
A
Yeah, around there. Yeah.
- [18:59]
C
Somewhere.
- [18:59]
A
I mean, and concurrently, we also had devices like the Garmins and the tomtoms and the sat nav. I remember people had the sat nav devices that would sit on the dashboard of their car. That was like a whole separate thing. You're googling it out right now, aren't you?
- [19:11]
C
Yeah. The first iPhone was released in 2007.
- [19:16]
A
2007, I was off by one. What can you do?
- [19:18]
C
You piqued my curiosity.
- [19:19]
A
Yeah, yeah, but, yeah, that. I mean, once we started getting it in our phones, because we had smartphones that were capable of really doing something with it, I mean, then it really took off.
- [19:29]
C
Yeah.
- [19:30]
A
But I think industries that became dependent on it. I want to say that that started a little earlier, but it was much more behind the scenes. But that said, I mean, where we're at right now, now with that civilian use is basically at the same level of military use, as far as we all know, anyway. I mean, agriculture, you mentioned it earlier, like, so much of agriculture depends on being able to locate where your machinery is in the world and how it's plotting its way around the fields. The energy sector uses GPS for a whole lot of stuff like pipelines. Just being able to monitor situations and get a sense of how things are going. Surveying uses it a lot. I mean, finance. Finance uses it for timing transactions. If we mess up GPS signals in the arena of how finance uses it, the global finance sector could collapse, has
- [20:25]
C
a minor hiccup day. Probably not good for Everyone.
- [20:28]
A
Yeah, not great. So for the infosec professional who's like, why on earth are you spending all this time talking about gps, the ephemeris data that GPS sends the latitude, longitude and altitude and the time. All very good stuff, but it's the timing.
- [20:44]
C
Taking it to a cyber actor level, being able to commit fraudulent transactions that look legitimate would be devastating. See, if you have the right credentials and are able to then manipulate the timing, you could get in, make it look legit, make it look all real. And you would probably also go undetected for some time because it looks so real.
- [21:05]
A
Yeah. You could overwrite something by just kind of essentially time traveling. Yeah, exactly. Yeah, yeah, it's, it's pretty dastardly when you start thinking about it. Like, oh, I'm sure financial folks are like, yeah, listen, we're, we're 20 years ahead of you. We've been working on this to prove ourselves against this. But yeah, just the potential there, if you would. Yeah. Well, I mean otherwise we just gave a lot of people a whole retirement plan and a really good idea. But no, it's, Yeah. I mean the financial systems alone, they have, I know a whole bunch of fail safes against this kind of thing, but it is a, it is a pertinent threat. The other one that I didn't quite realize was for us civilians are cellular networks. If they get out of synchronization, again, this has nothing to do with how we navigate in the world. This is just like how our phones work. Data throughput could degrade, calls would drop, and then also become out of sync. Which at the very least would be extremely annoying. Yes, but I could imagine, I mean like that is annoying when it happens, but we need to scale it up
- [22:06]
C
to the business level, right?
- [22:07]
A
Yeah.
- [22:07]
C
Like if you say, okay, yeah, on the individual, like my daily needs probably would be annoying. You know, when it's, I would equate it to like a standard sell outage. You're like, man, that's really irritating. I wish this wasn't happening, but you're fine. But then you take that and you scale that up to, okay, let's say it impacts a whole state, the whole state government can't function now for a day. That's unacceptable. We can't have that happening. Or a power grid goes down, or let's even take it, worst case scenario, emergency happens, flooding, earthquake, tornado. Now we can't get emergency services out. We don't know where people need to go. It just scales that up and the risk factor up for providing support and being able to ensure that services that we have available are actually able to function the way we want them to.
- [22:57]
A
Load balancing, apparently for power grids and phase synchronization, which I don't quite understand what those are. Aside from those sound important to me and I don't want those things to not work. Those need GPS timing signals. So grid goes down. That's bad. I can understand on that level.
- [23:14]
C
Yeah.
- [23:15]
A
I need power.
- [23:16]
C
Yeah. It's kind of important for the modern society.
- [23:20]
A
Yeah. And then I think the most obvious one and probably ties into what you said at the very top of this episode was data centers, server farms, synchronization. Yeah.
- [23:33]
C
When I think you hop into the cloud and the more we have gotten away from, and for very good reasons, by the way, this is not me poo pooing.
- [23:43]
A
Everyone owning their own server farm.
- [23:45]
C
Exactly. I mean, for very valid reasons that we have migrated to the cloud for many, many organizations and obviously as AI continues to expand up and that even further, invest in these massive data centers that are not internalized at all. That is going to while give us a ton of technological advancements, also does very much open the door to single points of failures. And that is something that is obviously not something that people are unaware of. People talk about it, but I. Yeah,
- [24:20]
A
every time AWS east goes down, pretty much all of us get a day off from work.
- [24:24]
C
Exactly right. Like, but that's gonna be one of those things that I think when you talk about gps, it's a conversational point that has to be included and it will only grow more included because those impacts are now gonna be felt way, way more. And it's why some of these concerns have been growing over the past five years.
- [24:55]
A
I think we're going to end this episode right there. We've talked a little bit about the nature of what could go wrong and why that would be very bad.
- [25:00]
C
Yeah.
- [25:01]
A
So what are the actual threats and how would they work against GPS signals? We'll get into that in the next episode, so stick around for that.
- [25:08]
C
Look forward to seeing you then.
- [25:17]
A
And that's T minus Space Cyber Briefing brought to you by N2K CyberWire. If you like what you heard today, you will also enjoy our newsletter, Signals and Space. There was a lot of research that goes into talking about something as complex as gps. It has a fascinating history and we just could not fit all of it into this episode. But we made sure to include more historical context on GPS in our newsletter so you can dive even deeper and understand how this crucial system came to be what we know and love and rely on today. Our companion newsletter, Signals in Space, has the research and notes pulled together by our producer Ethan Cook and me, along with this week's top space Hyper news stories. So make sure to subscribe by visiting TheCyberWire.com newsletters that's newsletters with an S. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing cybersecurity landscape. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to spacen2k.com we're proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector. From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies, N2K helps cybersecurity professionals grow, learn, and stay informed. As the nexus for discovery and connection, we bring you the people, technology and ideas shaping the future of secure innovation. Learn how@n2k.com thanks again for listening to T Minus. I am your host, Maria Varmazes. The show is produced by Ethan Cook and Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Ibin with content strategy by Mayan Plout. Peter Kilpe is our publisher. See you next week.
- [27:20]
B
T minus.
- [27:31]
C
You can't reason with the sun. Trust us, we've tried this summer. It's time to put that angry ball of fire on mute. Columbia's Omnishade technology is engineered to protect you from the sun's harsh rays that can burn and damage your skin. The sun is relentless, but so is our gear. Level up your summer@columbia.com to spend more time outside and less time slathering on aloe lotion. You're welcome, Columbia Engineered for Whatever.