Practical Spoofing Attacks against Galileo OSNMA with Time-Synchronization Manipulation

Abstract

Galileo launched the Open Service Navigation Message Authentication (OSNMA) to defend against spoofing attacks. This paper identifies an artificially manipulated time synchronization (ATS) condition in OSNMA-enabled receivers, under which attackers can jointly manipulate the Galileo signals and a receiver's local reference time (LRT) while still satisfying the time synchronization (TS) requirement. Exploiting the ATS condition, we propose a TS-compliant spoofing framework, including TS-compliant replay (TSR), TS-compliant forgery (TSF), and TS-compliant dual-frequency forgery (TSDF) attacks. The principle underlying these attacks is to first force the receiver to satisfy the TS requirement by manipulating its LRT, and then transmit carefully designed signals to spoof the receiver to the attacker-selected locations and times. More specifically, the TSR attack replays previously recorded E1 signals, the TSF attack transmits forged E1 signals containing valid OSNMA data, and the TSDF attack simultaneously forges both E1 and E5b signals, targeting dual-frequency receivers that support cross-band authentication. To validate the effectiveness of the proposed attacks, we conduct real-world experiments using two commercial Galileo receivers and two open-source software-defined radio (SDR) receivers that support OSNMA. The results showed that all attacks can successfully pass OSNMA authentication and spoof receivers to attacker-selected locations and times.