4 ms·

> one DES link encryption box [...] was sending out plaintext on the LEDs What? Care to elaborate? Did they just set the LED brightness based on the current oc

by jey 9y ago

> one DES link encryption box [...] was sending out plaintext on the LEDs What? Care to elaborate? Did they just set the LED brightness based on the current octet being encoded or something? But that seems like it's too high frequency to work.

jloughry 9y ago
In the early 1990s when we did this research, it was mostly RS-232 devices; the designers did in fact often connect LEDs directly to the serial TXD and RXD lines, which are relatively high voltage and have plenty of drive capability. Garden variety LEDs are plenty fast enough to reproduce bit transitions in the nanosecond range; we measured intelligible signals in the lab well into megabits per second; on real devices in the field, hundreds of kilobits per second. You're right, the trick wouldn't work so well with modern LVDS levels and speeds, but we examined (at the time) lots of Ethernet NICs with LEDs on them and found no indication there of useful data in the optical region. (It was a different story on the back panel of enterprise Cisco routers....) Ethernet PHY chips invariably, so far as I've seen, implement a pulse stretcher on the LED output pins for exactly the reason you noted. We found no intelligible optical emanations from any of the—admittedly low-cost—Ethernet devices we tested. But since then, two things have happened: USB and HFT. There are definite opportunities for the same thing to happen again. I've seen indications of it in a few USB devices. High Frequency Trading, though, is a whole other can of worms. There, you have FPGAs and ASICs being used to shave nanoseconds off latency, and I wouldn't be a bit surprised to see off-the-shelf gigabit Ethernet PHY chips spurned by fintech specialists designing an extremely specialised piece of hardware to do one job and do it as fast as physics allows. There's a window of opportunity there (sorry!) for rival HFT firms with a telescope and very high speed photodetector to exploit any incautiously wired-up LEDs connected directly to ASIC signals.... Hint: use a photomultiplier; PIN photodiodes are fast but the transimpedance amplifiers they need are s-l-o-w.
jloughry 9y ago
The details of the DES encryption vulnerability are all in our paper; it's behind a paywall but you can find it on my web site: J. Loughry and D.A. Umphress. 'Information Leakage from Optical Emanations'. ACM Trans. Info. Sys. Sec. 5(3), pp. 262–289, 2002. Available for free from http://applied-math.org/acm_optical_tempest.pdf http://applied-math.org/acm_optical_tempest.pdf

by jey 9y ago

jloughry 9y ago

In the early 1990s when we did this research, it was mostly RS-232 devices; the designers did in fact often connect LEDs directly to the serial TXD and RXD lines, which are relatively high voltage and have plenty of drive capability. Garden variety LEDs are plenty fast enough to reproduce bit transitions in the nanosecond range; we measured intelligible signals in the lab well into megabits per second; on real devices in the field, hundreds of kilobits per second. You're right, the trick wouldn't work so well with modern LVDS levels and speeds, but we examined (at the time) lots of Ethernet NICs with LEDs on them and found no indication there of useful data in the optical region. (It was a different story on the back panel of enterprise Cisco routers....) Ethernet PHY chips invariably, so far as I've seen, implement a pulse stretcher on the LED output pins for exactly the reason you noted. We found no intelligible optical emanations from any of the—admittedly low-cost—Ethernet devices we tested. But since then, two things have happened: USB and HFT. There are definite opportunities for the same thing to happen again. I've seen indications of it in a few USB devices. High Frequency Trading, though, is a whole other can of worms. There, you have FPGAs and ASICs being used to shave nanoseconds off latency, and I wouldn't be a bit surprised to see off-the-shelf gigabit Ethernet PHY chips spurned by fintech specialists designing an extremely specialised piece of hardware to do one job and do it as fast as physics allows. There's a window of opportunity there (sorry!) for rival HFT firms with a telescope and very high speed photodetector to exploit any incautiously wired-up LEDs connected directly to ASIC signals.... Hint: use a photomultiplier; PIN photodiodes are fast but the transimpedance amplifiers they need are s-l-o-w.

jloughry 9y ago

The details of the DES encryption vulnerability are all in our paper; it's behind a paywall but you can find it on my web site: J. Loughry and D.A. Umphress. 'Information Leakage from Optical Emanations'. ACM Trans. Info. Sys. Sec. 5(3), pp. 262–289, 2002. Available for free from http://applied-math.org/acm_optical_tempest.pdf http://applied-math.org/acm_optical_tempest.pdf