Researchers Hacked Starlink’s Signal So It Can Be Used for GPS

In addition to providing high-speed internet connectivity to even the most remote corners of the Earth, the over 3,000 satellites that make up the Starlink network have the potential to do even more, like replace the two dozen satellites that power the Global Positioning System. SpaceX passed on the idea, so a team of researchers took the long way to leverage Starlink as a GPS alternative.

Although Starlink’s thousands of satellites each maintain a non-geostationary position in low-Earth orbit, and GPS satellites follow one of six different orbits that circle the planet twice every day, they both share a common feature: they beam signals down to the surface of the Earth. Starlink’s signals deliver internet, while the signals from multiple GPS satellites are used by navigation devices to triangulate their exact position on the planet.

Todd Humphreys and a team of researchers from the University of Texas at Austin’s Radionavigation Laboratory realized that Starlink could also serve as an accurate and reliable backup to the Global Positioning System, but SpaceX eventually decided that it was not a priority for the company, and stopped cooperating with the researchers. A setback, for sure, but the UT Austin team didn’t actually need intimate knowledge of what exactly the Starlink satellites were broadcasting, they just needed the signals, which is something SpaceX had no way to hide.

Turning Starlink into a navigation system would have been easy with SpaceX’s cooperation, but without it, it took Humphreys’ team almost two years to reach their goal. They started by purchasing a Starlink terminal and service which was used to stream HD YouTube videos of tennis legend Rafael Nadal 24 hours a day. The setup was paired with an antenna nearby that was used to detect the regularly repeating synchronization sequence signals the Starlink service uses to help the ground-based receivers stay connected to the satellites. At no point did they attempt to crack or break the encryption that Starlink uses to keep its services exclusive to its subscribers.

Those repeating synchronization signals are sent at precisely timed intervals: four sequences every millisecond, which is an approach that the GPS system also uses. When paired with information about the movement of Starlink’s satellites, information that SpaceX readily shares online to help reduce the risk of costly collisions with hardware from other companies, the source of the signal, and how far away that satellite is, can be used to calculate the location of a receiver, with an accuracy of about 98 feet.

That’s a far cry from the potential millimeter accuracy that can be achieved with the GPS system when using advanced receiver equipment (the hardware the US military relies on) but Humphreys, who recently shared their team’s work on decoding the Starlink signal structure in a non-peer-reviewed paper, believes that if SpaceX chose to cooperate, simple software updates and additional data encoded in the synchronization signals could improve the positional accuracy to less than a meter, comparable to the accuracy of GPS consumer hardware.

The only catch? Relying on these predictable synchronization sequences that are used across the entire Starlink network for navigation comes with potential security risks because now everybody knows what they look like, and some will be eager to spoof and fake them for nefarious purposes. For obvious reasons (they were created as military tools first and foremost) services like GPS and GLONASS prioritize security, but as long as SpaceX has no interest in competing as a navigation service, using Starlink for that purpose could be problematic.

In addition to providing high-speed internet connectivity to even the most remote corners of the Earth, the over 3,000 satellites that make up the Starlink network have the potential to do even more, like replace the two dozen satellites that power the Global Positioning System. SpaceX passed on the idea, so a team of researchers took the long way to leverage Starlink as a GPS alternative.

Although Starlink’s thousands of satellites each maintain a non-geostationary position in low-Earth orbit, and GPS satellites follow one of six different orbits that circle the planet twice every day, they both share a common feature: they beam signals down to the surface of the Earth. Starlink’s signals deliver internet, while the signals from multiple GPS satellites are used by navigation devices to triangulate their exact position on the planet.

Todd Humphreys and a team of researchers from the University of Texas at Austin’s Radionavigation Laboratory realized that Starlink could also serve as an accurate and reliable backup to the Global Positioning System, but SpaceX eventually decided that it was not a priority for the company, and stopped cooperating with the researchers. A setback, for sure, but the UT Austin team didn’t actually need intimate knowledge of what exactly the Starlink satellites were broadcasting, they just needed the signals, which is something SpaceX had no way to hide.

Turning Starlink into a navigation system would have been easy with SpaceX’s cooperation, but without it, it took Humphreys’ team almost two years to reach their goal. They started by purchasing a Starlink terminal and service which was used to stream HD YouTube videos of tennis legend Rafael Nadal 24 hours a day. The setup was paired with an antenna nearby that was used to detect the regularly repeating synchronization sequence signals the Starlink service uses to help the ground-based receivers stay connected to the satellites. At no point did they attempt to crack or break the encryption that Starlink uses to keep its services exclusive to its subscribers.

Those repeating synchronization signals are sent at precisely timed intervals: four sequences every millisecond, which is an approach that the GPS system also uses. When paired with information about the movement of Starlink’s satellites, information that SpaceX readily shares online to help reduce the risk of costly collisions with hardware from other companies, the source of the signal, and how far away that satellite is, can be used to calculate the location of a receiver, with an accuracy of about 98 feet.

That’s a far cry from the potential millimeter accuracy that can be achieved with the GPS system when using advanced receiver equipment (the hardware the US military relies on) but Humphreys, who recently shared their team’s work on decoding the Starlink signal structure in a non-peer-reviewed paper, believes that if SpaceX chose to cooperate, simple software updates and additional data encoded in the synchronization signals could improve the positional accuracy to less than a meter, comparable to the accuracy of GPS consumer hardware.

The only catch? Relying on these predictable synchronization sequences that are used across the entire Starlink network for navigation comes with potential security risks because now everybody knows what they look like, and some will be eager to spoof and fake them for nefarious purposes. For obvious reasons (they were created as military tools first and foremost) services like GPS and GLONASS prioritize security, but as long as SpaceX has no interest in competing as a navigation service, using Starlink for that purpose could be problematic.