4 ms·

Very interesting, will have to read that properly, the results look impressive. I came across this paper 'Eye of Sauron: Long-Range Hidden Spy Camera Detection

Very interesting, will have to read that properly, the results look impressive. I came across this paper 'Eye of Sauron: Long-Range Hidden Spy Camera Detection and Positioning with Inbuilt Memory EM Radiation' recently, which I thought was extremely clever too. (https://www.usenix.org/system/files/sec24fall-prepub-357-zhang-qibo.pdf https://www.usenix.org/system/files/sec24fall-prepub-357-zha...)

vessenes 2y ago
Thanks for linking this paper, that’s super interesting. Seems like a project tailor made for a tech transfer startup and acquisition. I bet you could add directionality to the detector — essentially just walk around the room and go.
kurthr 2y ago
I am quite impressed by the results. Really, I was originally amazed that they were able to get much at all. I'm more familiar with DisplayPort so I was surprised that a fully differential embedded clock compressed 8b10b signal at 6GHz was recoverable. The answer is that I suspect it is not, even if a 1600:900 60Hz HDMI 1.4 with a 324MHz pixel clock is. I think there are some fairly big caveats with this (still quite impressive) work. It appears to be on HDMI 1.4 (2009), and although I don't doubt many TVs (though fewer monitors) use such an old standard, it's certainly not modern. It's limited to FHD at 60Hz (or 4k at 30Hz). Even HDMI 2.1 is from 2017. The differences are fairly significant. HDMI 1.4 is differential, but uses a separate clock rather than embedded clock for 2.1, which makes collecting FM data a LOT easier. The channel clock is "only" 350MHz t0 1.7GHz rather than an embedded clock signal carrying 12Gbps on a 6GHz 2bit symbol rate for modern HDMI. The video data is uncompressed rather than "lossless" compression (~4:1), which also makes things MUCH easier. Higher refresh rate might actually provide more data for eavesdropping, but higher HDR color depths probably confuse things. Modern video transports are often now "whitened" with short length LFSR to minimize radiation peaks for FCC compliance, but I don't really know about HDMI in particular. The Gate and Source line drivers on a modern LCD might give you more information since they're closer to analog (High voltage single ended) and only run at a few hundred kHz, but they are massively parallel rather than serial.

vessenes 2y ago

Thanks for linking this paper, that’s super interesting. Seems like a project tailor made for a tech transfer startup and acquisition. I bet you could add directionality to the detector — essentially just walk around the room and go.

kurthr 2y ago

I am quite impressed by the results. Really, I was originally amazed that they were able to get much at all. I'm more familiar with DisplayPort so I was surprised that a fully differential embedded clock compressed 8b10b signal at 6GHz was recoverable. The answer is that I suspect it is not, even if a 1600:900 60Hz HDMI 1.4 with a 324MHz pixel clock is. I think there are some fairly big caveats with this (still quite impressive) work. It appears to be on HDMI 1.4 (2009), and although I don't doubt many TVs (though fewer monitors) use such an old standard, it's certainly not modern. It's limited to FHD at 60Hz (or 4k at 30Hz). Even HDMI 2.1 is from 2017. The differences are fairly significant. HDMI 1.4 is differential, but uses a separate clock rather than embedded clock for 2.1, which makes collecting FM data a LOT easier. The channel clock is "only" 350MHz t0 1.7GHz rather than an embedded clock signal carrying 12Gbps on a 6GHz 2bit symbol rate for modern HDMI. The video data is uncompressed rather than "lossless" compression (~4:1), which also makes things MUCH easier. Higher refresh rate might actually provide more data for eavesdropping, but higher HDR color depths probably confuse things. Modern video transports are often now "whitened" with short length LFSR to minimize radiation peaks for FCC compliance, but I don't really know about HDMI in particular. The Gate and Source line drivers on a modern LCD might give you more information since they're closer to analog (High voltage single ended) and only run at a few hundred kHz, but they are massively parallel rather than serial.