Adaptive GNSS spoofing for drone hijacking

1. Summary

The satellite-navigation (GNSS) receiver in consumer drones accepts and trusts civilian GPS L1 C/A signals at 1575.42 MHz with no verification of their authenticity or origin [1][2]. An attacker in radio-frequency proximity, using a commodity software-defined radio, can transmit counterfeit L1 signals stronger than the genuine satellite constellation, causing the receiver to lock onto the false signal and report a fabricated position to the flight controller [2][8]. The distinguishing element of this work is that the false position is shaped over time so it never trips the drone’s spoofing/consistency fail-safes, letting the attacker steer the autopilot along a chosen path [2][6]. The core defect is an unauthenticated, unverified sensor input feeding the navigation state estimator; the downstream physical consequences are treated in Section 6.

2. Affected products & versions

Demonstrated targets are the four drones above [3][6]. Because the defect is a property of the unauthenticated civilian GPS L1 signal itself and of receiver/autopilot trust in it, no vendor version boundary exists and the weakness generalizes across the class of consumer GNSS receivers [1][7][8]. Related work [8] demonstrates a broader asynchronous-spoofing technique (not the Tractor Beam safe-hijack specifically) against additional high-volume consumer GNSS receivers and commercial drones such as the DJI Mavic 2 Pro; that is corroboration of the shared root cause, not an additional confirmed Tractor Beam target, and so is not listed as an affected product here.

3. The vulnerability in detail

The flaw lives at the boundary between the drone’s GNSS receiver and its flight controller / autopilot state estimator, and its root cause is architectural rather than a coding bug in any one product. Civilian GPS L1 C/A is an open, unauthenticated broadcast: the signal structure and spreading codes are public, there is no cryptographic signature on the navigation message, and there is no per-device or per-constellation secret that a receiver could use to distinguish a genuine satellite transmission from a counterfeit one [1][2][8]. Because of this, a GNSS receiver’s notion of “which signal is real” reduces almost entirely to signal power and code/carrier lock: the receiver tracks whichever correlated L1 signal is strongest and most consistent. This is the exact property the Tractor Beam work by Noh, Kwon, Son, Shin, Kim, Choi, and Yongdae Kim (KAIST SysSec, ACM Transactions on Privacy and Security, Vol. 22 No. 2, Article 12, 2019) turns into a hijack primitive [1][5].

The defect being exploited is twofold. First is the missing authenticity check just described (the CWE below). Second, and what makes this work more than “GPS spoofing exists,” is that the researchers systematically defeat the drones’ own defenses. Modern consumer drones ship fail-safe logic intended to catch spoofing or GNSS inconsistency: if the reported position jumps, drifts implausibly, or disagrees with other sensors, the autopilot is supposed to reject the fix and transition to a safe state (hover, return-to-home, or landing). The researchers performed both black-box and white-box analysis of these fail-safe modes per drone model, including analyzing the open-source 3DR Solo flight stack, where they examined the Extended Kalman Filter (EKF) failure-detection logic [2][3]. Because the Solo’s flight stack is open source, this model provides the strongest available grounding for the claim that the fail-safe does not catch the attack: the researchers could inspect the failure-detection logic directly rather than infer its behavior from black-box observation [2]. (The finer claim that specific innovation/consistency residual thresholds were shown never to be exceeded is a plausible reading of that analysis but is not documented as an exact numeric white-box result in available sources, so it is not asserted here.) This per-model analysis let the researchers build a taxonomy of each drone’s fail-safe thresholds and reactions [3][4].

The mechanism proceeds in two stages: capture, then guidance. In the capture stage, using a laptop, open-source GPS signal-generation software, and a BladeRF SDR (with a directional antenna), the attacker synthesizes L1 signals at 1575.42 MHz and transmits them at a power level above the genuine satellite signals reaching the target [2][8]. Because the receiver’s tracking loops preferentially lock onto the strongest self-consistent correlation peak, it loses lock on the real constellation and locks onto the counterfeit one; the attacker now owns the receiver’s notion of position. The counterfeit constellation is synthesized to look like a clean, internally coherent set of satellite measurements rather than the contradictory or noisy measurements a crude jammer would produce, so the receiver sees a high-quality fix and does not reject it on signal-quality grounds alone. (The specific characterization of that coherence as “plausible pseudoranges across the simulated satellites” is a reasonable description of how self-consistent spoofing works but is not documented as a quoted claim in available sources; it is presented here as mechanism, not as a quoted source claim.)

In the guidance stage, rather than teleporting the drone’s apparent position (which would trip a fail-safe), the attacker adaptively drifts the false position: small, continuous displacements kept below each model’s detection threshold. Here the attack exploits a control-loop inversion. The autopilot compares its (spoofed) position against its intended waypoint or loiter point and computes a corrective velocity to close the perceived gap. When the attacker slowly moves the reported position in direction X, the autopilot “believes” the aircraft has drifted toward X and commands a correction in the opposite direction — which is physically the direction the attacker wants the real aircraft to travel. By continuously nudging the false position and letting the autopilot’s own closed-loop correction do the flying, the attacker converts a passive sensor spoof into active trajectory control. Because every increment of false displacement is shaped to stay inside the known fail-safe envelope (per the taxonomy above), the aggregate manoeuvre can be arbitrarily large while no single update looks anomalous, so the drone never enters its protective state and instead flies under attacker guidance.

The end-to-end exploitation chain is: (1) attacker positions within RF range with a BladeRF SDR and open-source GPS software, holding no credentials and needing no network access; (2) attacker has performed prior black/white-box analysis of the target model’s fail-safe modes and built the per-model threshold taxonomy; (3) attacker transmits a self-consistent counterfeit L1 constellation above genuine satellite power so the receiver loses real lock and locks on; (4) attacker adaptively drifts the false position beneath the fail-safe threshold; (5) the autopilot’s closed-loop correction flies the aircraft in the attacker-chosen direction, and the drones can be forced to move in any direction with high accuracy [2][3][6]. The specific terminal outcomes and their consequences are treated in Section 6.

Proof-of-concept status: this is demonstrated, not theoretical. The authors validated the attack in field experiments against all four drones and in software-in-the-loop (SITL) simulation, and the technique is reproducible with open-source GPS simulators and commodity SDRs [2][3]. Independent work corroborates that consumer GNSS receivers accept unauthenticated L1 (including on the 3DR Solo specifically [7] and on high-volume consumer receivers and the DJI Mavic 2 Pro via a broader asynchronous-spoofing technique [8]). The researchers frame the work defensively, as a government-approved counter-drone capability for protecting critical infrastructure [3][4].

The closest CWE is CWE-345, Insufficient Verification of Data Authenticity (analyst inference; no CWE is assigned in the sources). The drone consumes a critical input — its own position — from an external source it cannot authenticate, and it makes safety-critical control decisions on that input as if it were trustworthy. The receiver has no way to confirm that the L1 signal originated from a real GPS satellite rather than an attacker’s radio, so a counterfeit input is accepted as ground truth, and the autopilot’s control loop then propagates that unverified input directly into physical actuation.

4. Discovery & timeline

The attack was discovered and published by Juhwan Noh, Yujin Kwon, Yunmok Son, Hocheol Shin, Dohyun Kim, Jaeyeong Choi, and Yongdae Kim of KAIST SysSec (Yongdae Kim’s group), as “Tractor Beam: Safe-hijacking of Consumer Drones with Adaptive GPS Spoofing,” in ACM Transactions on Privacy and Security, Vol. 22 No. 2, Article 12, pp. 12:1–12:26, 2019 (DOI 10.1145/3309735) [1][5]. The researchers maintain a project site and Q&A page describing the work and its defensive framing [3][4], and the result was publicly reported in 2019 [6]. This is a research disclosure of an inherent protocol/architecture weakness rather than a coordinated single-vendor disclosure; there is no vendor advisory, no assigned CVE, and no patch date, because the weakness is not fixable by a firmware update to any one product [3][4].

5. Technical reference

• CVE(s): none assigned. The class is considered outside conventional CVE coverage.
• CWE: CWE-345 (Insufficient Verification of Data Authenticity) — analyst inference; not present in sources.
• CVSS: no public baseline CVSS vector or score exists. The vulnerability is unscorable by CVSS in its standard form because the “attack” traverses an RF physical channel and a trusted-sensor input rather than a software interface with defined privileges/scope. See Section 6.
• Signal/technical refs: GPS L1 C/A carrier 1575.42 MHz; attacker hardware a BladeRF SDR plus laptop and open-source GPS signal-generation software (the source annotations attest only to a generic “BladeRF SDR”; no specific board variant is confirmed) [2][8]; 3DR Solo EKF failure-detection analyzed via its open-source flight stack [2].
• Accuracy of directional control: the drones can be forced to move “in any direction with high accuracy” [6]. No specific angular-error figure is supported: a “~20 degrees” value is not present in the public reporting [6] and is not documented in the ACM primary text [2]. The figure is therefore treated as unverified — not in available sources — and is not asserted here.
• Code/commit refs: none (no software patch exists).

6. Consequence & CFSE path analysis

Real-world consequence: an attacker with a few hundred dollars of radio hardware and no credentials can take over where a consumer drone flies — forcing a fly-away, steering it to a chosen location, or inducing a crash or forced landing — by feeding it a false position its autopilot trusts. This is control over a safety-critical physical actuator (the flight path), with the attendant risks of collision, loss of the aircraft, delivery of the aircraft (and any payload) to the attacker, and denial of the airspace the drone was protecting.

Why the CFSE Path Score differs from CVSS: CVSS presumes a software attack surface with enumerable privileges, network vectors, and a scope of compromised data/functions. Here there is no software credential, no network protocol, and no memory-corruption “impact” to score — the entry is an unauthenticated RF/proximity signal, and the “impact” is physical actuation. Standard CVSS cannot express “spoofed trusted sensor drives safety-critical actuation,” so the entry is recorded as unscorable_by_cvss and the CFSE Path Score carries the reachable-consequence analysis instead.

CFSE bands and verdict:

• Overall path_verdict: CRITICAL (direction UNSCORABLE, no CVSS). The entry decomposes the vulnerability into two co-dominant risk paths, both banded CRITICAL.
• Path 1 — PERCEPTION_TO_ACTION (RE:2/EC:2/EX:2/PH:4/DP:4/AT:2/CH:4/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE): models spoofed GNSS corrupting the position estimate the autopilot trusts, driving physical actuation such as forced fly-away, steering to the attacker location, or crash/forced landing.
• Path 2 — DEVICE_CONTROL_SAFETY (RE:2/EC:2/EX:2/PH:4/DP:3/AT:2/CH:3/SR:4/SX:3/OR:4/EV:3/LS:ACTIVE): models the terminal safety consequence where the attacker commandeers vehicle trajectory or forces a fail-safe transition, gaining effective control over a safety-critical actuator with no software credential.

Both paths share: a low-privilege RF/proximity entry (RE:2 — no network, no credentials); specialist-but-reproducible adaptive spoofing with a COTS software-defined radio (EC:2); bounded function authority exercised via a trusted sensor input rather than a firmware/trust root (AT:2); and a fleet-wide unauthenticated-L1 root cause (OR:4) that requires operational, sensor-fusion, or authenticated-GNSS redesign rather than a software patch. SR:4 reflects that the spoofing primitive is a shared, fleet-wide capability — the same unauthenticated L1 weakness applies across receivers, not a per-device flaw [7][8]. LS:ACTIVE reflects that the weakness remains current: later work confirms adaptive/asynchronous spoofing still defeats high-volume consumer GNSS receivers [8]. No public baseline score exists; the class is treated as outside conventional CVSS/CVE coverage, hence unscorable_by_cvss, with the registry recording the reachable consequence path.

7. Remediation & mitigations

There is no firmware patch and no fixed version; the defect is inherent to unauthenticated civilian GPS L1 and to autopilot trust in it [3][4]. Mitigations that actually apply to this specific bug:

• Authenticated GNSS: adopt signal-authenticated navigation (e.g., Galileo OSNMA-style navigation-message authentication) so receivers can reject unsigned counterfeit signals — this attacks the root cause (the missing authenticity check of Section 3) but requires new receiver hardware/firmware and constellation support.
• Multi-sensor fusion / cross-checks: fuse GNSS with independent, non-spoofable sensors (IMU, barometer, visual/optical-flow odometry, magnetometer) and reject a GNSS fix that disagrees with dead-reckoned or vision-derived motion. This directly targets the guidance-stage evasion: the attack works only by keeping GNSS drift beneath single-sensor fail-safe thresholds, so a cross-sensor consistency check — comparing the spoofed GNSS velocity against IMU/optical-flow-derived velocity — catches the very drift the attacker relies on staying quiet [2].
• Spoofing-aware fail-safe: integrate GPS-spoofing detection directly into the autopilot and trigger a threat-driven fail-safe or trajectory-avoidance response when spoofing is detected, closing the specific gap where adaptive drift currently slips under the fail-safe/EKF failure-detection logic identified on the 3DR Solo [4].
• UTM operational defenses: unmanned-traffic-management trajectory registration and independent tracking, so a drone whose externally observed trajectory diverges from its registered/expected path can be flagged and its spoofed state detected out-of-band [3][4].
• Signal-layer detection: RF power-monitoring and angle-of-arrival / multi-antenna checks can detect the over-powered single-source L1 transmitter characteristic of this attack (a genuine constellation arrives from many directions at low power; the spoofer arrives from one direction at elevated power).

Because the attacker input is a physical RF signal, conventional software controls (credentials, network filtering, patch management) do not address it and are out of scope.

8. Sources

[1] Tractor Beam: Safe-hijacking of Consumer Drones with Adaptive GPS Spoofing (ACM TOPS journal record) — ACM Transactions on Privacy and Security — https://dl.acm.org/doi/10.1145/3309735 — authoritative peer-reviewed primary source; establishes authors, venue, and the safe-hijacking adaptive spoofing technique against the four drones — researcher-primary. [2] Tractor Beam (ACM full-text HTML) — ACM Transactions on Privacy and Security — https://dl.acm.org/doi/fullHtml/10.1145/3309735 — experimental setup (laptop + BladeRF SDR + directional antenna, L1 1575.42 MHz), white/black-box fail-safe analysis, and 3DR Solo EKF failure-detection analysis; grounds the mechanism/EC/AT/DP detail — researcher-primary. [3] Tractor Beam (official researcher project page) — KAIST SysSec (Yongdae Kim group) — https://sites.google.com/view/tractorbeam — attack goal, the four tested drones via field experiments and SITL, and the fail-safe bypass thesis; the discovered_by URL — researcher-primary. [4] Tractor Beam Q&A — KAIST SysSec (Yongdae Kim group) — https://sites.google.com/view/tractorbeam/qa — defensive/counter-drone framing (government-approved), fail-safe taxonomy, and the three proposed mitigations (UTM registration, spoofing-detection integration, trajectory-avoidance fail-safe); supports OR/remediation reasoning — researcher-primary. [5] dblp bibliographic record: Tractor Beam (NohKSSKCK19) — dblp / Schloss Dagstuhl — https://dblp.org/rec/journals/tissec/NohKSSKCK19.html — independent verification of full author list, volume 22 no. 2 pp. 12:1–12:26 (2019), DOI 10.1145/3309735 — reputable-press. [6] A safe way to bring down rogue drones — Electronics Weekly — https://www.electronicsweekly.com/news/research-news/safe-way-bring-rogue-drones-2019-07/ — independent trade-press confirmation that adaptive spoofing can force all four drones to “move in any direction with high accuracy”; corroborates the terminal-consequence claims; the article contains no specific angular-error figure — reputable-press. [7] Analysis of the GPS Spoofing Vulnerability in the Drone 3DR Solo — IEEE Access (via ResearchGate) — https://www.researchgate.net/publication/332703349_Analysis_of_the_GPS_Spoofing_Vulnerability_in_the_Drone_3DR_Solo — independent corroboration on one exact affected model, reinforcing unauthenticated-L1 acceptance and fleet-wide generalization — researcher-primary. [8] Efficacy of Asynchronous GPS Spoofing Against High Volume Consumer GNSS Receivers — arXiv (ACM Q2SWinet 2022) — https://arxiv.org/pdf/2206.09133 — broader corroboration that adaptive/asynchronous spoofing works against high-volume consumer GNSS receivers and commercial drones (DJI Mavic 2 Pro); supports SR:4 shared primitive and LS active status. Note: demonstrates the broader technique, not the Tractor Beam safe-hijack specifically — researcher-primary.