
Loading summary
Maria Varmazes
You're listening to the Cyberwire Network, powered by N2K. Maybe that's an urgent message from your CEO, or maybe it's a deepfake trying to target your business. Doppel is the AI native social engineering defense platform fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back from automatically dismantling cross channel attacks to building team resilience and more. Doppel outpacing what's next in social engineering. Learn more@doppel.com that's.p p e l dot com. Yeah, I remember when I was researching when I first started this job a few years ago. I remember I pitched to my boss at the time, Brandon Karp, and I said, you know, Brandon, I really want to research GPS spoofing. I'm fascinated about this. And so in my naivete, I started calling a bunch of companies that sell to the US government anti GPS spoofing technology. And I was like, can you tell me how this works?
Ethan Cook
You're like, excuse me, who are you?
Maria Varmazes
Welcome, I'm Maria Varmazes and you're listening to T minus Space Cyber Briefing. In this show we examine the evolution of cybersecurity in the global and orbital infrastructure that powers, protects and connects our lives. 3, 2, 1, 0, 0. Let's. Greetings, friends. Thank you for joining me today. Last week on this show, we explored why attacks against GPS and similar space systems matter in a cybersecurity context. Reminder, global navigation satellite systems like GPS are a key dependency for much of our critical infrastructure. And so this week we're all about the how. How do attacks against GPS signals typically work? Well, producer Ethan Cook joins me again to explore a few of the different attack types that we might typically encounter. Let's do this. Hey, Ethan, good to see you again.
Ethan Cook
I'm back.
Maria Varmazes
Yeah, you're back. Long time no see.
Ethan Cook
We're back for GPS part two.
Maria Varmazes
GPS part two. I mean, honestly, we're, we're probably going to have part three, four, five later.
Ethan Cook
It's never ending, by the way. You know, we're just going to, it's, we're just an iterative.
Maria Varmazes
Well, it is so crucial, and you said it brilliantly in the last episode about it is only gonna become more important to how modern technology infrastructure works. And it is vastly underappreciated for what a cornerstone technology it is right now. I certainly, I will raise my hand in that one. I don't think I appreciated how much we use it in our modern lives outside of the obvious, I think that's
Ethan Cook
the story of most technologies. You know, I think we're all like, man, this is so helpful. And when it goes down, we're like, this is the worst thing in the world. And then you realize, man, this is what it was 10 years go.
Maria Varmazes
Yeah, it's that XKCD comic of the entire Internet being held up by that one guy in Finland or whatever, which I have been told by all my friends who know this stuff that that is completely true. I think that that one guy in Finland also can sometimes be gps.
Ethan Cook
Yes.
Maria Varmazes
Do we realize how much is actually really dependent on this being accessible and the signals being correctly interpreted and all that kind of thing? When the phrase GPS hacking gets thrown around, at least when I started this job a few years ago, I thought we literally meant hacking the GPS satellites, which I think the US Space Force is like, I'd like to see you try.
Ethan Cook
It would be very difficult.
Maria Varmazes
It would be extraordinarily difficult. And they're like, bring it on, we're ready for you. So that's not. But that's not really what is meant.
Ethan Cook
It's a lot more ground focused and a lot more. I think the best way to describe it, at least from what I saw, was confusing signals rather than overpowering signals, rather than trying to take down networks.
Maria Varmazes
That's exactly it. That was. That surprised me a lot because I really thought it was like, oh, you know, the space horse is just going bing, bing, bing. And I'm sure they are genuinely staving off all these attacks against the actual satellites and the ground stations that they use. But they're in the military, they're handling their own thing for the rest of us. It is exactly that. Like just that phrase, we love the signal and the noise. This is literally that situation of like these signals being blasted out in a spherical radius from the GPS satellites. We monkey with those signals as they hit the ground because they're very weak.
Ethan Cook
They've gone through atmosphere, potentially weather impacts, bounced off walls. They're far, you know, gone through buildings. It's not something that you try to
Maria Varmazes
get GPS from inside a house. You're just like, nope, not getting it. Yeah, those are really weak signals by the time they get here. So they are really easy to mess with or fake or overwhelm. And that is essentially what. Why don't we go through maybe some of the frequent attacks against GPS signals? So we call them sort of shorthand hacking gps. But again, it's really attacks against the signals as they arrive on the ground. So what is your understanding of GPS signal jamming?
Ethan Cook
So it feels kind of obvious when you say it out loud and that you're jamming the signal. Right. You're killing the legitimate signal by oftentimes overpowering it. So the legitimate signal cannot go through. Yeah. Use cases for that would be okay. I don't want the signal to accurately find where I am taking that to a real world example, because I think when you talk about attacks, it's really hard to conceptualize impacts unless you have real world examples. The Ukraine war. There has been multiple use cases confirmed at this point that military drones use GPS signals to make sure that they're going to hit the intended target accurately and on time. So if there is a tank or fortification or building that I'm trying to hit as an attacker, I'm using a GPS signal to guide that drone to the correct target.
Maria Varmazes
Yeah.
Ethan Cook
Now, GPS jamming can be used to counter that. It's an emerging front. It's something that I think really has popped up as a mainstream as drones have become more popular in the Ukraine front. And I'm sure it is taking place in Iran as well, where you confuse and you overpower the GPS signals that are guiding that drone. And the drone doesn't know where it's going anymore. Yeah, it's still going to hit somewhere and explode, but it's likely not going to hit the thing that it was meant to hit. And obviously that doesn't negate its damage or reduce any casualties. You know, the logic behind it from a defensive perspective is it's not hitting the main target. So maybe it's hitting the building and still causing structural damage, but it's not going to cause the whole building to collapse or it's not going to hit the tank head on, it's going to bounce off. And maybe the tank suffers some mechanical damage, but the whole tank isn't imploded. So that's kind of the logic there.
Maria Varmazes
That's exactly right. On the way that I think of it for jamming is the GPS signal as it hits the Earth is like a bird gently chirping. And then if you're jamming, you've got a foghorn and you're trying to hear that chirping bird, but all you can hear is the freaking foghorn.
Ethan Cook
Yeah.
Maria Varmazes
And it's just like literally looking for that signal through the noise. Something that I found fascinating years ago when I was learning about this initially, was that a lot of GPS jammers used to be, and I'm sure they still are, if you know where to look very unsophisticated, like Bluetooth devices you could just plug into your car's cigarette lighter, if you still have one. There was a guy who did just that and got massively fined and I'm pretty sure also arrested, which makes sense. Yeah. This was back in 2013 and he operated a GPS jammer from his car sitting outside of Newark Airport in New Jersey specifically to mess with the signals that the airplanes are dependent on, which is a humongously dangerous thing. I mean, he was not the only one. This was just the headline that stuck out in my head. But you know, it is not a sophisticated attack. No, it's not.
Ethan Cook
Highly illegal.
Maria Varmazes
Highly illegal. Do not come after us. We have warned you. Don't do this.
Ethan Cook
It's incredibly dumb if you do.
Maria Varmazes
Yeah. And the equipment is extremely low cost, so it makes sense. Why, especially in war zones, this is like one of the first things that people do is your GPS is not going to do anything good for you. And as sort of dark as this is to say, one of my favorite websites to sort of track how this actually looks like on a global scale is this website called gpsjam.org and it's this really fascinating resource. I sometimes I just go there just to. This sounds weird. Just to look around. Yeah, it's just basically uses open source information based on information from commercial planes about how accurate the information is that they're getting. And you can see really easily where the contested zones are. I'm looking at it right now as we're talking. Yeah. Ukraine lit up. Iran lit up. The Strait of Hormuz, Forget it. But also looking near, I'm looking near Estonia right now. Estonia and the Baltics in general are just bright red. So is a whole bunch of the Baltics.
Ethan Cook
They are very close to two conflict zones.
Maria Varmazes
Exactly. And there are other spots, like I think I'm looking at Myanmar as well. Even on the US border with Mexico, there are some red spots there. So whether or not that is intentionally being jammed or it is jammed from other factors, this website can't delineate between
Ethan Cook
intentional or like atmospheric incidents or something.
Maria Varmazes
Or just like just heavy traffic or something. Yeah. The creator of this website, they mentioned that this is GPS interference as he can map it based on open source information. So don't try to extrapolate necessarily intent. Although in some cases it's obvious.
Ethan Cook
Yes.
Maria Varmazes
Like a conflict.
Ethan Cook
So surprise that you know Ukraine, not a surprise there. That GPS may be unreliable.
Maria Varmazes
Correct. Yeah. And also near the border with Turkey on the Black Sea. Also very, very Contested. So it also has a historical record, which again, can be fascinating looking back in time to see how bad were certain spots with GPS interference. So jamming is unsophisticated and sort of table stakes, I think, for a lot of modern warfare at this point. But sometimes it's also used in petty crime. It is accessible to dumb basic criminals who are just trying to mess with people.
Ethan Cook
I'm sure we'll scale up the punishment when they inevitably get caught.
Maria Varmazes
Yeah. So definitely don't do it in your airplanes. Good heavens. So now that we've spent some time on GPS jamming, let's take a quick break. When we come back, we're going to talk about GPS jamming's much more interesting and shall we say, sophisticated cousin. And that would be GPS spoofing. Stay with us. No one goes to Hank's for spreadsheets. They go for a darn good pizza. Lately, though, the shop's been quiet. So Hank decides to bring back the $1 slice. He asks copilot in Microsoft Excel to look at his sales and costs and help him see if he can afford it. Copilot shows Hank where the money's going and which little extras make the dollar slice work. Now Hanks has a line out the door. Hank makes the pizza. Copilot handles the spreadsheets. Learn more@m365copilot.com Work. So good, so good, so good. New markdowns up to 70% off are at Nordstrom rack stores now. Stock up and save big on shoes, tops, dresses, accessories and more must haves for summer. Join the nordiclub to unlock exclusive discounts. Shop new arrivals first and more. Plus buy online and pick up at your favorite rack store for free. Great brands, great prices. That's why you rack. Ethan, I want to you, you take the glory on this one. Explain GPS spoofing.
Ethan Cook
So if you know, for your cyber professionals out there, if you know what map our Mac address or ip, you know, address spoofing is same concept, right? We are taking our signal. We would be displayed as and manipulating it intentionally to show a different thing. A great real world example where this is happening already is in the strait of Hormuz. A lot of boats going through there. Well, maybe not as much as it used to be, but a lot of boats should used to be going through there. But you know, we use GPS signals. Boats use them to make sure that we and airplanes too, to make sure we aren't colliding with each other. Because these are massive vehicles, especially boats that are hauling very Very expensive precious cargo. If we were have a collision, not only would that be an environmental disaster, but it would be a significant financial loss. We saw what happened in the Suez Canal a couple years ago when that one boat got stuck in the side.
Maria Varmazes
Yes, the ever something.
Ethan Cook
Yeah, I can't remember the company.
Maria Varmazes
It was a weird name.
Ethan Cook
Shutting down a key choke point like that is pretty big. Now that was a legitimate example of just someone deciding to by accidentally steer into a canal wall. But I think in the Strait of Hormuz example, you have reports that a bunch of boats are being shown on land in perfect circles, which anyone who knows how a boat works, they don't travel over land. Crazy stuff.
Maria Varmazes
I was not familiar with that. Thank you for clarifying.
Ethan Cook
Yeah, it's revolutionary. This is why I went to college. And so anyone who looks at the map goes, ha, ha, ha ha. That's obviously not correct. Right. But I think when you boil that down to actual real world impacts, the answer is, okay, let's say it's nighttime on a foggy day on the sea by the Strait of Hormuz and you really can't see a boat and you're having to go through to deliver the oil or go pick up oil and you go, oh, oh, we have now slammed into another boat. Or you have now slammed into a. Because maybe your address is being also jammed simultaneously so you don't know where you are either. You have now slammed into a seabed that you can't get out of. Right. And you take that to a logical conclusion. It is dramatically impactful. It could shut down trade lanes, it could shut down effective communications. Human life factor is absolutely something that needs to be talked about. These are real world impacts that have significant costs to them.
Maria Varmazes
Yeah. The consequences are especially catastrophic for spoofing. The Strait of Hormones is a fantastic example. I remember not that long ago when smugglers were all over the like pirates were all over in the news. One of the ways that I think they were all also evading notice was by spoofing their own signal and being like, yep, we're definitely not where you think we are.
Ethan Cook
We're not in the middle of X, Y and Z. We are, you know, 800 miles to the, to the west and you're never going to be able to see or find us.
Maria Varmazes
Yeah. In fact, we're on the ground, don't even worry about it. Yes. You mentioned drones a little earlier. That's another huge problem because drones also are, you know, key in modern warfare. Yeah. And if you completely redirect where the drone's gonna go. Not just confuse it, but just, like, send it elsewhere or tell it to actually, hey, you're in the airspace of an airport, which will force it to land.
Ethan Cook
I didn't know that.
Maria Varmazes
Yeah, yeah. If you tell a drone, actually, you're in airport airspace, they will go, well, time for me to go down to the ground immediately. So, I mean, drone operators know that, but, like, that is a frequent way of kind of trying to mess with them and disrupt their operations. So spoofing is much more sophisticated. It is not easy to broadcast out a different signal that has bad information in it. So this is usually something we see the military doing.
Ethan Cook
I was gonna say, when I was doing my research, jamming was a much more readily available topic to find information on and cover spoofing. The. Pretty much what I got, which is, this is highly illegal. We will not tell you even how it remotely functions. And if you do it, it is a significant punishment.
Maria Varmazes
Yeah. I remember when I was researching, when I first started this job a few years ago, I remember I pitched to my boss at the time, Brandon Karp, and I said, you know, Brandon, I really want to research GPS spoofing. I'm fascinated about this. And so, in my naivete, I started calling a bunch of companies that sell to the US Government anti GPS spoofing technology. And I was like, can you tell me how this works?
Ethan Cook
Excuse me, who are you?
Maria Varmazes
I swear, this is for legitimate purposes. So obviously, nobody told me anything, that no one was gonna do that, of course. And I stupidly even tried. As I said, I'm on a list somewhere, if I wasn't already. But it was a dumb question to even ask, but I was genuinely curious. So the answer is, maria, if you want to find out, go join the military. So that's.
Ethan Cook
And work your way to the top.
Maria Varmazes
Work my way to the top? Like, yeah. And there's a flavor of spoofing that I keep finding a reference to. Have you heard of this one called Meekening?
Ethan Cook
I have not, but I love the name. Yeah, it's a great name.
Maria Varmazes
Yeah. I saw mention of it, and I'm going, that's fascinating. So instead of trying to broadcast a different fake signal that says, actually, I'm over there, it just captures the legitimate GNSS signal and then just rebroadcasts it with a slight delay or modification at a higher signal strength. So it's spoofing, but, like, a flavor of spoofing. And the receiver, whoever they are, that signal looks extremely legit to them. It doesn't look like it's been messed
Ethan Cook
with, but it's slightly off. Just enough.
Maria Varmazes
Just off enough that it could probably evade a quick glance, essentially. So because the signals are legit, but just like mistimed. Yeah.
Ethan Cook
Well, going to the point on the timing ambulation that we talked about last episode.
Maria Varmazes
Yes. And how insidious this could be. But there are lots of. If you're in the military or the government, there are lots of vendors that will sell you solutions for this. And that is not our lane. But these problems are only getting more and more insidious and the consequences are more and more catastrophic as we become increasingly dependent on gps. The really interesting thing to me is because specifically GPS is such an old technology, the signals are not encrypted. No. So I know forward thinking, the idea is one day these signals will be more spoof resilient because they will be encrypted. And some of the GNSS systems in other parts of the world have better
Ethan Cook
signal, I would imagine because they're newer as well.
Maria Varmazes
Yeah, yeah.
Ethan Cook
You have security forward mindsets when you invented them or built your networks 20 years later.
Maria Varmazes
Yes, that's exactly it. And we got into it a little bit with my interview with Dr. Sean Gorman. But some of the work that was being done to try and make GPS more resilient, especially in the ground systems, unfortunately was recently canceled because it was over budget and behind schedule.
Ethan Cook
Yeah, yeah. Ten years behind schedule and double the cost. The military likes to give you a long leash for off time and overpriced projects. But that was a. Yeah.
Maria Varmazes
Even though that one. Yeah, they've got their limits. So the line from the Space Force is they've got these incremental improvements that they're working on to make sure that at least for their things, things are, you know, more secure and they can ensure the fidelity of the signal that they're receiving and interpreting. But yeah, GPS is speaking specifically about gps. It's an older system and satellites are being incrementally replaced over time. But you know, it's not a wholesale thing. It's just kind of one in, one out. Maybe one day we'll have fully encrypted signals from GPS would be nice, but it's not tomorrow,
Ethan Cook
it's not in the next five years.
Maria Varmazes
No, no. So I think the advice for a cybersecurity professional knowing that like pretty much everything in modern society there are a lot of flaws and this technology that can be easily exploited is just knowing, in my opinion, where the heck it's being used. What are your dependencies in your environment? For gps, I feel like it begins and ends really right there.
Ethan Cook
I think it's a, it is a risk management factor. It is something that you should be aware of if you're, if you're in, let's say finances, where you're prone to it, or it could be impactful, but it is not something that you as an individual or even as an organization can make and, you know, really shake up and fix. This is kind of the thing that you, you have redundancies in place to account for if something goes wrong, but you aren't sitting here being like, oh, let me buy the latest solution that fixes this.
Maria Varmazes
That's not, you know, the average infosec professional is not going to be no securing gps. That, that's the Space Force's job.
Ethan Cook
That's the thing you cross and hope for that. We got good people there.
Maria Varmazes
Yeah, exactly. Best men and women working on that. So, yeah, so just knowing that your dependency and managing that risk as best you can, planning around the fact that is not infallible, that's really the takeaway of an advice there as far as I'm concerned. But Ethan, I'm curious if there's any other thoughts you have on that.
Ethan Cook
Yeah, I think it kind of reinforces the conversation that these are technologies that. Because especially with the modern world as we continue to advance, these are not something that we can just hope they don't get attacked. It's already being attacked. These are things that already people are trying to exploit and successfully do all the time. And we should not rest on the laurels of let's hope it gets better or hope that we can just deal with this. This is something that I think a proactive approach of. We need to address, we need to talk about. We need to get governments invested in wanting to increase these, even if previous attempts haven't necessarily been successful. Don't let that kind of be the dying point. Let that be the initial point of a conversation of like, okay, we need to learn why this didn't work previously in our last attempt. Correct that and make sure we have reasonable timelines and cost expectations and address this now.
Maria Varmazes
Yeah, that's a federal government procurement right there. That's a whole other show. But I know that's a lot of your world also, so that's good points though.
Ethan Cook
It's a headache world.
Maria Varmazes
Yeah, no, that. The understatement of the century right there. As we're talking through and as I was listening to you talking about gps, a lot of this reminds me of just discussions about how the Internet came to be. And they said, well, maybe we'll let civilians start using this and not just like a few universities. I mean, they never could have anticipated what it would become. And same thing I don't think they
Ethan Cook
did with GPS when Clinton was like, hey, guys, everyone's. It's free for everyone. You know, go crazy. I don't think the logical conclusion was, well, what are the modern implications of drone warfare for this?
Maria Varmazes
What's a drone?
Ethan Cook
Yeah, exactly.
Maria Varmazes
None of this was anticipated, and it's been successful beyond the United States military's wildest dream, I'm sure. And it's what. What an incredible legacy. Not again. They're not paying me to say that. It's just. It's. It's just kind of amazing, the Internet and gps, like, what. What they've ended up becoming. They weren't meant for civilian use to begin with, so they weren't built with, you know, the idea of thousands of millions of literally billions of us trying to poke holes in them all the time. Exactly. So. And yet that's what we're doing because we're human beings, so we have to kind of just do the best we can with these flawed because they're made by humans systems. So, yeah, know your dependencies and you risk exposure. And that's about it. Yeah, I think.
Ethan Cook
Well said.
Maria Varmazes
Yeah. Thank you. All right, well, Ethan, thanks again for joining me and thanks for having me. Yeah, of course. Come on back next time.
Ethan Cook
Always.
Maria Varmazes
And that's t Space Cyber briefing, brought to you by N2K CyberWire. If you like what you heard today, you will also enjoy our newsletter signals and Space. You'll get research and notes pulled together by our producer, Ethan Cook and me, along with this week's top Space Cyber news stories. Subscribe by visiting TheCyberWire.com newsletters that's newsletters with an S. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing cybersecurity landscape. If you like this show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to space2k.com we're proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector. From the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies, N2K helps helps cybersecurity professionals grow, learn and stay informed. As the nexus for discovery and connection, we bring you the people, technology and ideas shaping the future of secure innovation. Learn how@n2k.com thank you for listening to T minus. I am your host Maria Varmazes. The show is produced by Ethan Cook and Liz Stokes. We are mixed by Elliot Peltzman and Trey Hester with original music by Elliot Peltzman. Our Executive producer is Jennifer Ibin with content strategy by Mayan Plout. Peter Kilpe is our publisher and we will see you next week. T minus. Foreign.
Ethan Cook
The right window treatments change everything. Your sleep, your privacy, the way every room looks and feels. @blinds.com We've spent 30 years making it surprisingly simple to get exactly what your home needs. We've covered over 25 million windows and have 50,000 five star reviews to prove we deliver. Whether you DIY it or want a pro to handle everything from measure to install, we have you covered. Real design professionals, free samples, zero pressure right now. Get up to 45% off site wide plus get a free professional measure. At blinds.com rules and restrictions apply.
Podcast: T-Minus: Space-Cyber Briefing
Host: Maria Varmazes
Guest/Producer: Ethan Cook
Date: June 7, 2026
Main Theme:
This episode explores the practical realities of attacks on GPS signals—specifically, jamming and spoofing—and how these manipulations threaten global security, critical infrastructure, and modern warfare. Maria and Ethan break down both attack vectors with compelling real-world examples and discuss why GPS vulnerabilities are of growing concern for cybersecurity professionals.
The Ubiquity and Fragility of GPS
GPS is a “cornerstone technology” for modern infrastructure, far beyond its original purpose ([02:59]):
"It is vastly underappreciated for what a cornerstone technology it is right now. ...I don't think I appreciated how much we use it in our modern lives outside of the obvious"
—Maria Varmazes [02:59]
GPS manipulation is not about “hacking the satellites” ([03:46]):
"When the phrase GPS hacking gets thrown around...I thought we literally meant hacking the GPS satellites, which I think the US Space Force is like, I'd like to see you try. ...It's a lot more ground-focused." —Maria Varmazes [03:47], Ethan Cook [04:17]
What is GPS Jamming?
“They're very weak signals by the time they get here. So they are really easy to mess with or fake or overwhelm.” —Maria Varmazes [05:11]
Real-world Example: Warfare and Civilian Risks
"Military drones use GPS signals to make sure they’re going to hit the intended target accurately and on time...now GPS jamming...the drone doesn't know where it's going anymore." —Ethan Cook [06:31]
"The GPS signal as it hits the Earth is like a bird gently chirping. And then if you're jamming, you've got a foghorn and you're trying to hear that chirping bird, but all you can hear is the freaking foghorn." —Maria Varmazes [07:26]
Simplicity and Dangers of Jamming
"A lot of GPS jammers used to be, and I'm sure they still are, if you know where to look, very unsophisticated, like Bluetooth devices you could just plug into your car's cigarette lighter." —Maria Varmazes [07:45]
Illegal and Global Prevalence
Heavy legal penalties for civilian use ([08:48]):
"Highly illegal. Do not come after us. We have warned you."
—Maria Varmazes [08:50], Ethan Cook [08:55]
Live tracking of jamming:
“Ukraine lit up. Iran lit up. The Strait of Hormuz, forget it. ...Even on the US border with Mexico, there are some red spots there.”
—Maria Varmazes [09:55]
What is GPS Spoofing?
"If you know what mac address or IP, address spoofing is, same concept, right? ...Manipulating [the signal] intentionally to show a different thing." —Ethan Cook [12:48]
Impact Examples
"...reports that a bunch of boats are being shown on land in perfect circles, which anyone who knows how a boat works, they don't travel over land." —Ethan Cook [13:42]
"I remember...when smugglers...were all over in the news, one of the ways...they were evading notice was by spoofing their own signal." —Maria Varmazes [15:15]
“If you tell a drone, actually, you're in airport airspace, they will go, well, time for me to go down to the ground immediately.” —Maria Varmazes [16:08]
The Rarity, Secrecy, and Difficulty of Spoofing
"Jamming was a much more readily available topic to find information on...The pretty much what I got [on spoofing] is, this is highly illegal. We will not tell you even how it remotely functions." —Ethan Cook [16:34]
Mitening/Meaconing: Special Flavors of Spoofing
"It just captures the legitimate GNSS signal and then just rebroadcasts it with a slight delay or modification at a higher signal strength. So it’s spoofing, but a flavor of spoofing." —Maria Varmazes [17:53]
Why is Spoofing Possible?
GPS is old and unencrypted ([19:16]):
"The really interesting thing to me is because specifically GPS is such an old technology, the signals are not encrypted." —Maria Varmazes [19:16]
Some (newer) global GNSS systems may have improved security ([19:19]).
Critical Recommendations for Professionals
Main defense: Risk awareness and management ([20:31]):
“...knowing...where the heck [GPS] is being used. What are your dependencies in your environment? For GPS, I feel like it begins and ends really right there.”
—Maria Varmazes [20:31]
GPS insecurity is not easily “solved” at the organizational level; true solutions are at the governmental or infrastructure level ([21:18]):
"You have redundancies in place to account for if something goes wrong, but you aren't sitting here being like, oh, let me buy the latest solution that fixes this." —Ethan Cook [21:18]
Systemic Challenges
Incremental improvements exist, but major U.S. government modernization efforts have struggled ([19:26]):
"...some of the work that was being done to try and make GPS more resilient...was recently canceled because it was over budget and behind schedule." —Maria Varmazes [19:26]
Most advice for organizations: Know your risk exposure and plan for GPS unreliability ([23:27]):
"They weren’t meant for civilian use to begin with, so they weren’t built with...the idea of...billions of us trying to poke holes in them all the time." —Maria Varmazes [23:27]
Call to Action
"We need to address, we need to talk about...correct that and make sure we have reasonable timelines and cost expectations and address this now." —Ethan Cook [21:46]
On GPS's Fragility:
“It’s that XKCD comic of the entire Internet being held up by that one guy in Finland...that one guy in Finland also can sometimes be GPS.”
—Maria Varmazes [03:31]
On the Simplicity of Jamming:
“It’s not a sophisticated attack. No, it’s not...Highly illegal.”
—Maria Varmazes [08:48], Ethan Cook [08:50]
On GPS Signal Weakness:
"The GPS signal as it hits the Earth is like a bird gently chirping...if you're jamming, you've got a foghorn."
—Maria Varmazes [07:26]
On the Need for Real Resilience:
"We cannot just hope they don't get attacked. It's already being attacked."
—Ethan Cook [21:46]
The episode demystifies how GPS jamming and spoofing attacks work, emphasizing their increasing relevance, simplicity of execution (for jamming), and the catastrophic consequences for critical infrastructure and modern warfare. The hosts stress the importance of organizational awareness of dependencies and systemic advocacy for stronger, encrypted, and resilient navigation infrastructures.
Main takeaway:
Know your dependencies on GPS, acknowledge its vulnerabilities, and build risk management strategies. True security solutions will require systemic upgrades and government-level commitment.