3 ms·

My first job in tech as a teenager (2007 or so) was doing blueprint analysis and WiFi Access Point placement for a US Defense contractor in the Midwest. While

by marstr 8y ago

My first job in tech as a teenager (2007 or so) was doing blueprint analysis and WiFi Access Point placement for a US Defense contractor in the Midwest. While working on one of the buildings with some missile guidance programs, I found a small room in the center of the building that had twelve inch thick concrete walls and a thick steel door. Determined to do my job, I experimented with placing several access points near this room until I found a combination that would force enough signal to connect through those walls. I had the telecom team pull wires, a month later I threw some WAPs in my backpack and installed them. A week later I got an email marked urgent demanding that my team turn off these access points immediately. I complied, but asked what exactly the concern was. They mentioned that by bouncing WiFi signals, a van parked in the parking lot could monitor the activity in any room they wanted. At the time I thought they were crazy, and at times I've told this story to demonstrate how paranoid that company was. Looks like there was some real basis to their concern.

nickpsecurity 8y ago
It's called an active emanation attack. Passive attacks interpret the electromagnetic signals that electronic devices naturally emanate. They try to reconstruct what the original information was. The active attacks work by doing the equivalent how you see trees at night with a flashlight: they hit the target with a signal, it is affected by what's there, it bounces back, and you get a distorted version of whatever that was. EMSEC standards, esp TEMPEST shielding, were invented to mitigate as much of that as possible. Although it's classified, there's been a number of sites talking about public and some declassified info. I don't have the link to old site everyone in hacking community used. Here's one provider that describes it nicely plus illustrates what the products look like. They used to be way bulkier. http://sst.ws/what-is-tempest.php http://sst.ws/what-is-tempest.php Some more links. Elovici's lab is at the forefront of new attacks. http://www.elastic.org/~fche/mirrors/www.cryptome.org/nsa-tempest.htm http://www.elastic.org/~fche/mirrors/www.cryptome.org/nsa-te... http://tempest-inc.com/ http://tempest-inc.com/ https://en.wikipedia.org/wiki/Yuval_Elovici https://en.wikipedia.org/wiki/Yuval_Elovici Here's the quote that first taught me about the risk you described: "A STU-III is a highly sophisticated digital device; however, they suffer from a particular nasty vulnerability to strong RF signals that if not properly addressed can cause the accidental disclosure of classified information, and recovery of the keys by an eavesdropper. While the unit itself is well shielded, the power line feeding the unit may not have a clean ground (thus negating the shielding)... The best way to deal with this is to never have a cellular telephone or pager on your person when using a STU, or within a radius of at least thirty feet (in any direction) from an operational STU (even with a good ground). If the STU is being used in a SCIF or secure facility a cell phone is supposed to be an excluded item, but it is simply amazing how many government people (who know better) forget to turn off their phone before entering controlled areas and thus cause classified materials to be compromised." These are also another piece of evidence for two claims I often make: mainstream security folks don't produce devices that are actually secure; NSA/DOD are opponents of securing American infrastructure. On the first, high-assurance security and NSA certifications for TS/SCI demanded EMSEC since they were known attacks, esp by US and Russia. Mainstream ignored them mostly for "secure" products with only a handful trying to do something. The second claim is from fact that security agencies misled U.S. companies and individuals about these risks specifically so they could use the attacks on them if needed. Although I don't recall if current, they also refused to sell TEMPEST-certified systems outside Defense in the past. So, NSA and pals were known to keep us vulnerable on purpose long before Snowden leaks. I've been griping about and trying to raise awareness of it for some time. Examples: https://www.schneier.com/blog/archives/2011/08/business_week_o_1.html#c568363 https://www.schneier.com/blog/archives/2011/08/business_week... https://www.schneier.com/blog/archives/2014/03/friday_squid_bl_420.html#c5226750 https://www.schneier.com/blog/archives/2014/03/friday_squid_...

by marstr 8y ago

nickpsecurity 8y ago

It's called an active emanation attack. Passive attacks interpret the electromagnetic signals that electronic devices naturally emanate. They try to reconstruct what the original information was. The active attacks work by doing the equivalent how you see trees at night with a flashlight: they hit the target with a signal, it is affected by what's there, it bounces back, and you get a distorted version of whatever that was. EMSEC standards, esp TEMPEST shielding, were invented to mitigate as much of that as possible. Although it's classified, there's been a number of sites talking about public and some declassified info. I don't have the link to old site everyone in hacking community used. Here's one provider that describes it nicely plus illustrates what the products look like. They used to be way bulkier. http://sst.ws/what-is-tempest.php http://sst.ws/what-is-tempest.php Some more links. Elovici's lab is at the forefront of new attacks. http://www.elastic.org/~fche/mirrors/www.cryptome.org/nsa-tempest.htm http://www.elastic.org/~fche/mirrors/www.cryptome.org/nsa-te... http://tempest-inc.com/ http://tempest-inc.com/ https://en.wikipedia.org/wiki/Yuval_Elovici https://en.wikipedia.org/wiki/Yuval_Elovici Here's the quote that first taught me about the risk you described: "A STU-III is a highly sophisticated digital device; however, they suffer from a particular nasty vulnerability to strong RF signals that if not properly addressed can cause the accidental disclosure of classified information, and recovery of the keys by an eavesdropper. While the unit itself is well shielded, the power line feeding the unit may not have a clean ground (thus negating the shielding)... The best way to deal with this is to never have a cellular telephone or pager on your person when using a STU, or within a radius of at least thirty feet (in any direction) from an operational STU (even with a good ground). If the STU is being used in a SCIF or secure facility a cell phone is supposed to be an excluded item, but it is simply amazing how many government people (who know better) forget to turn off their phone before entering controlled areas and thus cause classified materials to be compromised." These are also another piece of evidence for two claims I often make: mainstream security folks don't produce devices that are actually secure; NSA/DOD are opponents of securing American infrastructure. On the first, high-assurance security and NSA certifications for TS/SCI demanded EMSEC since they were known attacks, esp by US and Russia. Mainstream ignored them mostly for "secure" products with only a handful trying to do something. The second claim is from fact that security agencies misled U.S. companies and individuals about these risks specifically so they could use the attacks on them if needed. Although I don't recall if current, they also refused to sell TEMPEST-certified systems outside Defense in the past. So, NSA and pals were known to keep us vulnerable on purpose long before Snowden leaks. I've been griping about and trying to raise awareness of it for some time. Examples: https://www.schneier.com/blog/archives/2011/08/business_week_o_1.html#c568363 https://www.schneier.com/blog/archives/2011/08/business_week... https://www.schneier.com/blog/archives/2014/03/friday_squid_bl_420.html#c5226750 https://www.schneier.com/blog/archives/2014/03/friday_squid_...