Relative Spoofing: Real-Time Manipulation of GNSS Correction Data Streams

Søren Reime Larsen, Lasse Lehmann, Daniel H. Olesen, Anna B.O. Jensen

Peer Reviewed

Abstract:	Especially in the later years, GNSS jamming and spoofing has been getting increased attention, and has been studied intensely with the purpose of improving detection, localization, mitigation and more. However, with the focus directed towards protection and authentication of the satellite signals, another issue has so far gone under the radar: Spoofing of differential GNSS enabled receivers through manipulation of correctional data. This approach is also denoted relative spoofing, due to the way it spoofs relative positioning. This paper investigates the impact of relative spoofing on three commercially available RTK receivers. The paper presents a Python code denoted BaSSim (Base Station Simulator), that manipulates RTCM data in real-time and forwards it to the receivers in question. These carefully manipulated RTCM data causes a spoofing effect in all three RTK receivers, making their positions drift in a manner that can be designed by the spoofer. This paper shows that it is possible to spoof all three receivers through relative spoofing, and that they all reported fixed RTK positions, even though they were spoofed several meters off their true location. In the one case, a receiver reported a fixed position, although that position was in fact applied a spoofed offset of more than 580m. All this was done in real-time using the BaSSim code running on a laptop. Thus, the paper demonstrates that relative spoofing is a serious issue, and that current generation RTK receivers and services have no methods for detecting or mitigating this kind of attack. Therefore, the paper also discusses several methods for verifying the integrity of the correctional data and suggests encryption and authentication of the RTCM data stream, to avoid potential relative spoofing attacks.
Published in:	Proceedings of the 38th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2025) September 8 - 12, 2025 Hilton Baltimore Inner Harbor Baltimore, Maryland
Pages:	1486 - 1500
Cite this article:	Larsen, Søren Reime, Lehmann, Lasse, Olesen, Daniel H., Jensen, Anna B.O., "Relative Spoofing: Real-Time Manipulation of GNSS Correction Data Streams," Proceedings of the 38th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2025), Baltimore, Maryland, September 2025, pp. 1486-1500. https://doi.org/10.33012/2025.20244
Full Paper:	ION Members/Non-Members: 1 Download Credit Sign In