6 ms·

That first link (https://www.win.tue.nl/~aeb/linux/hh/tempest.pdf https://www.win.tue.nl/~aeb/linux/hh/tempest.pdf) is absolutely fascinating.

jcims 6y ago
For <$100 you too can play at home: https://github.com/martinmarinov/TempestSDR https://github.com/martinmarinov/TempestSDR https://www.rtl-sdr.com/tempestsdr-a-sdr-tool-for-eavesdropping-on-computer-screens-via-unintentionally-radiated-rf/ https://www.rtl-sdr.com/tempestsdr-a-sdr-tool-for-eavesdropp...
anfractuosity 6y ago
Oona Räisänen has an awesome video of van eck phreaking against HDMI: https://www.youtube.com/watch?v=BpNP9b3aIfY https://www.youtube.com/watch?v=BpNP9b3aIfY Also I think this paper is amazing - http://s3.eurecom.fr/docs/ccs18_camurati_preprint.pdf http://s3.eurecom.fr/docs/ccs18_camurati_preprint.pdf "The well-known electromagnetic (EM) leakage from digital logic is inadvertently mixed with the radio carrier, which is amplified and then transmitted by the antenna. We call the resulting leak “screaming channels”" You might find this interesting too, leaking AM emissions from a computer by twiddling the memory bus - https://github.com/fulldecent/system-bus-radio https://github.com/fulldecent/system-bus-radio I made a silly program to play .wav files based on that.
- segfaultbuserr 6y ago
  > leaking AM emissions from a computer by twiddling the memory bus This technique is as old as computers themselves, it's well-known back to the mainframe and minicomputer era. For example, here's a video of a DEC PDP-8 (LAB-8/e) minicomputer (1971) playing music using the same technique [0], the software was Richard Wilson's "Music Compiler" written back in 1975, you should watch it. Later it was also rediscovered by the microcomputer hackers, members of the Homebrew Computer Club played Beatles on the Altair 8800. Acoustic leakage is also possible. Here [1] is a program that runs on a Thinkpad, and here's the video [2]. It changes the Intel CPU P-state to induce a coil whine at a specific frequency, and it plays PC Speaker music via the inductor coil on the switched-mode power supply of the CPU. On one hand, we can say it's a time-honored tradition in computing and hacking, on the other hand, it means the same huge side-channel exploit is still here despite that it has been half-a-century already... [0] https://www.youtube.com/watch?v=akvSE5Z474c https://www.youtube.com/watch?v=akvSE5Z474c [1] https://rkapl.cz/thinkpad-coilwhine/ https://rkapl.cz/thinkpad-coilwhine/ [2] https://www.youtube.com/watch?v=1xYZHdhYfSE https://www.youtube.com/watch?v=1xYZHdhYfSE
  - anfractuosity 6y ago
    Cheers, I like the coil whine video and the DEC one too, I'd not seen them before :) In a related note that's what Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: https://www.tau.ac.il/~tromer/acoustic/ https://www.tau.ac.il/~tromer/acoustic/
    - segfaultbuserr 6y ago
      > Cheers, I like the coil whine video :) I have personally tried it on my Thinkpad, I even modified the program to play different tunes. Although my Thinkpad is a different model, it works! > Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: In my opinion, the most fascinating work of side-channel attacks by Genkin et. al, is the chassis ground potential side-channel [0]. Apparently, the conducted electromagnetic emission also induces a small voltage on the computer chassis ground (Earthing/Grounding is only for 50 Hz/60 Hz AC, it doesn't do anything at RF). Direct attack by probing the chassis is not the only way to attack, anything connected to the chassis ground, such as a CAT-5 cable, can be used. The most mind-blowing thing is, it even works across a human body! So basically, someone can steal your private key by touching your computer. [0] https://www.tau.ac.il/~tromer/handsoff/ https://www.tau.ac.il/~tromer/handsoff/
      - anfractuosity 6y ago
        Neat, I don't think I've seen that paper before, sounds very cool! I will have to read that properly, but would I be right in thinking they would be able to see their leakage on the earth wire too? I saw this where they captured PS/2 keystrokes from the earth wire: http://dev.inversepath.com/download/tempest/tempest_2009.pdf http://dev.inversepath.com/download/tempest/tempest_2009.pdf But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing?
        segfaultbuserr 6y ago
        > but would I be right in thinking they would be able to see their leakage on the earth wire too? Yes, I think it should work. As you said, the main difference appears to be just the ADC. The PS/2 research only used a 1 Msps ADC on a microcontroller, it's a laughingly simple setup, but already productive (it's literally a 10-dollar instrument today, ideal spy gadget if your victim is still using PS/2 I guess). > But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing? Someone should try again using the latest USRP SDR receiver [0] and see what they are able to get. RTL-SDR can be used but the sampling depth (8-bit) is not ideal for hunting weak signals near a strong signal. Probing the power earth wiring instead of the chassis or data cable will be noisier, there are a lot of appliances connected. And at higher frequencies, the SNR will be worse due to attenuation, but I think nothing stops one from performing a successful attack. To my knowledge, using a power line filter is mandatory in many high-security facilitates. [0] https://www.ettus.com/ https://www.ettus.com/
- diggernet 6y ago
  I recall long ago playing some space game on a (speakerless) TRS-80 Model 1, which was carefully programmed to play game sound effects through any nearby AM radio tuned to the right frequency.
mettamage 6y ago
It's Hackers Hut [1]! I found it out when I was still doing security courses at the Vrije Universiteit Amsterdam. Hackers Hut is an absolutely amazing resource from the University of Eindhoven. And it is fun to know that the Vrije Universiteit isn't the only Dutch university doing security research (also shoutout to Delft! I saw some great work from them as well -- mostly in the form of my teacher Pietro Frigo). [1] https://www.win.tue.nl/~aeb/linux/hh/ https://www.win.tue.nl/~aeb/linux/hh/ (removed tempest.pdf)
elsonrodriguez 6y ago
The most infuriating part of this document is that the Seismics, Flooding, and Anomalies section of the document are still redacted many decades later. It's also the most interesting part of the document!
- yummypaint 6y ago
  Perhaps there is still deployed equipment with the exact vulnerabilities described? Any idea what flooding refers to?
diggernet 6y ago
This reminds me of an old used printer I bought, long ago. Sadly, I don't recall the printer model, but I think it was built in the 1980's. When I opened it up to clean it, I discovered it was full of extra circuit components (with "In-Q-Tel" labels). It appeared to be a special TEMPEST-shielded unit.
- JetSpiegel 6y ago
  > In-Q-Tel The CIA front, for those unfamiliar with the name.

jcims 6y ago

For <$100 you too can play at home: https://github.com/martinmarinov/TempestSDR https://github.com/martinmarinov/TempestSDR https://www.rtl-sdr.com/tempestsdr-a-sdr-tool-for-eavesdropping-on-computer-screens-via-unintentionally-radiated-rf/ https://www.rtl-sdr.com/tempestsdr-a-sdr-tool-for-eavesdropp...

anfractuosity 6y ago

Oona Räisänen has an awesome video of van eck phreaking against HDMI: https://www.youtube.com/watch?v=BpNP9b3aIfY https://www.youtube.com/watch?v=BpNP9b3aIfY Also I think this paper is amazing - http://s3.eurecom.fr/docs/ccs18_camurati_preprint.pdf http://s3.eurecom.fr/docs/ccs18_camurati_preprint.pdf "The well-known electromagnetic (EM) leakage from digital logic is inadvertently mixed with the radio carrier, which is amplified and then transmitted by the antenna. We call the resulting leak “screaming channels”" You might find this interesting too, leaking AM emissions from a computer by twiddling the memory bus - https://github.com/fulldecent/system-bus-radio https://github.com/fulldecent/system-bus-radio I made a silly program to play .wav files based on that.

segfaultbuserr 6y ago
> leaking AM emissions from a computer by twiddling the memory bus This technique is as old as computers themselves, it's well-known back to the mainframe and minicomputer era. For example, here's a video of a DEC PDP-8 (LAB-8/e) minicomputer (1971) playing music using the same technique [0], the software was Richard Wilson's "Music Compiler" written back in 1975, you should watch it. Later it was also rediscovered by the microcomputer hackers, members of the Homebrew Computer Club played Beatles on the Altair 8800. Acoustic leakage is also possible. Here [1] is a program that runs on a Thinkpad, and here's the video [2]. It changes the Intel CPU P-state to induce a coil whine at a specific frequency, and it plays PC Speaker music via the inductor coil on the switched-mode power supply of the CPU. On one hand, we can say it's a time-honored tradition in computing and hacking, on the other hand, it means the same huge side-channel exploit is still here despite that it has been half-a-century already... [0] https://www.youtube.com/watch?v=akvSE5Z474c https://www.youtube.com/watch?v=akvSE5Z474c [1] https://rkapl.cz/thinkpad-coilwhine/ https://rkapl.cz/thinkpad-coilwhine/ [2] https://www.youtube.com/watch?v=1xYZHdhYfSE https://www.youtube.com/watch?v=1xYZHdhYfSE
- anfractuosity 6y ago
  Cheers, I like the coil whine video and the DEC one too, I'd not seen them before :) In a related note that's what Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: https://www.tau.ac.il/~tromer/acoustic/ https://www.tau.ac.il/~tromer/acoustic/
  - segfaultbuserr 6y ago
    > Cheers, I like the coil whine video :) I have personally tried it on my Thinkpad, I even modified the program to play different tunes. Although my Thinkpad is a different model, it works! > Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: In my opinion, the most fascinating work of side-channel attacks by Genkin et. al, is the chassis ground potential side-channel [0]. Apparently, the conducted electromagnetic emission also induces a small voltage on the computer chassis ground (Earthing/Grounding is only for 50 Hz/60 Hz AC, it doesn't do anything at RF). Direct attack by probing the chassis is not the only way to attack, anything connected to the chassis ground, such as a CAT-5 cable, can be used. The most mind-blowing thing is, it even works across a human body! So basically, someone can steal your private key by touching your computer. [0] https://www.tau.ac.il/~tromer/handsoff/ https://www.tau.ac.il/~tromer/handsoff/
    - anfractuosity 6y ago
      Neat, I don't think I've seen that paper before, sounds very cool! I will have to read that properly, but would I be right in thinking they would be able to see their leakage on the earth wire too? I saw this where they captured PS/2 keystrokes from the earth wire: http://dev.inversepath.com/download/tempest/tempest_2009.pdf http://dev.inversepath.com/download/tempest/tempest_2009.pdf But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing?
      - segfaultbuserr 6y ago
        > but would I be right in thinking they would be able to see their leakage on the earth wire too? Yes, I think it should work. As you said, the main difference appears to be just the ADC. The PS/2 research only used a 1 Msps ADC on a microcontroller, it's a laughingly simple setup, but already productive (it's literally a 10-dollar instrument today, ideal spy gadget if your victim is still using PS/2 I guess). > But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing? Someone should try again using the latest USRP SDR receiver [0] and see what they are able to get. RTL-SDR can be used but the sampling depth (8-bit) is not ideal for hunting weak signals near a strong signal. Probing the power earth wiring instead of the chassis or data cable will be noisier, there are a lot of appliances connected. And at higher frequencies, the SNR will be worse due to attenuation, but I think nothing stops one from performing a successful attack. To my knowledge, using a power line filter is mandatory in many high-security facilitates. [0] https://www.ettus.com/ https://www.ettus.com/
diggernet 6y ago
I recall long ago playing some space game on a (speakerless) TRS-80 Model 1, which was carefully programmed to play game sound effects through any nearby AM radio tuned to the right frequency.

mettamage 6y ago

It's Hackers Hut [1]! I found it out when I was still doing security courses at the Vrije Universiteit Amsterdam. Hackers Hut is an absolutely amazing resource from the University of Eindhoven. And it is fun to know that the Vrije Universiteit isn't the only Dutch university doing security research (also shoutout to Delft! I saw some great work from them as well -- mostly in the form of my teacher Pietro Frigo). [1] https://www.win.tue.nl/~aeb/linux/hh/ https://www.win.tue.nl/~aeb/linux/hh/ (removed tempest.pdf)

elsonrodriguez 6y ago

The most infuriating part of this document is that the Seismics, Flooding, and Anomalies section of the document are still redacted many decades later. It's also the most interesting part of the document!

yummypaint 6y ago
Perhaps there is still deployed equipment with the exact vulnerabilities described? Any idea what flooding refers to?

diggernet 6y ago

This reminds me of an old used printer I bought, long ago. Sadly, I don't recall the printer model, but I think it was built in the 1980's. When I opened it up to clean it, I discovered it was full of extra circuit components (with "In-Q-Tel" labels). It appeared to be a special TEMPEST-shielded unit.

JetSpiegel 6y ago
> In-Q-Tel The CIA front, for those unfamiliar with the name.