With an off the shelf antenna, what kind of range can you spoof?

I was involved in some GPS SDR research in university, and this is one of those conversations where I have reservations about participating both because of potential exporting of technology (hey guys, here are some GPS jamming tips!) and simply making doing nefarious things easier for people who found my comment. On another level it is unfortunate to feel and act suspicious and mistrusting.

Imagine if someone said the same to you when you expressed an interest in this field.

To the interested, this paper [0] from microsoft mentions a range of 40-50 meters with off the shelf hardware.

[0]: https://people.cs.vt.edu/gangwang/sec18-gps.pdf

I would suggest hardwiring it to avoid committing a federal crime.

https://www.fcc.gov/general/jammer-enforcement

Even just the leakage might get you in trouble if there is any, it should really be done in an rf shielded enclosure.

This. If you have access to a tunnel, deep basement, or cave, these can serve.

+1

A USRP N2X0 will spoof a phone in the same room just through leakage

This sounds like something one learns unexpectedly.

I use a crappy antenna and I get a few meters, without any amplification. If it was going further I would use attenuators or a cage.

I have the SDR streaming satellite data for 5min and it then restarts and retransmitts again. That allows units on the assembly table to get a sat lock and pass the factory test.

Does it see the SDR as one satellite, or multiple? I guess you can just spoof as many satellites as you want, but wouldn't it be rather hard to spoof a position?

Not the OP, but it'd see it as multiple SVs. Basically you figure out what the range would be from the SVs to whatever location you want the things to think they're at, and put out all the signals to make that happen. Spoofing a single SV is pretty useless, you have to spoof at least enough of them to give you a position solution.

Do you need to slave the clock to anything?