5 ms·

> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connec

> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors > GNU Radio [2] is a Free & Open-Source Toolkit for Software Radio [1] https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename) [2] https://gnuradio.org https://gnuradio.org

boredgamer2 6y ago
> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors I've always thought of TEMPEST as magic and incredibly cool. I get how this works for video, but why is it that infosec recommends for EM shielding of a datacenter? Wouldn't there be so much EM noise from a DC that the data you could pull off be .. noisy? lossy?
- pjc50 6y ago
  It's difficult, but it gets a lot easier if you can send requests in. If you can force some kind of deterministic (not salted) crypto calculation to happen with a particular piece of key material, over and over again, you can use the same correlation technique that works for extracting GPS signals from hundreds of dB below the noise floor. People have also done this with analysis of the power consumption of crypto hardware. I believe this was used against Trezor devices.
  - ohazi 6y ago
    > GPS signals from hundreds of dB below the noise floor Nitpick: GPS is more like 20 dB below the noise floor [1] https://sdrgps.blogspot.com/2016/02/find-signal-in-noise.html https://sdrgps.blogspot.com/2016/02/find-signal-in-noise.htm... But yeah, theoretically you can cook up as much process gain as you need, it just might take a while.
    - madengr 6y ago
      My old boss always said "There isn't 200 dB in the entire universe". Of course if you compare the diameter of the universe to a quark, it's 10,453 dBmeters, so I guess there is.
      - ohazi 6y ago
        That's a pretty good rule of thumb until you get into some really weird stuff. The link budget for bouncing radio signals off the moon (EME) is something like 260 dB. A while ago I had a chance to see the ground station at NASA Goldstone where they manage the radio links to Mars and the outer planets. There was a terminal open with ~single digit bits / second coming in from one of the Voyager probes. Having a 70 meter dish and a cryogenic receiver helps, but the link budget there has got to be truly staggering...
      - jandrese 6y ago
        200dB is the one way freespace path loss to Geo orbit. Back when I learned this I was shocked that satellite communications work at all. I can only imagine how much loss you have trying to hear communications from the Voyager probes now.
        drmpeg 6y ago
        318 dB for Voyager 1 at X-band.
        boredgamer2 6y ago
        > Back when I learned this I was shocked Care to explain? I'm not following..
        jandrese 6y ago
        Every 3dB is roughly a halving of the power level. It's hard to wrap a human brain around the orders of magnitude difference, the numbers are so far outside of anything we can encounter in the human scale. Still, I will try to make an analogy. Start with the smallest transistor we make today, (7nm) and scale it up by the equivalent of 200dB and it would be 258 million km across, or about the same as the diameter of the Earth's orbit around the sun.
ardy42 6y ago
>> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors IIRC, I think it originally used the analog signals generated by controlling the electron gun in a CRT.
- deleted 6y ago
  [deleted]
- JackRabbitSlim 6y ago
  Yes, but no. https://www.cl.cam.ac.uk/~mgk25/pet2004-fpd.pdf https://www.cl.cam.ac.uk/~mgk25/pet2004-fpd.pdf tl;dr The signal from a DVI cable can be detected but at much more reduced ranges. See also; RAGEMASTER (Snowden leak) a range extending implant for video cables.
sandworm101 6y ago
TEMPEST was also the codename of the NSA project for leveraging emissions. And it has become code for machines modified to protect against such things. So a "tempest computer" (if you ever see one) is a computer hardened against emissions.
- na85 6y ago
  They're stupid expensive, those machines. A lot of places are finding that it's less expensive to maintain an EMSEC zone and run COTS equipment.
  - sandworm101 6y ago
    I've heard about them being used for an opposite reason. Rather than for security, they are used in places where you don't want to risk them interfering with other equipment, like a room with radar equipment that might be sensitive.

boredgamer2 6y ago

> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors I've always thought of TEMPEST as magic and incredibly cool. I get how this works for video, but why is it that infosec recommends for EM shielding of a datacenter? Wouldn't there be so much EM noise from a DC that the data you could pull off be .. noisy? lossy?

pjc50 6y ago
It's difficult, but it gets a lot easier if you can send requests in. If you can force some kind of deterministic (not salted) crypto calculation to happen with a particular piece of key material, over and over again, you can use the same correlation technique that works for extracting GPS signals from hundreds of dB below the noise floor. People have also done this with analysis of the power consumption of crypto hardware. I believe this was used against Trezor devices.
- ohazi 6y ago
  > GPS signals from hundreds of dB below the noise floor Nitpick: GPS is more like 20 dB below the noise floor [1] https://sdrgps.blogspot.com/2016/02/find-signal-in-noise.html https://sdrgps.blogspot.com/2016/02/find-signal-in-noise.htm... But yeah, theoretically you can cook up as much process gain as you need, it just might take a while.
  - madengr 6y ago
    My old boss always said "There isn't 200 dB in the entire universe". Of course if you compare the diameter of the universe to a quark, it's 10,453 dBmeters, so I guess there is.
    - ohazi 6y ago
      That's a pretty good rule of thumb until you get into some really weird stuff. The link budget for bouncing radio signals off the moon (EME) is something like 260 dB. A while ago I had a chance to see the ground station at NASA Goldstone where they manage the radio links to Mars and the outer planets. There was a terminal open with ~single digit bits / second coming in from one of the Voyager probes. Having a 70 meter dish and a cryogenic receiver helps, but the link budget there has got to be truly staggering...
    - jandrese 6y ago
      200dB is the one way freespace path loss to Geo orbit. Back when I learned this I was shocked that satellite communications work at all. I can only imagine how much loss you have trying to hear communications from the Voyager probes now.
      - drmpeg 6y ago
        318 dB for Voyager 1 at X-band.
      - boredgamer2 6y ago
        > Back when I learned this I was shocked Care to explain? I'm not following..
        jandrese 6y ago
        Every 3dB is roughly a halving of the power level. It's hard to wrap a human brain around the orders of magnitude difference, the numbers are so far outside of anything we can encounter in the human scale. Still, I will try to make an analogy. Start with the smallest transistor we make today, (7nm) and scale it up by the equivalent of 200dB and it would be 258 million km across, or about the same as the diameter of the Earth's orbit around the sun.

ardy42 6y ago

>> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors IIRC, I think it originally used the analog signals generated by controlling the electron gun in a CRT.

deleted 6y ago
[deleted]
JackRabbitSlim 6y ago
Yes, but no. https://www.cl.cam.ac.uk/~mgk25/pet2004-fpd.pdf https://www.cl.cam.ac.uk/~mgk25/pet2004-fpd.pdf tl;dr The signal from a DVI cable can be detected but at much more reduced ranges. See also; RAGEMASTER (Snowden leak) a range extending implant for video cables.

sandworm101 6y ago

TEMPEST was also the codename of the NSA project for leveraging emissions. And it has become code for machines modified to protect against such things. So a "tempest computer" (if you ever see one) is a computer hardened against emissions.

na85 6y ago
They're stupid expensive, those machines. A lot of places are finding that it's less expensive to maintain an EMSEC zone and run COTS equipment.
- sandworm101 6y ago
  I've heard about them being used for an opposite reason. Rather than for security, they are used in places where you don't want to risk them interfering with other equipment, like a room with radar equipment that might be sensitive.