4 ms·

I always thought it requires a CRT screen, but I got a surprisingly clear signal from my LCD screen. Why does this work? Where does the recoverable signal leak

I always thought it requires a CRT screen, but I got a surprisingly clear signal from my LCD screen. Why does this work? Where does the recoverable signal leak? I would expect a modern LCD to be full of digital signals sent in unpredictable, manufacturer-specific ways, and certainly not sequentially enough to leak as recognizable audio.

tyingq 6y ago
My guess is that it's leaking in multiple places. Since it's relatively crude by alternating "all black" and "all white" pixels at different "switch rates", it generates recognizable noise in multiple places. That seems to match all the different frequencies you see people reporting to find it. And people finding it regardless of how the signal is getting to the monitor, LVDS, HDMI, VGA, etc. The "requires a CRT screen" was, I think, referencing the much more fine grained ability to actually recreate what was displayed on a screen. Though that's been replicated for LCDs now also.
- amelius 6y ago
  Isn't EMC testing supposed to uncover this kind of flaw, and what does the FCC say about equipment which leaks like this?
  - tyingq 6y ago
    They do, but it would fall under "unintentional radiators", and the measurements are made at some distance from the device. Something like this language: Except for Class A digital devices, the field strength of radiated emissions from unintentional radiators at a distance of 3 meters shall not exceed the following values: Frequency of emission(MHz) Field strength (microvolts/meter) 30-88 100 88-216 150 216-960 200 Above 960 500
  - segfaultbuserr 6y ago
    For civilian applications, EMC standards and tests primarily ensure the RF leakage is not severe enough to create harmful interference to other devices or users of the RF spectrum, and that your device is robust enough to handle reasonable interference from others. But, it's not designed to eliminate information leakage and protect you from enemy actions. There are specialized (often military) EMC standards that are designed to do this, most famously, TEMPEST by the U.S. government. But you're unlikely to see it in any consumer electronics. Heavy shielding is required.
- lippel82 6y ago
  Cheap HDMI cables typically leak image information quite nicely. With the right equipment, it's really easy to get a decent resolution image of the radiation picked up from an HDMI cable even over tens of meters.
  - crtasm 6y ago
    Does anyone have a link to a demonstration of this? I'm not sure what keywords I should be searching.
    - segfaultbuserr 6y ago
      Keywords: HDMI RF leakage attack. Putting them in a search engine, I was able to find an article about it quickly. * DVI (HDMI) and DisplayPort digital video interfaces in electromagnetic eavesdropping process https://sci-hub.se/https://doi.org/10.1109/EMCEurope.2019.8872097 https://sci-hub.se/https://doi.org/10.1109/EMCEurope.2019.88... You can also search for "side-channel" and "TEMPEST". --- The signals analyzed below are LVDS and VGA, not exactly HDMI, but also an interesting read - because the LVDS signal is used to drive the LCD panel and it's also a major source of leakage. * Exposing Computer Monitor Side-Channel Vulnerabilities With TempestSDR https://hackaday.com/2020/07/15/exposing-computer-monitor-side-channel-vulnerabilities-with-tempestsdr/ https://hackaday.com/2020/07/15/exposing-computer-monitor-si... The author of the program even wrote a paper on that for a master degree. https://raw.githubusercontent.com/martinmarinov/TempestSDR/16e526f0ee440f97bd3d3064cb94b8312bb33a2d/documentation/acs-dissertation.pdf https://raw.githubusercontent.com/martinmarinov/TempestSDR/1...
    - rianmcguire 6y ago
      Here's one: https://www.youtube.com/watch?v=BpNP9b3aIfY https://www.youtube.com/watch?v=BpNP9b3aIfY
segfaultbuserr 6y ago
> full of digital signals sent in unpredictable My opinion is digital signals are the very antithesis of "unpredictable", it's always an exact replication. Of course it may look like garbage (and sometimes even intentionally scrambled to garbage for electrical reasons) to the naked eyes without interpretation, but many things are possible after signal processing. > manufacturer-specific ways First, there are industrial standards on display interfaces, for example, there are well-defined ways to send a video signal, such as HDMI to the monitor, and LVDS (a specific version of LVDS) from the monitor to the LCD panel. The majority of LCD screens use these standard. Second, even when there's no standard, similar architectures are used across different systems, for example, most LCD drivers on the market are similar to each other. Discovering a way of doing it on a new system is not exactly a surprise. > and certainly not sequentially enough to leak as recognizable audio. All you need to do is doing something periodically. Even if the activity you're doing is at low frequency, often it influences some high frequency signals so that a signal can be modulated. As a thought experiment, if you write something to RAM with all 1s and all 0s once every few seconds, it's very reasonable to assume it creates a detectable burst of radiation on the RF spectrum even if the bus itself runs at a higher frequency. In practice it's more subtle and specific from system to system but there's often a way. For example, it's possible to modulate a computer's memory bus to emit AM audio by accessing the memory in a specific pattern using a few lines of assembly code, whether on a PDP-11 or a MacBook, it's possible to modulate the mechanical vibration of inductor coils on the CPU power circuitry to emit audible music on a Thinkpad by rapidly changing the CPU power state, etc. There are endless number of ingenious ways of doing it, if you have control over a process.
px43 6y ago
I think it's mostly the power draw that's leaking. Timing the pulses with those thick white and black bars is what lets you do it so easily. Pulling individual pixels off the screen would be a much more difficult task.
herendin2 6y ago
>I always thought it requires a CRT screen, Probably you were right, in the past, because it has become much easier to do this with LCD screens as their resolution has increased into a range which demands fine control of higher-frequency digital data -- high enough (a function of the Nyquist frequency, I guess) to reproduce an analog radio signal with sufficient control to carry a recognizable audio signal

tyingq 6y ago

My guess is that it's leaking in multiple places. Since it's relatively crude by alternating "all black" and "all white" pixels at different "switch rates", it generates recognizable noise in multiple places. That seems to match all the different frequencies you see people reporting to find it. And people finding it regardless of how the signal is getting to the monitor, LVDS, HDMI, VGA, etc. The "requires a CRT screen" was, I think, referencing the much more fine grained ability to actually recreate what was displayed on a screen. Though that's been replicated for LCDs now also.

amelius 6y ago
Isn't EMC testing supposed to uncover this kind of flaw, and what does the FCC say about equipment which leaks like this?
- tyingq 6y ago
  They do, but it would fall under "unintentional radiators", and the measurements are made at some distance from the device. Something like this language: Except for Class A digital devices, the field strength of radiated emissions from unintentional radiators at a distance of 3 meters shall not exceed the following values: Frequency of emission(MHz) Field strength (microvolts/meter) 30-88 100 88-216 150 216-960 200 Above 960 500
- segfaultbuserr 6y ago
  For civilian applications, EMC standards and tests primarily ensure the RF leakage is not severe enough to create harmful interference to other devices or users of the RF spectrum, and that your device is robust enough to handle reasonable interference from others. But, it's not designed to eliminate information leakage and protect you from enemy actions. There are specialized (often military) EMC standards that are designed to do this, most famously, TEMPEST by the U.S. government. But you're unlikely to see it in any consumer electronics. Heavy shielding is required.
lippel82 6y ago
Cheap HDMI cables typically leak image information quite nicely. With the right equipment, it's really easy to get a decent resolution image of the radiation picked up from an HDMI cable even over tens of meters.
- crtasm 6y ago
  Does anyone have a link to a demonstration of this? I'm not sure what keywords I should be searching.
  - segfaultbuserr 6y ago
    Keywords: HDMI RF leakage attack. Putting them in a search engine, I was able to find an article about it quickly. * DVI (HDMI) and DisplayPort digital video interfaces in electromagnetic eavesdropping process https://sci-hub.se/https://doi.org/10.1109/EMCEurope.2019.8872097 https://sci-hub.se/https://doi.org/10.1109/EMCEurope.2019.88... You can also search for "side-channel" and "TEMPEST". --- The signals analyzed below are LVDS and VGA, not exactly HDMI, but also an interesting read - because the LVDS signal is used to drive the LCD panel and it's also a major source of leakage. * Exposing Computer Monitor Side-Channel Vulnerabilities With TempestSDR https://hackaday.com/2020/07/15/exposing-computer-monitor-side-channel-vulnerabilities-with-tempestsdr/ https://hackaday.com/2020/07/15/exposing-computer-monitor-si... The author of the program even wrote a paper on that for a master degree. https://raw.githubusercontent.com/martinmarinov/TempestSDR/16e526f0ee440f97bd3d3064cb94b8312bb33a2d/documentation/acs-dissertation.pdf https://raw.githubusercontent.com/martinmarinov/TempestSDR/1...
  - rianmcguire 6y ago
    Here's one: https://www.youtube.com/watch?v=BpNP9b3aIfY https://www.youtube.com/watch?v=BpNP9b3aIfY

segfaultbuserr 6y ago

> full of digital signals sent in unpredictable My opinion is digital signals are the very antithesis of "unpredictable", it's always an exact replication. Of course it may look like garbage (and sometimes even intentionally scrambled to garbage for electrical reasons) to the naked eyes without interpretation, but many things are possible after signal processing. > manufacturer-specific ways First, there are industrial standards on display interfaces, for example, there are well-defined ways to send a video signal, such as HDMI to the monitor, and LVDS (a specific version of LVDS) from the monitor to the LCD panel. The majority of LCD screens use these standard. Second, even when there's no standard, similar architectures are used across different systems, for example, most LCD drivers on the market are similar to each other. Discovering a way of doing it on a new system is not exactly a surprise. > and certainly not sequentially enough to leak as recognizable audio. All you need to do is doing something periodically. Even if the activity you're doing is at low frequency, often it influences some high frequency signals so that a signal can be modulated. As a thought experiment, if you write something to RAM with all 1s and all 0s once every few seconds, it's very reasonable to assume it creates a detectable burst of radiation on the RF spectrum even if the bus itself runs at a higher frequency. In practice it's more subtle and specific from system to system but there's often a way. For example, it's possible to modulate a computer's memory bus to emit AM audio by accessing the memory in a specific pattern using a few lines of assembly code, whether on a PDP-11 or a MacBook, it's possible to modulate the mechanical vibration of inductor coils on the CPU power circuitry to emit audible music on a Thinkpad by rapidly changing the CPU power state, etc. There are endless number of ingenious ways of doing it, if you have control over a process.

px43 6y ago

I think it's mostly the power draw that's leaking. Timing the pulses with those thick white and black bars is what lets you do it so easily. Pulling individual pixels off the screen would be a much more difficult task.

herendin2 6y ago

>I always thought it requires a CRT screen, Probably you were right, in the past, because it has become much easier to do this with LCD screens as their resolution has increased into a range which demands fine control of higher-frequency digital data -- high enough (a function of the Nyquist frequency, I guess) to reproduce an analog radio signal with sufficient control to carry a recognizable audio signal