Airway UM688 Iraq: Fake GPS signals causing nav failure over Iraq

[70 Mustang]

Flights Misled Over Position - Nav Failure Follows

- New RISK WARNING: Enroute aircraft are being targeted with fake GPS signals, leading to complete nav failures
- 12 separate reports – types include Embraer 190, Boeing 737, 747 and 777, G650, CL650, Falcon 8X and Global Express.
- This type of GPS spoofing has not been seen before – IRS is quickly “infected” by false position

- OPSGROUP Members: Suggested Guidance and Procedures, and original crew reports, in Briefing PDF below.


https://ops.group/blog/gps-spoof-attacks-irs/

[JanetFlight]

Many moons ago someone in this Forum advised me that ops.group was not supposed to be taken so seriously :)

[70 Mustang]

Just sent the link to a friend who now flies out if the sandpit
and received this within a few minutes.

"at one point the ANP went up 20.0 … aircraft started to turn not knowing at all where it was… luckily it was a very short outage, so i kept in TRK SEL…maintened the course till the outage/wrong signal vanished and then re engaged!!
But it was the first time its been such a huge nac error,
Normally that area is already riddled with jamming and gps messes up!!"

He said he flies that airway quite often.

Couldn't that also be said of this website? This thread may soon be removed?

[Luc Lion]

Strange.
Spoofing the signal of a single GPS satellite would just result in the RAIM system discarding that satellite data.
And spoofing the signal of all satellites that are in line of sight would be extraordinarily complex, would be valid for a single airplane and would require knowing the exact location of that plane.
The only spoofing strategy that (I think) appears to be simpler is spoofing the EGNOS signal for en-route augmentation.
However, I guess that all GPS receivers can be set to enable/disable SBAS signals.

[STBYRUD]

It's been happening for years, but the results are getting more interesting. In the 737NG it starts with a GPS INVALID L/R, if that state persists for a while you'll get the GPS and GLS fail lights as well. In five percent of the flights or so I've seen the UTC time reappear on the clocks, but several hours off - that's quite impressive - so the signals were good enough to get through the RAIM logic at least momentarily. That also causes lovely false EGPWS warnings, TOO LOW TERRAIN for instance when you're on short final on an ILS or so. Since I mainly fly in that area I'm unfortunately used to it by now, but not being able to fly RNP procedures, not having terrain display and reverting to conventional navigation with ANP above 5NM are really reducing the safety margins.

[FullWings]

I’ve flown through there what seems dozens of times since the jamming and spoofing started. I hear some operators have been getting EGPWS terrain warnings, i.e. pull-ups, in the cruise and/or on approach to destination as the GPS altitude can stay messed up on some receivers even when the jamming has stopped.

The funniest one was last year when somewhere over northern Iraq all the reminders we’d put in the system went off at once. I thought the interference might have spoofed the time but it was the same as on the iPad. Hmm. Checked the date and it was several days in the future, very clever!

[Check Airman]

Many moons ago someone in this Forum advised me that ops.group was not supposed to be taken so seriously :)

What’s ops.group? Some sort of conspiracy theorist hideout?

[172_driver]

- This type of GPS spoofing has not been seen before – IRS is quickly “infected” by false position


Is that poorly worded? The IRSes themselves wouldn't be affected would they, looking at the raw IRS output? Whatever the FMC is tricked to do with all navigation inputs is another question.

[Sailvi767]

We would lose both GPS’s on nearly every departure out of TLV going north toward Turkey. Lots of Jamming in Syria. Some of the A330’s would not reacquire the GPS signal exiting that area resulting in NATS restrictions. I understand Airbus has since fixed that issue.

[Klauss]

I think that the OPS group is for real, and serioius.

[atakacs]

GPS jamming is one thing. Spoofing, especially a lasting / actionable one as some report here is an altogether different proposition.
I am really surprised it is actually happening to that extent. This need some serious “gear” and competency - what is the intent ? Sure not just annoy overflying aircraft ?

[Less Hair]

Could it be a certain country trying to avoid precision strikes on its nuclear arms infrastructure?

[kristofera]

From a purely technical perspective, wouldn't retransmission of GPS signals with a high powered transmitter be able to achieve something like this? Low-powered retransmission of GPS signals is sometimes used to improve GPS coverage indoors, but if done with a high power transmitter that drowns out the signal from the satellites to nearby receivers, wouldn't that make other receivers think they are at the location and altitude of the retransmitted signals..?

[atakacs]

From a purely technical perspective, wouldn't retransmission of GPS signals with a high powered transmitter be able to achieve something like this? Low-powered retransmission of GPS signals is sometimes used to improve GPS coverage indoors, but if done with a high power transmitter that drowns out the signal from the satellites to nearby receivers, wouldn't that make other receivers think they are at the location and altitude of the retransmitted signals..?
Short answer yes but you have to "recompute" your output so that the receiver "sees" something (ie multiple satellites with a coherent signals) that will pass validation. Not trivial. I mostly wonder about the cost / benefit of this applied to commercial airliners overflying Iraq.

[grizzled]

I think that the OPS group is for real, and serioius.

For real, sort of. Serious, no.

[lederhosen]

Surely this is likely not to be aimed at the airliners. They are collateral damage. The russians have had a lot of aviation assets on the Syrian side of the border. Iran is not far away (and indeed was lobbing missiles at Erbil airport not so long ago) and the Turkey/Kurd situation means that there are any number of big players who might be behind this for primarily military purposes. However I certainly would not fancy flying between the mountains into Sulemanyah right now in the middle of the night in poor weather.

[ATC Watcher]

Nothing new. The Russians regularly used spoofing and since years , especially during navy maneuvers, I remember some ships found themselves 30 NM inland Norway a few years ago,
It is not rocket science to do but is likely a State capability, but seen the recent military exchanges between Russia and Iran , Less hair hypothesis above earlier looks plausible.

[Klauss]

hi, question is, what is beeing done to address the GPS trouble. NOTAMs are out since a long time. Example: "A0639/23 NOTAMN Q) ORBB/ A) ORBB B) 2308050000 C) 2311042359 E) 1-ALL AIRLINES FLYING THROUGH BAGHDAD FIR-ORBB SHOULD EXPECT GPS JA MMING/GNSS INTERFERENCE IN THE NORTHERN PART OF IRAQ ALONG THE ATS RO UTE UM688 FROM RATVO TO VAXEN............ So, is the airspace avoided or or what´s beeing done ? Not enough, I think.

[hunterboy]

If there is extra cost involved…what do you think the airlines are going to do…?

[FullWings]

It’s not like you can avoid the area easily - for many airlines Damascus, Kyiv, Amman, Jeddah, Baku, Tehran, Kabul, Sanaa, etc. FIRs are out-of-bounds, in part or in whole, which makes routing to/from the Middle and Far East problematic at the best of times. Even Baghdad FIR is deemed unsafe at lower levels.

[Klauss]

Yes, it may not be easy, but
a) has anyone heard of airline operational procedures to fly without GPS, like ´deselect GPS. Announce to ATC ´unable RNP´ the moment this occurs, despite DME updating ?
or
b) For ATC: change affected airspace way from closely spaced RNP values to something that can be flown without GPS. ?

Better to take action than explain things to the ??? party whose airspace was infringed or whatever.
?

[compressor stall]

Yes, it may not be easy, but
a) has anyone heard of airline operational procedures to fly without GPS, like ´deselect GPS. Announce to ATC ´unable RNP´ the moment this occurs, despite DME updating ?
?

I can’t speak for all OEMs but that’s not Airbus SOP (yet).
https://safetyfirst.airbus.com/gnss-interference/amp/

Spoofing (false position) has been around for ages , although generally more in “hot” zones rather that an airway used by hundreds of aircraft a day.

There has been jamming (corrupted / no signal) along that airway on the Iraq Türkiye border for years, but clearly for some aircraft something new is afoot in that region

[FlightDetent]

I can’t speak for all OEMs but that’s not Airbus SOP (yet).
https://safetyfirst.airbus.com/gnss-interference/amp/ Appreciate the link.

[ATC Watcher]

b) For ATC: change affected airspace way from closely spaced RNP values to something that can be flown without GPS. ?
?
That is a very interesting question .
In my days in the airspace I controlled that would not be possible, if your primary Nav equipment failed , what ever that is, NDB, VOR, or GPS ,we expect you to have a back up , and if not, then we'll give you radar vectors and that's it. We cannot change the routies or the separation standards for that. . In an non radar area , or in ADS-B airspace, I guess that would be an emergency situation and consequently emergency (vertical) separations will apply. ,
But , especially in today's increasing unstable world, and era , maybe there are new procedures that I am unaware of. Will check. Curious too..

[Klauss]

Thank you, Compressor Stall, for the link. Really interesting, really good description of what happens to the various Airbus.
What I am missing is the description of a procedure that keeps aircraft safe, like
a) avoid areas of know interference and spoofing (simple, but impractical in this day and age, I guess. It´s ubiquituous. Either for real, or for ´GPS on TEST´ ...)
or
b) PRIOR to entry into suspected GPS Jamming / Spoofing areas, perform 1) + 2) + 3) ....

Didn´t see it. Also in view of timing issues reports, the problem seems to go deeper, more than navigation.
So, can the use of GPS even be 100 % disabled ?

Re airspace: might be causing raised eyebrows if that has to be changed due to jamming/spoofing, right ?

[70 Mustang]

A colleague just sent this message tonight:

"got the spoof in UM 866, nav was handled… the side effect later was that the terrain data base was destroyed, so leaving Fl220 to Fl210 over water in Bahrain airspace got terrain PULL UP, and it never stopped… just kept going… terrain ovrd in the end to deal with it, but super annyoing to have that shouting when flying knowing its a spurious one!!"

apparently it could remove a safety-net item that could be a factor on a low vis approach, with a possible altimeter setting error.

[ATC Watcher]

So, can the use of GPS even be 100 % disabled ?

Yes. GPS can be disabled as the US Pentagon has the key .( first degrade the accuracy, then the signal.)
Re airspace: might be causing raised eyebrows if that has to be changed due to jamming/spoofing, right ?
Yes again . As promised I checked with my contacts in both Canada and Australia , the heavy current users if ADS-B for surveillance, and both confirmed there are no specific airspace procedures to mitigate GPS outages .

[balsa model]

From a purely technical perspective, wouldn't retransmission of GPS signals with a high powered transmitter be able to achieve something like this? Low-powered retransmission of GPS signals is sometimes used to improve GPS coverage indoors, but if done with a high power transmitter that drowns out the signal from the satellites to nearby receivers, wouldn't that make other receivers think they are at the location and altitude of the retransmitted signals..?
Short answer yes but you have to "recompute" your output so that the receiver "sees" something (ie multiple satellites with a coherent signals) that will pass validation. Not trivial. I mostly wonder about the cost / benefit of this applied to commercial airliners overflying Iraq.
Perhaps not as difficult as you think. Some receivers (I don't know how many but definitely some I've worked with (*)) appear to have been designed without any thought given to spoofing. So computations with geometrically too incoherent data will still produce solutions on some kind of a best-effort basis. Until such receivers get fixed with firmware updates, one has to be wary.
And even afterwards, because more sophisticated methods will inevitably become accessible to a wider audience, as time marches on.

PS: (*) These were NOT aviation receivers, before anyone asks for names.

[albatross]

And yet, here in Canada as elsewhere, they are enthusiastically decommissioning NDBs, VOR/DME ect. at an accelerating rate.
Nothing like putting all your eggs in one basket.
“What could possibly go wrong?”

One of the funniest things I ever saw was a complete GPS failure 142 NM offshore in a helicopter. The total helmet fire in the opposite seat was a wonder to behold. Ah nothing like a “Child of the Magenta” when the magic box stops working. He had never flown without GPS and he was supposed to be a Capt. and a Training Capt. to boot.

https://youtu.be/5ESJH1NLMLs?si=FyvkES6X6-0dqID2

[negativeclimb]

And yet, here in Canada as elsewhere, they are enthusiastically decommissioning NDBs, VOR/DME ect. at an accelerating rate.

Same bull**** in Europe, the plan of EASA is to replace the ILS cat I with RNAV GNSS procedures only. So ridicolous.

[70 Mustang]

Just saw the promo video for the PT6E-66XT
with the single lever control and self starting electronic systems.

With the economic forces driving the industry's components to less weights, less components to mechanically fail and less opportunities of pilot mistakes...

Are they creating more aircraft, engines and nav systems that will be even more "hackable" or completely disabled via targetted attacks from adversaries?

[ATC Watcher]

.

Are they creating more aircraft, engines and nav systems that will be even more "hackable" or completely disabled via targetted attacks from adversaries?
Again the answer is Yes.
One aircraft manufacturer ( will not say which one ) in order to reduce weight and cost of installing Kms of cables is proposing to link electronic boxes , including flight controls via some kind of Bluetooth connections. I am not sure how this will float with the regulators and will evolve but it seems to be more and more the way to go .
Jamming a frequency or disabling an antenna is very easy and very cheap to do., as Hamas demonstrated last Saturday. ( Dixit the New York Times this morning)

[mrmalibu]

Saw this posted on the gcmap.com homepage:

"Over the past ten or so days, aircraft have been targeted with fake GPS signals, leading to a loss of onboard navigational capability. The majority of these incidents have been along the Iraqi portion of Airway UM688, near the Iranian border. Unlike GPS jamming, which merely causes the loss of GPS and thus reliance on the INS (Inertial Navigation System), the spoofing feeds erroneous data into the system which confuses the INS. (It seems fair to wonder why the INS doesn't detected the mismatch and reject the GPS data.)

Most of the reports have involved failures near Erbil, Sulaimaniyah, Baghdad and involved shifts of about 60 nm"

Apparently all onboard navigation, including the IRS and the UTC clock, are affected and corrupted by the false GPS signal. One aircraft nearly strayed into the Iranian FIR, another needed radar vectors all the way to Dubai. Didn't see anything about this on pprune so figured I should post in case any of you operate in the area

[Jonty]

Saw this posted on the gcmap.com homepage:

"Over the past ten or so days, aircraft have been targeted with fake GPS signals, leading to a loss of onboard navigational capability. The majority of these incidents have been along the Iraqi portion of Airway UM688, near the Iranian border. Unlike GPS jamming, which merely causes the loss of GPS and thus reliance on the INS (Inertial Navigation System), the spoofing feeds erroneous data into the system which confuses the INS. (It seems fair to wonder why the INS doesn't detected the mismatch and reject the GPS data.)

Most of the reports have involved failures near Erbil, Sulaimaniyah, Baghdad and involved shifts of about 60 nm"

Apparently all onboard navigation, including the IRS and the UTC clock, are affected and corrupted by the false GPS signal. One aircraft nearly strayed into the Iranian FIR, another needed radar vectors all the way to Dubai. Didn't see anything about this on pprune so figured I should post in case any of you operate in the area


Interesting.

On the small bus you can deselect the GPS and switch the clock to internal. It’s like being back in the 1990s!

[megan]

It’s like being back in the 1990sIf things really go down the drain you good folk might have to return to the 50's and those sextant thingies. ;) Some military have returned to the lost art I believe as a just in case. Talk in some quarters of inertial being backed up by Astro as used in the SR-71 being developed for commercial ops.

[IBMJunkman]

Dumb question. Given that most likely the bad actors don’t actually have satellites and, I assume, GPS signals only come from satellites why can’t airplanes only use GPS signals that come from the top of the plane? Ignore GPS signals from the ground.

[ATC Watcher]

Given that most likely the bad actors don’t actually have satellites
The Russians have a lot of them and are the main culprits in North/East Europe, I have no idea when the jamming/spoofing comes from but in theory it could come from other satellites.

[Fursty Ferret]

Dumb question. Given that most likely the bad actors don’t actually have satellites and, I assume, GPS signals only come from satellites why can’t airplanes only use GPS signals that come from the top of the plane? Ignore GPS signals from the ground.

For the same reason your kitchen radio works if you turn it upside-down.

[Sallyann1234]

An accurate fix requires signals from a number of satellites, that will be spread over a wide angle. Not just one or two directly above. So the GPS receiver needs a wide beamwidth.

To maintain continuous jamming over a defined area by satellite would be a difficult and expensive business. Why bother when jamming from a ground station, even a mobile one, is relatively easy.

[MechEngr]

With a narrow beam antenna one could feed in a gradually increasing change and steer a user any way one wanted.The main defense would be to realize the fake is higher power than expected. Update the ephemeris data and the receiver can become out of sync with the actual constellation and can then follow a broadcast.

A general method for detecting this would be tracking known radio sources, but not many aircraft have direction finders.

[Klauss]

Got a questiion: the ´bad guys´ are somewhere in the Iraq / Turkey / Iran / Russia area. Bad enough. What about all the activity in the West that´s Notam-public, like in the US or UK or Germany or or ... ??

[sprinte]

GPS Spoofing being reported in vicinity of Amman, Jordan.

[Sallyann1234]

Got a questiion: the ´bad guys´ are somewhere in the Iraq / Turkey / Iran / Russia area. Bad enough. What about all the activity in the West that´s Notam-public, like in the US or UK or Germany or or ... ??
What about it? Sometimes necessary for military training or other security issues. Not an issue if you read the NOTAM.

[Klauss]

What about it? Sometimes necessary for military training or other security issues. Not an issue if you read the NOTAM.

Well, I can read ...but the airplane or it´s computers can´t . > GPS

[ATC Watcher]

Well, I can read ...but the airplane or it´s computers can´t . > GPS
That is basically why there is still a human in the cockpit :E
The idea of the NOTAM is that it is read before departure and mitigation is taken . i.e do not rely 100% on GPS in an area NOTAMed for GPS outages ,

[Klauss]

OK, so I read that GPS= potentially out over xxx area.
My MEL says GPS=out = ADS-B = out.
What do I tell ATC ? Do they quickly install different surveillance or return to larger separation ?

I can read - my airplane / the airplane systems can´t.

[ATC Watcher]

OK, so I read that GPS= potentially out over xxx area.
My MEL says GPS=out = ADS-B = out.
What do I tell ATC ? Do they quickly install different surveillance or return to larger separation ?
I can read - my airplane / the airplane systems can´t.
Will all depends where this happens,
Over land , under SSR coverage just tell ATC you.'ve lost GPS, and request radar vectoring
North Atlantic , half of it is now radar covered . so ATC has a fall back, , outside of it is the issue , there is no real urgency as ATC know your last position the system can extrapolate, if it last long , then we have a problem and emergency separation ( 500ft ) might be applied. As I posted earlier both Canada and Australia , the main users of ADS-B alone ( not backed up by radar) have no published procedures for this .
ASECNA ( Africa) is currently installing it , and there I would be very , very careful ,as communications is also an issue .

Now that is is for unforeseen hostile jamming , back to NOTAMs, again , if there is a published outage, ADS-B , outside -radar coverage, ADS-B separation will not be offered by ATC during that period and you will enter that airspace procedurally separated as before.

[megan]

From Avweb.GPS Spoofing Signals Traced To Tehran

A University of Texas student has traced the source of alarming GPS spoofing signals in the Middle East to the eastern outskirts of Tehran, but it would seem there is little anyone can do to stop the navigation interference. Todd Humphreys, who heads up the Radionavigation Laboratory at UT, said the grad student, Zach Clements, was able to use gear on the International Space Station to scan for the bogus signals and approximate their source. He said analysis of the signals themselves suggests it’s a more sophisticated form of jamming, the cruder form of which is ubiquitous in the region. “They seemed to be aimed at denial of service rather than actual deception,” Humphreys told Vice (https://www.vice.com/en/article/m7bk3v/commercial-flights-are-experiencing-unthinkable-gps-attacks-and-nobody-knows-what-to-do). “My students and I came to realize that spoofing is the new jamming. In other words, it is being used for denial of service because it’s more effective for that purpose than blunt jamming.”

Since late September, the website Ops Group (https://ops.group/blog/new-gps-spoofing-incident-shows-how-it-works/) has been collecting reports from pilots flying in the Middle East reporting satellite-based navigation equipment giving them false position reports. In some cases, their panels have told them they’re as much as 120 miles from their actual location, prompting the FMS to react. Some crews have had to ask ATC for vectors to keep them on course. Humphreys said the alarming development is the spoofing affects both the GPS-dependent equipment and the Inertial Reference System (IRS). The two systems are supposed to operate independently and the IRS was thought to be immune to that kind of tampering. It affects the main system and their backups simultaneously. “The GPS and IRS, and their redundant backups, are the principal components of modern aircraft navigation systems,” Humphreys said. “When their readings are corrupted, the Flight Management System assumes an incorrect aircraft position, Synthetic Vision systems show the wrong context, etc.” He said crews eventually figure out something is wrong and use old-fashioned tools like VOR and DME, but those are not always available and they have to call up ATC.

[mmm998]

Looking at flight radar it seems spoofing on bagh fir is going so far tonight!!!

[OuchSpud]

An accurate fix requires signals from a number of satellites, that will be spread over a wide angle. Not just one or two directly above. So the GPS receiver needs a wide beamwidth.
To maintain continuous jamming over a defined area by satellite would be a difficult and expensive business. Why bother when jamming from a ground station, even a mobile one, is relatively easy.
Jamming would be easy, spoofing is what is being talked about here. The Rx beamwidth does not matter, a strong enough signal comprised of all the sat spoof signals with drown out the real ones.
But they wouldnt spoof over a large area anyway, it would have to be directed at a small area/single target to be effective, i.e.trick the check logic.
Spoofing would have to come from above where the Rx antenna is, and we can guess the players that have that hardware.

[ATC Watcher]

Spoofing would have to come from above where the Rx antenna is, .
Do you mean / imply that Spoofing can only be done from Satellites ( or AWACS) ? That would indeed limit a lot the possible perpetrators..

[OuchSpud]

Do you mean / imply that Spoofing can only be done from Satellites ( or AWACS) ? That would indeed limit a lot the possible perpetrators..
I would think so, GPS frequencies are line of sight, and therefore with the Rx antenna on top of the a/c theres going to be a huge dead area under the aircrafts radio shadow where a ground station would be ineffective.

[kippers47]

So is anyone on either Airbus or Boeing fleets inhibiting GNSS in this airspace?

[xray one]

So is anyone on either Airbus or Boeing fleets inhibiting GNSS in this airspace?

This would be against Airbus SOPs (don't know about Boeing)

[A320251N]

Airbus doesn't prohibit you to deselect the GPS, it only says that you shouldn't do it, because when it was just a GPS jamming, the signal was supposed to come back shortly.

To my experience, deselecting the GPS and setting the clock to INT as soon as the ECAMs start to pop up and after checking that I really lost the GPS position has worked nicely. By the way, the NAV ACCURACY never dropped below HIGH.