3 ms·

Oona Räisänen has an awesome video of van eck phreaking against HDMI: https://www.youtube.com/watch?v=BpNP9b3aIfY https://www.youtube.com/watch?v=BpNP9b3aIfY A

Oona Räisänen has an awesome video of van eck phreaking against HDMI: https://www.youtube.com/watch?v=BpNP9b3aIfY https://www.youtube.com/watch?v=BpNP9b3aIfY Also I think this paper is amazing - http://s3.eurecom.fr/docs/ccs18_camurati_preprint.pdf http://s3.eurecom.fr/docs/ccs18_camurati_preprint.pdf "The well-known electromagnetic (EM) leakage from digital logic is inadvertently mixed with the radio carrier, which is amplified and then transmitted by the antenna. We call the resulting leak “screaming channels”" You might find this interesting too, leaking AM emissions from a computer by twiddling the memory bus - https://github.com/fulldecent/system-bus-radio https://github.com/fulldecent/system-bus-radio I made a silly program to play .wav files based on that.

segfaultbuserr 6y ago
> leaking AM emissions from a computer by twiddling the memory bus This technique is as old as computers themselves, it's well-known back to the mainframe and minicomputer era. For example, here's a video of a DEC PDP-8 (LAB-8/e) minicomputer (1971) playing music using the same technique [0], the software was Richard Wilson's "Music Compiler" written back in 1975, you should watch it. Later it was also rediscovered by the microcomputer hackers, members of the Homebrew Computer Club played Beatles on the Altair 8800. Acoustic leakage is also possible. Here [1] is a program that runs on a Thinkpad, and here's the video [2]. It changes the Intel CPU P-state to induce a coil whine at a specific frequency, and it plays PC Speaker music via the inductor coil on the switched-mode power supply of the CPU. On one hand, we can say it's a time-honored tradition in computing and hacking, on the other hand, it means the same huge side-channel exploit is still here despite that it has been half-a-century already... [0] https://www.youtube.com/watch?v=akvSE5Z474c https://www.youtube.com/watch?v=akvSE5Z474c [1] https://rkapl.cz/thinkpad-coilwhine/ https://rkapl.cz/thinkpad-coilwhine/ [2] https://www.youtube.com/watch?v=1xYZHdhYfSE https://www.youtube.com/watch?v=1xYZHdhYfSE
- anfractuosity 6y ago
  Cheers, I like the coil whine video and the DEC one too, I'd not seen them before :) In a related note that's what Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: https://www.tau.ac.il/~tromer/acoustic/ https://www.tau.ac.il/~tromer/acoustic/
  - segfaultbuserr 6y ago
    > Cheers, I like the coil whine video :) I have personally tried it on my Thinkpad, I even modified the program to play different tunes. Although my Thinkpad is a different model, it works! > Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: In my opinion, the most fascinating work of side-channel attacks by Genkin et. al, is the chassis ground potential side-channel [0]. Apparently, the conducted electromagnetic emission also induces a small voltage on the computer chassis ground (Earthing/Grounding is only for 50 Hz/60 Hz AC, it doesn't do anything at RF). Direct attack by probing the chassis is not the only way to attack, anything connected to the chassis ground, such as a CAT-5 cable, can be used. The most mind-blowing thing is, it even works across a human body! So basically, someone can steal your private key by touching your computer. [0] https://www.tau.ac.il/~tromer/handsoff/ https://www.tau.ac.il/~tromer/handsoff/
    - anfractuosity 6y ago
      Neat, I don't think I've seen that paper before, sounds very cool! I will have to read that properly, but would I be right in thinking they would be able to see their leakage on the earth wire too? I saw this where they captured PS/2 keystrokes from the earth wire: http://dev.inversepath.com/download/tempest/tempest_2009.pdf http://dev.inversepath.com/download/tempest/tempest_2009.pdf But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing?
      - segfaultbuserr 6y ago
        > but would I be right in thinking they would be able to see their leakage on the earth wire too? Yes, I think it should work. As you said, the main difference appears to be just the ADC. The PS/2 research only used a 1 Msps ADC on a microcontroller, it's a laughingly simple setup, but already productive (it's literally a 10-dollar instrument today, ideal spy gadget if your victim is still using PS/2 I guess). > But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing? Someone should try again using the latest USRP SDR receiver [0] and see what they are able to get. RTL-SDR can be used but the sampling depth (8-bit) is not ideal for hunting weak signals near a strong signal. Probing the power earth wiring instead of the chassis or data cable will be noisier, there are a lot of appliances connected. And at higher frequencies, the SNR will be worse due to attenuation, but I think nothing stops one from performing a successful attack. To my knowledge, using a power line filter is mandatory in many high-security facilitates. [0] https://www.ettus.com/ https://www.ettus.com/
diggernet 6y ago
I recall long ago playing some space game on a (speakerless) TRS-80 Model 1, which was carefully programmed to play game sound effects through any nearby AM radio tuned to the right frequency.

segfaultbuserr 6y ago

> leaking AM emissions from a computer by twiddling the memory bus This technique is as old as computers themselves, it's well-known back to the mainframe and minicomputer era. For example, here's a video of a DEC PDP-8 (LAB-8/e) minicomputer (1971) playing music using the same technique [0], the software was Richard Wilson's "Music Compiler" written back in 1975, you should watch it. Later it was also rediscovered by the microcomputer hackers, members of the Homebrew Computer Club played Beatles on the Altair 8800. Acoustic leakage is also possible. Here [1] is a program that runs on a Thinkpad, and here's the video [2]. It changes the Intel CPU P-state to induce a coil whine at a specific frequency, and it plays PC Speaker music via the inductor coil on the switched-mode power supply of the CPU. On one hand, we can say it's a time-honored tradition in computing and hacking, on the other hand, it means the same huge side-channel exploit is still here despite that it has been half-a-century already... [0] https://www.youtube.com/watch?v=akvSE5Z474c https://www.youtube.com/watch?v=akvSE5Z474c [1] https://rkapl.cz/thinkpad-coilwhine/ https://rkapl.cz/thinkpad-coilwhine/ [2] https://www.youtube.com/watch?v=1xYZHdhYfSE https://www.youtube.com/watch?v=1xYZHdhYfSE

anfractuosity 6y ago
Cheers, I like the coil whine video and the DEC one too, I'd not seen them before :) In a related note that's what Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: https://www.tau.ac.il/~tromer/acoustic/ https://www.tau.ac.il/~tromer/acoustic/
- segfaultbuserr 6y ago
  > Cheers, I like the coil whine video :) I have personally tried it on my Thinkpad, I even modified the program to play different tunes. Although my Thinkpad is a different model, it works! > Genkin et. al exploited along with capacitors changing size too, to extract RSA keys: In my opinion, the most fascinating work of side-channel attacks by Genkin et. al, is the chassis ground potential side-channel [0]. Apparently, the conducted electromagnetic emission also induces a small voltage on the computer chassis ground (Earthing/Grounding is only for 50 Hz/60 Hz AC, it doesn't do anything at RF). Direct attack by probing the chassis is not the only way to attack, anything connected to the chassis ground, such as a CAT-5 cable, can be used. The most mind-blowing thing is, it even works across a human body! So basically, someone can steal your private key by touching your computer. [0] https://www.tau.ac.il/~tromer/handsoff/ https://www.tau.ac.il/~tromer/handsoff/
  - anfractuosity 6y ago
    Neat, I don't think I've seen that paper before, sounds very cool! I will have to read that properly, but would I be right in thinking they would be able to see their leakage on the earth wire too? I saw this where they captured PS/2 keystrokes from the earth wire: http://dev.inversepath.com/download/tempest/tempest_2009.pdf http://dev.inversepath.com/download/tempest/tempest_2009.pdf But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing?
    - segfaultbuserr 6y ago
      > but would I be right in thinking they would be able to see their leakage on the earth wire too? Yes, I think it should work. As you said, the main difference appears to be just the ADC. The PS/2 research only used a 1 Msps ADC on a microcontroller, it's a laughingly simple setup, but already productive (it's literally a 10-dollar instrument today, ideal spy gadget if your victim is still using PS/2 I guess). > But I'm wondering if using a high sample rate ADC would pick up other emissions like Genkin et. al are doing? Someone should try again using the latest USRP SDR receiver [0] and see what they are able to get. RTL-SDR can be used but the sampling depth (8-bit) is not ideal for hunting weak signals near a strong signal. Probing the power earth wiring instead of the chassis or data cable will be noisier, there are a lot of appliances connected. And at higher frequencies, the SNR will be worse due to attenuation, but I think nothing stops one from performing a successful attack. To my knowledge, using a power line filter is mandatory in many high-security facilitates. [0] https://www.ettus.com/ https://www.ettus.com/

diggernet 6y ago

I recall long ago playing some space game on a (speakerless) TRS-80 Model 1, which was carefully programmed to play game sound effects through any nearby AM radio tuned to the right frequency.