GNSS spoofing corrupting onboard time on commercial airliners (disclosed 2024)
What happened
At DEF CON 32 in August 2024 Ken Munro of Pen Test Partners reported that GNSS spoofing affecting commercial aviation had begun to corrupt aircraft time as well as aircraft position. In an interview with Reuters he described an incident in which the onboard clocks of an aircraft operated by a major Western airline were suddenly advanced by years during a spoofing event, causing the aircraft to lose access to its digitally-encrypted communication systems; it was grounded for weeks while engineers manually reset its onboard systems. Munro declined to identify the airline or the aircraft type and gave no date. He framed the wider risk as starting a cascade of events, and cited a 400 percent rise in GNSS spoofing affecting commercial airliners reported by the aviation advisory body OPSGROUP, and Finnair's temporary suspension of flights to Tartu, Estonia in April 2024 over spoofing attributed to Russia. GNSS is a timing service before it is a positioning service, so a receiver that accepts counterfeit signals accepts counterfeit time, and downstream consumers of that time fail in ways the crew do not associate with navigation.
Single-sourced and undated on its central incident: one researcher, speaking to a wire service, who declined to name the airline, the aircraft type or the date, with no regulator finding, operator statement or incident report available. The record is written against the pattern (that GNSS spoofing corrupts aircraft time, and that spoofing volumes rose sharply in 2024) with the clock-advance incident as illustration rather than as the load-bearing evidence. Held also on the same scope question as the rest of this batch: SPARTA's EX-0014.01 and EX-0014.04 are written with the spacecraft as the deceived party and the victim here is an airliner. Distinct from gnss-interference-european-aviation-2022-2026 by effect rather than geography: that record covers position degradation as EASA describes it, this one covers the timing failure mode.
Attack vector
Transmission of counterfeit GNSS signals in airspace transited by commercial aircraft, causing receivers to accept an attacker-chosen time solution which is then consumed by onboard systems including cryptographic communications.
Operational impact
In the single incident described, an aircraft's onboard clocks advanced by years, the aircraft lost access to its digitally-encrypted communication systems, and it was grounded for weeks pending manual reset by engineers. In the wider pattern, a reported 400 percent rise in spoofing affecting commercial airliners.
Affected segments
user, link
Disclosed
2024-08-10
SPARTA techniques evidenced
Each row is a technique this record evidences, with the reasoning and the source that attests to it.
What relationship, confidence, and evidence mean on the rows below
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
Munro reports onboard clocks advancing by years during a GNSS spoofing event, with the consequence that the aircraft lost access to its digitally-encrypted communication systems and required weeks of manual reset by engineers. EX-0014.01's own vector list includes introducing a higher-priority or cleaner time source such as GNSS-derived time, and its stated consequences include broken timetag validation and misaligned anti-replay windows, which is the class of failure described. The behaviour and the failure class match exactly; only the victim differs from the technique's spacecraft framing. SCOPE FLAG: drops if the editor rules terrestrial-victim GNSS events out of SPARTA scope.
The reported activity is GNSS spoofing of commercial airliners, at a volume the aviation advisory body OPSGROUP puts at a 400 percent rise, of which the timing corruption is one consequence. EX-0014.04's own text records that spoofed PNT can bias timekeeping even where GNSS is not the primary navigation source, which is the bridge between this technique and EX-0014.01 within one event. Derived because the technique names the spacecraft's navigation solution as the affected system and the victims here are aircraft receivers. SCOPE FLAG: drops if the editor rules terrestrial-victim GNSS events out of SPARTA scope.
The aircraft's systems accepted a fabricated time as truth and acted on it to their operator's detriment, rejecting valid credentials and taking the aircraft out of service. That is IMP-0001's definition: falsification of information into a system to induce a reaction prejudicial to the affected party's interests. Munro's own framing, that spoofing creates confusion and risks starting a cascade of events, describes the same thing. No source uses the term deception and this technique is not in the bibliography starting set, so the edge is derived and moderate. Not affected by the spacecraft-victim scope question.
Considered and not mapped
These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.
Parent of
EX-0014.01andEX-0014.04, both of which are mapped. Mapping the parent as well adds nothing and inflates the count. Rejected on the same basis asEX-0016ingnss-interference-european-aviation-2022-2026.Defensible, the receiver is a sensor and its output is fabricated, but it is the mapping used for the superyacht record, where the effect is a fabricated position fed to a navigation estimator. Here the reported effect is on time and on cryptographic validity, not on an estimation loop, and
EX-0014.01names that precisely. Mapping both would double-count one behaviour.Tempting, because an aircraft was grounded for weeks. Rejected because the grounding was the operator's remediation of a corrupted clock, not an impairment the spoofing sustained; the spoofing event itself was transient. Asserting disruption would misattribute the duration. This is a judgement call and an editor may reasonably reverse it.
Sources
The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.
A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.
Tier 2: Reuters wire reporting of a named researcher's DEF CON presentation and follow-up interview, quoting him directly. Not a regulator finding, not peer-reviewed and not an operator statement; the central incident is the researcher's account with the airline and aircraft withheld.
Tier 2: A regional US daily's syndication of Reuters wire copy. The tier is Reuters's, because the text is Reuters's.
Every source SafeMode Space reproduces, and on what terms: sources and attribution.