One October morning in Kyiv the phone in our test car announced, with full confidence, that it was in Peru — 13,600 km away. The map didn't flicker; the accuracy circle was a neat few metres. That is what makes spoofing dangerous: a faked position looks exactly like a real one.
KeepNav kept the car in Kyiv. Here is how.
Satellites are quiet, spoofers are loud
A GPS satellite is 20,000 km away and its signal arrives weaker than the background noise. A transmitter at the roadside can easily overpower it. Civil GPS signals carry no signature, so the receiver in your phone has no way to tell an honest satellite from a box on a pole — it simply locks onto the strongest, most consistent signal.
Since Android 7 apps can read the raw measurements: for each satellite, the pseudorange, Doppler shift, signal strength and the time it claims to carry. That is the evidence we work with.
Five questions for every satellite
- Should it be visible at all? From official orbit files (IGS) we know where every satellite is. A spoofer replaying a sky for somewhere else often shows satellites that are below our horizon. On the Peru morning, several were.
- Does its Doppler match the real sky? A real satellite's frequency shift follows its motion relative to us. A simulated sky moves differently.
- Is its time right? The time inside the signal must match the network clock. Spoofers that “move” you also shift time.
- Do the groups agree? We solve the position separately from GPS, Galileo and the L1 and L5 bands. Fakes rarely cover all of them consistently.
- Is the signal too good? Uniformly strong signals and a receiver turning its gain down while signal strength goes up are typical of a nearby transmitter.
No single test decides. Each adds weighted evidence; the combination gives the status you see on the map.
When only some satellites are fake
The more common case on the road is a partial attack: some signals are fake, some genuine. On one recorded drive, of about sixty signals only 7–14 were real. KeepNav drops the ones that fail the checks and solves on the rest. The status turns orange — “GPS attack · position verified” — and the position stays within 4 m (median) of the truth. Turning everything red here would be wrong: the position is fine.
The poisoned leap second
Our favourite find. GPS time and UTC differ by a whole number of “leap seconds” — 18 today. A spoofer broadcast 19. The phone's GNSS chip believed it and kept the wrong value for more than a day after the attack, which quietly broke GLONASS and our own time check. KeepNav now takes the leap-second count from the orbit files rather than from the chip.
What we do not do
We do not publish where interference happens. The app tells you about your trip; a public map of interference zones would help the wrong people more than drivers.
Next: what KeepNav does once it has decided the satellites cannot be trusted.