We all know that GPS trackers send signals to satellites, which in turn send them back to Earth at base stations. The Globalstar GPS satellite network, the company that bills itself as the most modern satellite network in the world, covers the largest area of the earth.
And you might be surprised to learn that it doesn't guard its GPS satellites like it should. There are no layers of encryption and no kind of security to assure us that data is only shared between the two intended parties.
Colby Moore, a researcher at security firm Synack, says that every year at Black Hat, someone shows off some kind of satellite hack– but it’s all still theoretical. So, he thought, why not try something new? At Black Hat conf. #2015, without any kind of ‘high-level’ presentation, he showed off a step-by-step satellite hack. Moore targeted Globalstar since he already uses a Globalstar SPOT for distress signals.
To reverse-engineer the device, he did some simple research. He found that the device's FCC registration contained a lot of useful data that would help him hack the GPS satellite. After detailing the protocol, Moore built a simple device that cost less than $1,000 to capture and decode signals from Globalstar GPS trackers.
The Moore hack box has the ability to intercept satellite traffic and decode it. But to get to the point of doing the satellite hack of the GPS tracker in real time, it will need more computing power. Speaking about the idea of injecting, he said that it is considered illegal since it could interfere with critical functions and communications. He emphasizes that the actual control of the satellite does not use this protocol.
Looking at the firmware of the satellite hack box, Moore found a debugging console that has the ability to change the device's unique ID to that of someone else. So you could steal a car, copy and disable its tracker, and make it appear as if the car is still moving toward its destination. It could also be used to spoof emergency calls, find out where someone is hiding, or gain a competitive advantage by tracking your competitors' business activities.
Moore detailed the issue to Globalstar about 180 days ago, but received no response. The company then officially announced that they would "take privacy seriously." However, Globalstar can't really do anything about it, as it would have to upgrade about 649,000 Globalstar devices worldwide, which is practically impossible.
