Podcast
Root Causes 12: PKI in the News


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
April 16, 2019
It was a busy news week for PKI and authenticated identity, and our hosts run through four current stories to clarify them. Tune in to learn the latest about the Dragonblood WPA3 vulnerability, Russian spoofing of GPS/GNSS navigation signals, Know Your Customer (KYC) for social media sites, and a Chinese national's apparent attempt to install a USB rootkit somewhere in Mar-a-Lago.
Podcast Transcript
Lightly edited for flow and brevity.
The way GPS works is it depends on very, very accurate clocked signals reaching you, and the timing of the signals reaching you is how essentially you are triangulated. What’s interesting here, Tim, is the ability to mess with those signals and that’s what they are, they’re essentially electromagnetic signals going out across the air.
Bottom line question on this: If these things are so eminently spoofable and if critical systems including the things that drive our economy depend on them, is this an unacceptably fragile system? And does the global community need to be findnig a way to somehow nail down authentic identity for these sources?
Or something worse, which is what you’re seeing now, which is spoofing signals. The average person probably doesn’t know it. Unless you’re a real geek or a major shipping company you probably are aware about this, and therefore maybe you’re already using some other commercial means of navigation.
So there are other ways to do this. I don’t know of a private GPS system that’s out there currently, but in terms of shipping lanes and things like this there are other means of triangulation. For the big guys who really need to have very, very trustworthy navigation signals, they’re probably already using some other commercial means.

