6 ms·
An Implementation of Tempest in GNU Radio
- portmanteaufu 6y ago> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors > GNU Radio [2] is a Free & Open-Source Toolkit for Software Radio [1] https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename) [2] https://gnuradio.org https://gnuradio.org
- boredgamer2 6y ago> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors I've always thought of TEMPEST as magic and incredibly cool. I get how this works for video, but why is it that infosec recommends for EM shielding of a datacenter? Wouldn't there be so much EM noise from a DC that the data you could pull off be .. noisy? lossy?
- pjc50 6y agoIt's difficult, but it gets a lot easier if you can send requests in. If you can force some kind of deterministic (not salted) crypto calculation to happen with a particular piece of key material, over and over again, you can use the same correlation technique that works for extracting GPS signals from hundreds of dB below the noise floor. People have also done this with analysis of the power consumption of crypto hardware. I believe this was used against Trezor devices.
- ohazi 6y ago> GPS signals from hundreds of dB below the noise floor Nitpick: GPS is more like 20 dB below the noise floor [1] https://sdrgps.blogspot.com/2016/02/find-signal-in-noise.html https://sdrgps.blogspot.com/2016/02/find-signal-in-noise.htm... But yeah, theoretically you can cook up as much process gain as you need, it just might take a while.
- madengr 6y agoMy old boss always said "There isn't 200 dB in the entire universe". Of course if you compare the diameter of the universe to a quark, it's 10,453 dBmeters, so I guess there is.
- ohazi 6y agoThat's a pretty good rule of thumb until you get into some really weird stuff. The link budget for bouncing radio signals off the moon (EME) is something like 260 dB. A while ago I had a chance to see the ground station at NASA Goldstone where they manage the radio links to Mars and the outer planets. There was a terminal open with ~single digit bits / second coming in from one of the Voyager probes. Having a 70 meter dish and a cryogenic receiver helps, but the link budget there has got to be truly staggering...
- jandrese 6y ago200dB is the one way freespace path loss to Geo orbit. Back when I learned this I was shocked that satellite communications work at all. I can only imagine how much loss you have trying to hear communications from the Voyager probes now.
- drmpeg 6y ago318 dB for Voyager 1 at X-band.
- boredgamer2 6y ago> Back when I learned this I was shocked Care to explain? I'm not following..
- jandrese 6y agoEvery 3dB is roughly a halving of the power level. It's hard to wrap a human brain around the orders of magnitude difference, the numbers are so far outside of anything we can encounter in the human scale. Still, I will try to make an analogy. Start with the smallest transistor we make today, (7nm) and scale it up by the equivalent of 200dB and it would be 258 million km across, or about the same as the diameter of the Earth's orbit around the sun.
- ardy42 6y ago>> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors IIRC, I think it originally used the analog signals generated by controlling the electron gun in a CRT.
- deleted 6y ago[deleted]
- JackRabbitSlim 6y agoYes, but no. https://www.cl.cam.ac.uk/~mgk25/pet2004-fpd.pdf https://www.cl.cam.ac.uk/~mgk25/pet2004-fpd.pdf tl;dr The signal from a DVI cable can be detected but at much more reduced ranges. See also; RAGEMASTER (Snowden leak) a range extending implant for video cables.
- sandworm101 6y agoTEMPEST was also the codename of the NSA project for leveraging emissions. And it has become code for machines modified to protect against such things. So a "tempest computer" (if you ever see one) is a computer hardened against emissions.
- na85 6y agoThey're stupid expensive, those machines. A lot of places are finding that it's less expensive to maintain an EMSEC zone and run COTS equipment.
- sandworm101 6y agoI've heard about them being used for an opposite reason. Rather than for security, they are used in places where you don't want to risk them interfering with other equipment, like a room with radar equipment that might be sensitive.
- subsubsub 6y agoObligatory recommendation: https://en.m.wikipedia.org/wiki/Cryptonomicon https://en.m.wikipedia.org/wiki/Cryptonomicon
- louwrentius 6y agoAgreed! Would recommend this book.
- gruturo 6y agoI would recommend it too. It's also one of few Neal Stephenson books in which the ending isn't completely missing or feels too phoned in (beware it IS somewhat unsatisfactory if you wanted more closure). The author unfortunately has a longstanding position where he "doesn't owe the reader a specific type of ending" and the real world doesn't provide textbooks ending either, if I remember correctly. Such a shame because his books are on average excellent until the last 10-20%.
- kh_hk 6y agoI do not! I liked the book, I find parts of it memorable, but I never recommend it as an introduction to Neal Stephenson. Unfortunately, Anathema is also a difficult book to recommend as an introduction.
- mbowcutt 6y ago> [The characters'] goal is to facilitate anonymous Internet banking using electronic money and (later) digital gold currency, with a long-term objective to distribute Holocaust Education and Avoidance Pod (HEAP) media for instructing genocide-target populations on defensive warfare. The Holocaust education tidbit caught my eye, there was a Twitter post just a few days ago about using Filecoin to preserve genocide data https://twitter.com/dietrich/status/1258128262615773187 https://twitter.com/dietrich/status/1258128262615773187
- madengr 6y agoI always thought it was Transient ElectroMagnetic ProteEction STandard. Wikipedia says: TEMPEST (Telecommunications Electronics Materials Protected from Emanating Spurious Transmissions) This says it is "Telecommunications and Electrical Machinery Protected from Emanations Security" https://www.patton.com/solution/Tempest-EMI-RFI-Data-Security/ https://www.patton.com/solution/Tempest-EMI-RFI-Data-Securit...
- schoen 6y agoWhy would it be protected from emanations security? Achieving emanations security is the goal of these protections! Aren't all of these are probably backronyms for an originally randomly selected codeword?
- Burner99 6y agoReplying with a burner account: TEMPEST is and has always been a code name, not an acronym. I've been seeing forced acronyms to TEMPEST for decades, all of them wrong because there is no acronym.
- jcrawfordor 6y agoIt is an intelligence community convention to write codewords in ALL CAPS to differentiate them from the normal use of the same word. This doesn't indicate that they are acronyms. The appearance, though, combined with the fact that they are often in mixed use with acronyms, leads to a tendency for people to make up expansions of codewords which aren't intended to have one. Codewords were intentionally selected to have little if any relationship to what they describe. To further muddy the waters, the military is just as fond of writing things in all caps as the intelligence community is, but they usually actually are acronyms or abbreviations. In contrast to TEMPEST consider PAVE PAWS, which is an acronym, and USSPACOM, which is abbreviation.
- carapace 6y agoFun fact: TEMPEST is the reason that asterisks are substituted for passwords onscreen.
- wahern 6y agoNot simply because people can look over your shoulder?
- deleted 6y ago[deleted]
- crankylinuxuser 6y agoLight is a TEMPEST emission :) It too is EM. But yeah, you're right. Shoulder surfers are very much why * are used.
- jandrese 6y agoAsterisks for passwords predate TEMPEST by many years.
- Luc 6y agoThat would be surprising, since Tempest dates from the early 1950's.
- person_of_color 6y agoDoes this work with HDCP?
- vorpalhex 6y agoWhat's a common antenna setup for something like this? UHF Yagi?
- drmpeg 6y agoWide band antennas like this PCB Vivaldi slot are popular with the SDR crowd. http://www.w6rz.net/IMG_0069.JPG http://www.w6rz.net/IMG_0069.JPG https://www.amazon.com/RFSPACE-Wideband-Antenna-600-6000-Vivaldi/dp/B0141KA6LM/ https://www.amazon.com/RFSPACE-Wideband-Antenna-600-6000-Viv...
- AlexTrask 6y agoI'm reading Cryptonomicon of Neal Stephenson and I discovered this attack some days ago. It's mind blowing