PaperlayerView exact revision on arXiv

Source-linked AI summary

GNSS Spoofing in Mobile Devices: A Survey on Impact and Countermeasures

Robert Argo, Andrea Nardin, Alex Minetto, Pau Closas

arXiv:2610.01294v1cs.CRcs.SYeess.SPeess.SY

TL;DR

Smartphone spoofing countermeasure surveys often assume receiver data and capabilities that commodity phones do not expose, leaving real-world applicability unclear. This paper surveys smartphone vulnerabilities and feasible countermeasures, develops a threat taxonomy, and compares approaches whose protections occupy different trade-offs, with none reaching trusted PVT restoration.

  • Problem

    Existing GNSS security surveys often assume access to receiver data unavailable on commodity smartphones, so the applicability of their methods to real-world phones remains unclear.

    Source: A. Previous Surveying Works · p. 3

  • Method

    The article surveys smartphone spoofing susceptibility and countermeasures, introduces a GNSS spoofing-effects taxonomy, and assesses methods against smartphone constraints.

    Source: §VI · p. 20

  • Results

    The reviewed approaches occupy different positions across deployability, device independence, attack coverage, and protection, and none currently reaches ASC3 trusted-PVT restoration.

    Source: A. Countermeasure Comparison and… · p. 18

  • Takeaways & Limitations

    The comparison frames smartphone protection as a trade-off among deployability, device independence, attack coverage, and attainable protection.

    Source: A. Countermeasure Comparison and… · p. 18

    Commercial smartphones expose application-level PVT and selected Android raw observables, but not raw digital samples or correlator outputs, and apps may lack control to restore trusted PVT.

    Source: B. GNSS Receiver Basic Processing… · p. 7, A. Countermeasure Comparison and… · p. 18

Abstract

from arXiv · show

Smartphones rely on Global Navigation Satellite System (GNSS)-based positioning for many of the functions they execute everyday. The GNSS receivers embedded in smartphones are susceptible to anthropogenic radio frequency interference attacks in the forms of jamming and spoofing due to the low-power and open-architecture signals they receive from the satellite constellations. While jamming is a practice that denies a GNSS receiver the ability to form a position, velocity, and time (PVT) solution, spoofing represents a more insidious threat by using forged satellite signals that aim at causing the victim receiver to compute a false PVT solution. The ubiquity of smartphones and the sensitive geolocation data they hold make them a primary target for malicious spoofing. However, their hardware constraints and the lack of deep visibility into the GNSS receiver processing chain create significant hurdles for effective countermeasures. Existing surveys comprehensively explore general spoofing countermeasures but fail to address these mobile-specific limitations. This article fills that gap with a novel survey focused on techniques viable within the unique constraints of smartphone architectures. Specifically, we establish a taxonomy for defining GNSS spoofing attack effects and countermeasures, provide a historical review of smartphone vulnerability characterization, and provide an overview of techniques proposed to detect and counteract smartphone spoofing threats, offering a comparative framework to weigh their respective pros and cons on mobile platforms.

I. INTRODUCTION

Smartphones use GNSS for location-based services and are vulnerable to spoofing that can falsify position, velocity, or time. Existing surveys often assume receiver capabilities unavailable on commodity phones, leaving smartphone feasibility unclear.

I. INTRODUCTION

  • Forged GNSS signals can produce false PVT estimates, exposing ubiquitous smartphones and location-based services to large-scale disruption and financial consequences.In dense urban areas, device density can reach one million per square kilometer.Source: §I · p. 1
  • Demonstrations include incorrect device time, a driver diverted up to 1 km, geofence bypass exposing phone data, and ride-share fare inflation.The geofence example involves physical access to a phone and spoofing its configured area.Source: §I · pp. 1–2
  • Android raw GNSS measurements give researchers lower-level receiver data for detecting spoofing artifacts, although smartphone access to intermediate observables remains limited.The article notes that Android raw measurements became available through the API in May 2016.Source: §I · p. 2

A. Previous Surveying Works

  • Prior surveys often assume access to raw correlation, carrier-phase, IQ, or RF-front-end data unavailable on commodity phones, making smartphone applicability unclear.They also rarely account for heterogeneous Android implementations and restricted chipset diagnostics.Source: A. Previous Surveying Works · pp. 2–3
  • Unlike prior surveys, this article evaluates countermeasures through smartphone hardware and data constraints to clarify which approaches are feasible on mobile platforms.Some earlier surveys de-emphasized smartphones or focused on receiver data unavailable to them.Source: A. Previous Surveying Works · p. 3

B. Objectives, Scope, and Organizational Layout

The paper surveys smartphone spoofing susceptibility and countermeasures, with emphasis on Android, and offers a broader GNSS threat taxonomy. It also presents an over-the-air smartphone spoofing dataset and models how legitimate and forged satellite signals combine.

B. Objectives, Scope, and Organizational Layout

  • The article presents what it describes as the first survey explicitly limited to countermeasures realistically deployable on commercial smartphones.It assesses which detection and mitigation mechanisms remain operational with observables exposed through current GNSS APIs.Source: B. Objectives, Scope, and… · p. 3
  • The survey reviews smartphone susceptibility and proposed countermeasures, emphasizes Android raw measurements, and introduces a spoofing-effects taxonomy applicable to GNSS receivers broadly.The taxonomy provides a unified framework beyond smartphones.Source: B. Objectives, Scope, and… · p. 3
  • The article includes an over-the-air GNSS spoofing dataset covering multiple smartphones, made available for researchers to test and validate methods.The authors describe it as the first such open dataset to their knowledge.Source: B. Objectives, Scope, and… · p. 3

II. BACKGROUND ON GNSS RECEIVERS

  • The background section focuses on satellite signals, receiver architectures, and which observables are available at different processing stages.These topics provide context for the paper's assessment of smartphone-accessible data.Source: §II · p. 3

A. Signal Model

  • The signal model combines legitimate and spoofed satellite transmissions, with spoofers able to modify signal parameters and potentially navigation-message bits.The model distinguishes legitimate and spoofed satellite index sets and their respective parameters.Source: A. Signal Model · p. 4
  • When sufficiently stable over time, spoofing attacks impose drifts in the receiver's position, velocity, and time solution relative to its actual state.The paper discusses these effects further in its spoofing-effects taxonomy.Source: A. Signal Model · p. 5

B. GNSS Receiver Basic Processing Architecture

A GNSS receiver amplifies and digitizes the incoming signal, tracks satellite codes and carriers, then derives observables for its PVT solution. Smartphone developers can access only a subset of receiver information, limiting visibility into earlier processing stages.

B. GNSS Receiver Basic Processing Architecture

  • The AGC adjusts signal amplitude before digitization, but its scale is hardware-dependent and can behave opaquely across Android smartphones.It reduces gain in the presence of interference to help prevent ADC saturation.Source: B. GNSS Receiver Basic Processing… · p. 5
  • After ADC digitization, acquisition and tracking loops correlate the signal against satellite code and carrier replicas to produce correlator outputs.The tested code delays can include early, late, very-early, and very-late replicas.Source: B. GNSS Receiver Basic Processing… · p. 5
  • Tracking loops use correlator values to estimate code delay, carrier frequency and phase, while C/N0 and power estimates may mix spoofed and legitimate signals.The tracking-loop formulation varies by receiver implementation.Source: B. GNSS Receiver Basic Processing… · p. 5
  • Pseudorange and pseudorange-rate observables, together with navigation-message fields, feed the processing module that computes receiver PVT.Many smartphone chipsets do not expose broadcast navigation messages through the Android GNSS API.Source: B. GNSS Receiver Basic Processing… · p. 6
  • Smartphone APIs expose selected measurements such as AGC, C/N0, pseudorange rate and pseudorange, but not raw samples or correlator outputs.These measurements are more accessible at later receiver stages; Figure 2 identifies Android-accessible observables in green.Source: B. GNSS Receiver Basic Processing… · pp. 6–7, Figure 2 · p. 6

C. Position, Velocity, and Time calculation

A GNSS receiver estimates position, velocity, and clock state from satellite observables and ephemerides. The paper focuses on approaches aligned with smartphone access to these inputs.

C. Position, Velocity, and Time calculation

  • The PVT state includes user position and velocity plus receiver clock offset and drift, though common applications report position and clock offset.The solution is generally computed from pseudorange and pseudorange-rate observables from at least four satellites, with relevant ephemeris data.Source: C. Position, Velocity, and Time… · p. 7
  • The survey focuses on smartphone-available processing and excludes direct-positioning approaches that bypass intermediate per-satellite processing.Access to navigation messages varies across smartphone chipsets and production firmware, and Android-level access is often disabled.Source: C. Position, Velocity, and Time… · p. 7
  • PVT computation solves a geometric estimation problem, commonly using least squares for single-point positioning or Kalman filtering for continuous tracking.Kalman filters also support sensor-fusion setups such as those using IMUs; prior PVT estimates and other sensor inputs may be used.Source: C. Position, Velocity, and Time… · p. 7

A. Receiver Effects of Spoofing

The paper classifies spoofing by its effects on receiver observables and state estimation, rather than only by signal alignment. The framework distinguishes outcomes according to the composition and consistency of legitimate and spoofed observables.

A. Receiver Effects of Spoofing

  • The receiver-effects framework complements signal-alignment classifications by accounting for complexities in the victim receiver processing chain.The authors note that other frameworks also classify spoofing by deception strategy and that AI is considered as a defensive mechanism and potential enabler of adaptive attacks.Source: A. Receiver Effects of Spoofing · p. 8
  • The taxonomy models the observable set as legitimate and spoofed subsets, enabling distinct receiver-level scenarios to be identified for attack assessment.For simplicity, the paper focuses on fabricated observables, not fabricated ephemerides.Source: A. Receiver Effects of Spoofing · p. 8
  • When spoofing is too weak for coherent takeover, it can increase measurement noise and degrade precision while still constituting failed deception.With no spoofed observables, the receiver processes legitimate measurements and produces a nominal PVT solution.Source: A. Receiver Effects of Spoofing · p. 8
  • When legitimate and spoofed observables coexist, the receiver may produce biased estimates, fail to converge consistently, or compute a fully forged PVT.The precise outcome depends on scenario conditions; full deception is the limiting case in which only spoofed observables remain and the estimator converges to a controlled, internally consistent false state.Source: A. Receiver Effects of Spoofing · p. 8

B. Countermeasure Technique Assessment Framework

The paper assesses countermeasures by how much they reduce spoofed observables and reviews general GNSS approaches against smartphone constraints. Its framework ranks capabilities without prescribing a particular PVT outcome for each technique.

B. Countermeasure Technique Assessment Framework

  • The framework defines three nested anti-spoofing categories: detecting spoofing, identifying spoofed satellites, and mitigating spoofing to restore an uncontaminated observable set.Effectiveness increases from ASC1 to ASC3, and higher-category techniques can implicitly perform lower-category functions.Source: B. Countermeasure Technique Assessment… · p. 9, Figure 4 · p. 9
  • A countermeasure may move the receiver toward a less affected PVT state, but the framework does not prescribe a specific outcome because receiver complexity also matters.For example, detection can be used to reduce false PVT information or stop producing a PVT solution.Source: B. Countermeasure Technique Assessment… · pp. 9–10

C. General Countermeasure Approaches for GNSS Spoofing

  • Prior general-GNSS surveys assess countermeasures under differing assumptions about which receiver-processing data tap points are available.The available receiver information constrains which approaches are possible.Source: C. General Countermeasure Approaches… · p. 10
  • Many general techniques have limited smartphone applicability because of hardware, mobility, and receiver-access constraints, although some use data available on smartphones.Examples of assumptions that can exclude techniques include stationary or predetermined movement, digitally signed signals, or inaccessible receiver-chain data.Source: C. General Countermeasure Approaches… · p. 10

IV. SMARTPHONE-SPECIFIC SPOOFING IMPACT AND COUNTERMEASURES

This section reviews smartphone susceptibility to GNSS spoofing and the mobile countermeasures researchers have proposed. It covers receiver impacts, AGC/C/N0 detection, and the limitations imposed by device variation and receiver data access.

A. Spoofing Impact on Smartphones

  • In a study of 18 smartphone devices versus the original 3, reducing true-to-spoofed offset from 144 km to 12 km and adding preemptive jamming yielded much higher susceptibility to reporting spoofed locations.In the earlier three-phone test, phones tracked forged signals but often excluded them from the GNSS solution.Source: A. Spoofing Impact on Smartphones · pp. 10–11
  • Modern Android devices lack native GNSS spoofing countermeasures, while the raw-measurements API enables software detection using pseudorange, Doppler, and signal-to-noise data.Detection strategies may combine GNSS data with inertial sensors or network-based location information.Source: A. Spoofing Impact on Smartphones · p. 12

B. AGC & C/N0 Detection Algorithms

  • Spoofing can raise RF energy and produce lower AGC gain with higher C/N0, whereas jamming can lower both AGC gain and C/N0.Thresholds on the joint AGC/C/N0 behavior distinguish nominal operation, obstruction, jamming, and spoofing regions.Source: B. AGC & C/N0 Detection Algorithms · p. 12
  • Before Android exposed raw observables, researchers used root access to obtain AGC and C/N0 measurements and observed their expected shifts under jamming and high-power spoofing.Later work reproduced similar results without root access after the API became available [13], and combined these metrics with others,,,,,.Source: B. AGC & C/N0 Detection Algorithms · pp. 12–13
  • Inconsistent AGC direction, scale, and baseline across devices hinder universal thresholds, while aggregate-power readings cannot distinguish individual GNSS signals or interference sources.C/N0 can provide signal-level discrimination that AGC alone does not.Source: B. AGC & C/N0 Detection Algorithms · p. 13

C. Temporal Correlation-based Methods

Temporal-correlation methods look for shared signal behavior that differs between a single-antenna spoofer and authentic satellite signals. Pairwise correlations can support detection and selective exclusion of potentially spoofed signals.

C. Temporal Correlation-based Methods

  • A single-antenna spoofer sends satellite signals through a common propagation channel, producing higher temporal correlations than authentic satellite data,.Authentic signals generally propagate through mostly independent channels.Source: C. Temporal Correlation-based Methods · p. 13
  • Pairwise Pearson correlations offer chipset-independent detection after a few seconds of data, with thresholds set from training data or a chosen false-alarm probability.The correlated pairs can be identified for selective exclusion from the navigation solution.Source: C. Temporal Correlation-based Methods · pp. 13–14
  • Adding temporal correlation to the signal-parameter space helps distinguish spoofing-like shifts in pairwise measurements from their nominal ranges.The approach can extend to other GNSS observables and complementary features.Source: C. Temporal Correlation-based Methods · pp. 13–14

D. Inertial-based Methods

Inertial-based methods compare smartphone motion measurements with GNSS-derived estimates, using disagreement as a potential spoofing indicator. The reviewed work ranges from feasibility studies to a Kalman-filter innovation detector, whose results are qualified by false alarms under challenging signal conditions.

D. Inertial-based Methods

  • Inertial sensors provide a measurement modality unaffected by GNSS spoofing, so disagreement with GNSS measurements can serve as a detection cue.Smartphone inertial sensors have limited quality, but their drift over a few seconds can remain small enough for countermeasure use.Source: D. Inertial-based Methods · p. 14
  • Early smartphone studies found discernible inertial-data differences between spoofed and benign scenarios, but did not present a detection algorithm [102],.The studies noted limited sensor quality and described cross-checking as a possible use.Source: D. Inertial-based Methods · p. 14
  • A carrier-phase approach compared GNSS-derived heading rate, acceleration, and attitude with inertial estimates, achieving low false alarms in two phones tested only without spoofing.The authors noted that thresholds may need to be device-specific.Source: D. Inertial-based Methods · p. 14
  • A more developed method fused GNSS and inertial measurements with a Kalman filter and tested spoofing detection through the resulting innovation vector [103].The vector measures the difference between observations and predicted measurements; its distributions under spoofed and non-spoofed conditions feed a thresholded binary test.Source: D. Inertial-based Methods · pp. 14–15
  • On three phones, the innovation detector flagged strong spoofing, but high multipath and weak GNSS also raised innovations, complicating low-false-alarm operation [103].Innovation distributions also differed across phones.Source: D. Inertial-based Methods · p. 15

E. Crowdsource Methods

Crowdsourced methods combine measurements from nearby phones to detect interference and estimate its location, while networked positioning can also spread corrupted GNSS measurements. The section also reviews multi-source phone detection that combines GNSS and other indicators.

E. Crowdsource Methods

  • A crowdsourced C/N0 method distinguishes area-wide signal-power drops as jamming from drops reported by a minority of users as blockage.It detected jamming but produced false alarms, and could misclassify blockage when many users simultaneously lost satellite line of sight.Source: E. Crowdsource Methods · p. 15
  • A later study found discernible differences in position/velocity, acceleration, and signal power between spoofed and benign settings, but offered no unified detection metric or network algorithm [100].The spoofed phones did not report raw GNSS measurements in that field test.Source: E. Crowdsource Methods · pp. 15–16
  • Crowdsourced AGC and C/N0 measurements can support emitter localization, but cross-device calibration is needed to place heterogeneous readings on a common interference-power scale.Once estimated, interference power can be modeled continuously or thresholded into detections for localization.Source: E. Crowdsource Methods · p. 16
  • Localization can use continuous-valued power in propagation or data-driven models, or cluster thresholded detections and estimate the dominant cluster’s center.The clustering route is computationally lightweight; the illustrated open-field scenario assumes path-loss propagation dominates.Source: E. Crowdsource Methods · p. 16, Figure 7 · p. 16
  • In DGNSS networks, a phone may track spoofed signals without reporting a spoofed position, yet its exchanged raw measurements can disrupt another receiver’s solution.The study observed discontinuities and recommended threshold-based edge detection for identifying spoofed network measurements.Source: E. Crowdsource Methods · pp. 16–17

F. Multi-Data Source Methods

  • GNSSAlarm combines GNSS/network location, mock-location status, GNSS/system time, and AGC/C/N0 discrepancies to indicate spoofing likelihood [120].Its AGC/C/N0 settings may require phone-specific tuning, and integration of additional candidate metrics remains unclear.Source: F. Multi-Data Source Methods · p. 17

G. Multi-Frequency Methods

Smartphone countermeasures occupy a trade-off among deployability, device independence, attack coverage, and protection; none of the reviewed methods reaches ASC3. Multi-frequency processing can identify affected measurements under limited attack coverage, while effective mitigation ultimately depends on access to receiver processing and control.

G. Multi-Frequency Methods

  • Cross-frequency inconsistencies can flag single-band spoofing and help identify affected measurements, but L1-dependent acquisition can leave L5 vulnerable; studies, report greater resistance with independent L5 tracking.Multi-frequency processing does not provide general immunity: coordinated attacks covering multiple frequencies can remove the diversity it relies on.Source: G. Multi-Frequency Methods · pp. 17–18, A. Countermeasure Comparison and… · p. 18

A. Countermeasure Comparison and Assessment

  • No reviewed method reaches ASC3, so application-level detection or identification may still leave the native PVT solution unprotected.The survey attributes this gap to limited information and control over receiver processing; native chipset integration is identified as the most direct mitigation path.Source: A. Countermeasure Comparison and… · pp. 18–19
  • AGC and C/N0 monitoring is mature and readily deployable, but device-dependent measurements and benign power anomalies make it unsuitable as a stand-alone spoofing indicator.Similar anomalies can arise from jamming, blockage, or propagation effects.Source: A. Countermeasure Comparison and… · p. 18
  • Temporal-correlation methods can identify groups of potentially spoofed signals at ASC2, but depend on attack-structure assumptions and need broader device and environment validation.The available experimental evidence is less mature than for AGC and C/N0 monitoring.Source: A. Countermeasure Comparison and… · p. 18
  • GNSS/inertial consistency is constrained by consumer-sensor bias, drift, device motion, and benign GNSS errors, while multi-source fusion depends on indicator availability, calibration, and statistical dependence.GNSS/inertial methods remain at proof-of-concept stage, and robust fusion must account for reliability under both attacks and benign anomalies.Source: A. Countermeasure Comparison and… · p. 18
  • Crowdsourced detection uses spatial diversity to distinguish isolated anomalies from geographically coherent events, but remains immature and requires sufficient contributors, reliable communications, harmonized measurements, and privacy and trust safeguards.The survey treats it as complementary infrastructure capability, not a self-contained individual-device defense.Source: A. Countermeasure Comparison and… · p. 18
  • Table III shows no method dominates across deployability, device independence, attack coverage, and protection; maturity indicates implementation and validation, not complete security.The comparison is a trade space rather than a single ranking.Source: A. Countermeasure Comparison and… · p. 18, Table III · p. 19
  • A layered architecture combines power and temporal warning, inertial and multi-source PVT consistency, multi-frequency identification, and crowdsourced spatial confirmation.The survey identifies chipset integration as the most direct path to mitigation, with operating-system protections and controlled APIs as further layers.Source: A. Countermeasure Comparison and… · p. 19

B. Open-Access Smartphone Spoofing GNSS Dataset

The paper presents an open-access smartphone GNSS dataset to support countermeasure development and testing across benign and spoofed settings, devices, and chipsets. Its outlook emphasizes heterogeneous-device evaluation and common metrics, while noting that methods rely on differing assumptions and levels of maturity.

B. Open-Access Smartphone Spoofing GNSS Dataset

  • The open-source dataset contains over-the-air smartphone GNSS measurements from benign and spoofed environments across multiple phone models and chipsets, enabling tests of hardware and firmware heterogeneity.The paper presents it as the first smartphone dataset addressing the discussed countermeasure needs.Source: B. Open-Access Smartphone Spoofing… · pp. 19–20

VI. CONCLUSIONS AND OUTLOOK

  • The survey presents a taxonomy of spoofing effects, a countermeasure-assessment framework, and a review of smartphone-specific techniques, their limitations, and maturity.It reports that independent tests have found significant smartphone susceptibility to GNSS spoofing.Source: §VI · p. 20
  • Sensor and firmware heterogeneity complicates statistical characterization and generalization, especially for signal-power and inertial methods; alternate methods make assumptions that spoofer sophistication may overcome.Examples include aligning spoofed time with current time or including multiple GNSS signals in the spoofed signal.Source: §VI · p. 20
  • Future evaluations should compare methods across heterogeneous devices, realistic benign environments, and adaptive attacks using common detection, false-alarm, delay, residual-PVT-error, computational-cost, and portability metrics.The paper describes continued smartphone countermeasure development as having substantial prospects.Source: §VI · p. 20
Loading 2610.01294v1…