SpaceX Starlink Reverse-Engineered into Navigation System, Claim Researchers

A group of researchers led by Professor Todd Humphreys out of the University of Texas claims it has reverse-engineered SpaceX’s Starlink internet service, successfully turning it into a global navigation system — reports MIT Technology Review (via Yahoo Finance).

SpaceX was approached by the U.S. military in 2020 to explore Starlink’s potential as a navigation system, but CEO Elon Musk refused. The military was seeking a new, secure navigation system independent of the Global Positioning System (GPS) and its European, Russian, and Chinese equivalents.

Professor Humphreys and his team spent the last two years trying to reverse-engineer the signals Starlink satellites in low Earth orbit use to communicate with user terminals on the ground, without any inside knowledge of the system.

“The Starlink system signal is a closely guarded secret,” Humphreys told MIT Technology Review. “Even in our early discussions, when SpaceX was being more cooperative, they didn’t reveal any of the signal structure to us. We had to start from scratch, building basically a little radio telescope to eavesdrop on their signals.”

Ultimately, the team of researchers managed to crack Starlink’s signals. They have created a comprehensive characterization of the signals without breaking Starlink’s encryption or accessing any of the data being transmitted through those signals.

Starting with a Starlink unit programmed to transmit high-definition YouTube videos of Spanish tennis player Rafael Nadal, the group began tracking the satellite’s synchronization sequences and detected their patterns of transmission — about four sequences every millisecond. These sequences — repeating patterns of signals beamed down to Earth by the satellite — help receivers coordinate with them, leaving clues to the satellite’s distance and velocity.

The earthbound receiver, using the timing of the signals received from the satellite and information publically available about its orbit, can then calculate the distance to the satellite and approximate a location within 30 meters.

30 meters isn’t as dialed in as GPS, which is usually accurate to about 16 feet in commercial use. However, a Starlink-based navigation system could definitely get there with some tweaking.

While Humphreys’ research has uncovered another potential use for Starlink, it has also revealed a potential security flaw in Starlink signals if they were to be used as a navigation system. Known signals can be detected and even faked, which presents concerns for potential misuse.

“Any navigation system working on open-source sequences could definitely be spoofed, because everyone will know how to spot those signals and create fake ones,” explained Mark Psiaki, a GPS expert and aerospace professor at Virginia Tech.

The potential security threat is made more serious by the fact that Starlink is currently integral in keeping Ukrainian communications services online and connected to the rest of the world.

Earlier this week, Musk tweeted that Russia is “actively trying to kill Starlink.” Humphreys’ discovery — that Starlink signals are predictable and replicable — could present a new avenue for the intentional disruption of Starlink.

SpaceX has sent around 25,000 Starlink terminals to Ukraine and has over 150,000 daily active users in the embattled region.

Last week, SpaceX asked the Pentagon to take responsibility for funding Starlink kits and connections for Ukraine. Musk said a couple of days later that SpaceX would continue funding Starlink in Ukraine for free, and the company withdrew its request for funding despite the Pentagon considering it.

Update (Sunday): Musk said in a tweet that Starlink can “obviously offer far more robust positioning than GPS,” since the service will eventually have 1,000 times as many satellites. Even without every single satellite having a line of sight to users, a Starlink-based positioning system would still be 10 times better than GPS and have a far stronger signal.