Carry-Off GPS Attack is a spoofing attack in which a receiver is gradually led away from the correct GPS position by false signals or manipulated satellite data. It targets navigation and timing systems, so defenders should cross-check location with other sensors, detect signal anomalies, and treat unexpected drift as a possible attack.
How a Carry-Off GPS Attack Works
A carry-off GPS attack starts with believable false positioning signals, then gradually biases the receiver so the target accepts a wrong location or timing solution as normal. The danger is not a sudden drop in service, but a slow drift that can remain plausible long enough to influence navigation, landing, routing, or synchronisation decisions.
Because the receiver continues to see what appears to be a valid signal environment, the attack can be harder to spot than a simple jamming event. Defenders therefore need to think in terms of deception, not just loss of signal, and watch for the gap between reported position and other trusted sensors.
Why Carry-Off Spoofing Is Dangerous
The core security problem is trust in satellite-derived location and time. If an attacker can control that input, they can misdirect vehicles, influence operational timing, or degrade downstream systems that depend on accurate geospatial or clock data. In safety-critical environments, even a small displacement can have outsized consequences.
This attack is especially concerning where GPS is treated as an authoritative source instead of one signal among several. CISA cyber threat advisories are useful for tracking broad threat patterns around spoofing, interference and related operational impacts that can affect critical infrastructure and navigation systems.
How Organisations Check Exposure and Detect Drift
Exposure is highest where GPS is embedded in critical navigation, fleet management, aviation, maritime, telecom, industrial control, or timing environments. Teams should know which assets depend on satellite positioning, which ones can fail open, and where a bad location or clock value can propagate into other systems.
Detection usually depends on correlation. Cross-checking against inertial, cellular, Wi-Fi, map, visual, or fixed-reference data can reveal an inconsistency even when the receiver itself appears healthy. Sudden jumps, implausible speed, altitude or heading changes, and slow unexplained drift are all warning signs that deserve attention.
For deeper threat context, the MITRE ATT&CK Enterprise Matrix helps defenders think about adversary tradecraft around deception, persistence and operational compromise, while NIST Cybersecurity Framework 2.0 provides a broad structure for identifying, detecting and responding to anomalous system behaviour.
Remediation and Resilience Measures
When GPS spoofing is suspected, the immediate goal is to prevent the false signal from steering operations further. Systems should fail over to alternative references where possible, and operators should validate position or time against independent sources before acting on it.
Longer-term resilience comes from reducing single-source dependence. Receiver diversity, anti-spoofing capabilities, signal quality monitoring, physical and environmental context checks, and clear operational procedures for degraded navigation all make carry-off attacks harder to sustain.
Authoritative guidance on control hardening is available from NIST AI Risk Management Framework only indirectly, but the more directly relevant control thinking is to treat location and timing as security-relevant inputs and protect them with layered verification rather than blind trust.
Risk and Threat Considerations
Carry-off attacks matter because they can produce a believable wrong answer instead of an obvious outage. That makes them useful for adversaries who want to redirect assets, disrupt timing-dependent operations, or create confusion without immediately triggering alarms.
Failure mechanism: The attacker keeps the receiver locked while slowly shaping the perceived signal environment, so the device accepts a corrupted navigation or timing solution as if it were genuine.
Impact: Operational decisions can be made on false position or time data, which can lead to misrouting, unsafe movement, synchronisation failures, and delayed detection of compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1027 — Obfuscated Files or Information | GPS spoofing uses deceptive signal shaping to mask true location or timing. |
| Recommendation — Correlate deceptive telemetry patterns with intrusion hunts and validate anomalous navigation inputs. | ||
| NIST CSF 2.0 | DE.AE-03 — Anomalies are investigated to determine whether incidents are occurring | Unexpected GPS drift is an anomalous condition that must be investigated as possible incident activity. |
| PR.DS-01 — Data-at-rest is protected | Location and timing data are security-relevant inputs that should be protected from tampering in transit or storage. | |
| PR.PS-01 — Configuration Management | Resilience against spoofing depends on hardened receiver configuration and trusted source selection. | |
| Recommendation — Investigate unexplained location and timing anomalies before trusting dependent operations. Protect positioning and timing inputs from unauthorized alteration across the data path. Harden receiver configuration and restrict trust to approved navigation sources. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detection of drift and spoofing depends on collecting and reviewing receiver and sensor telemetry. |
| Recommendation — Centralize and review GNSS and sensor logs for drift, inconsistency and anomaly patterns. | ||
Practitioner Guidance
Why practitioners should care: Carry-off spoofing is a control-integrity problem, not just a radio problem. Teams should treat any unexplained drift between GPS output and independent telemetry as a security event until proven otherwise.
What to watch for: The strongest warning signs are gradual divergence, improbable motion patterns, and disagreement between satellite data and other sensors. When those appear, pause automated trust in the receiver and validate the signal path before downstream systems consume it.
Related resources from NHI Mgmt Group
- Attack Surface Management
- How do organisations govern identity attack surface as a programme, not a one-off project?
- What are the signs that a living off the land attack is already underway?
- What happens when a living off the land attack is detected after the attacker has already embedded in the network?