Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All...
Transcript of Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All...
![Page 1: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/1.jpg)
11/8/2009
1
Security : Forensic Signal Analysis: MPHIL ACS 2009
Video eavesdropping- RF
Y.K. Roland Tai
Security : Forensic Signal Analysis
1. Introduction
2. History of TEMPEST
3. Type of RF leakages
4. Counter-measures.
5. Experiment & Demo
![Page 2: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/2.jpg)
11/8/2009
2
Phenomenon of video eavesdropping
1. All electronics equipment emit RF emissions
2. Classified information may ride onto these
emission and be rebroadcasted.
Electromagnetic RF emissions
Attacker
Rx antenna
X distance
Security : Forensic Signal Analysis: MPHIL ACS 2009
History
* Information extracted from paper Soft Tempest: Hidden data Transmission
Using Electromagnetic emanations.
![Page 3: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/3.jpg)
11/8/2009
3
http://img393.imageshack.us/i/b28ck.jpg/
Attacks use available electromagnetic RF
signal.
1. Leakage through conduction. E.g Pipes,
signal cables. (Near field coupling)
2. Leakage through RF signal.(Far field
radiation)
Passive Attack
![Page 4: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/4.jpg)
11/8/2009
4
Leakage Through RF
All monitors emit weak TV signal
1.UHF or VHF radio modulated with distorted
version of displayed image
2.Emissions can be reconstructed using a
good broadband receiver
3.LCD monitors are also vulnerable
4.Serial cable (acts as radiating antenna) from
LCD carries video signal
3. Leakage through RF
(Direct radiation leakage)
Detection
system
Non-intrusive
Attack with use of high
Gain antenna
Unintended
Leakage signal
Classified information
F1
F1
F1
Note:
Assume F1 is one of the
Compromising emanation frequencies
Typical Attack
scenario
![Page 5: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/5.jpg)
11/8/2009
5
4. Leakage through RF
(Non-linear intermodulation radiation leakage)
Detection
system
Non-intrusive
Attack with use of high
Gain antenna
Classified information
F1
F2
Non-linear
mixing
F3
Where F3 is the intermod frequency.
F3= F2+F1 or F3 = F2-F1
F3
Leakage Through Conduction
1. Equipment based
• fax
• Ethernet cables
• RS-232
2. Infrastructure based (Buildings)
1. Power cables
2. Telephone lines
3. Metallic piping
![Page 6: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/6.jpg)
11/8/2009
6
1. Leakage through conduction
(Direct conduction leakage)
Common cable
connection points
e.g. Power line, LAN
cable, Telephone cable
Detection
system
Non-intrusive
Attack with use of current sensor
Typical Attack
scenario
2. Leakage through conduction
(Radiated conduction leakage)
Common cable
connection points
Detection
system
Non-intrusive
Attack with use of current sensor
Un Classified
information
Radiated
![Page 7: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/7.jpg)
11/8/2009
7
Vulnerability levels of Computer equipment
Note: Quote from paper: Countermeasures to Prevent Eavesdropping on Unintentional Emanations from Personal
Computers
Video timing
1. Actual video contents
2. H-Sync pulses
(48kHz, 80kHz etc)
One line of information
3. Vertical sync pulses
(60Hz, 75Hz, 100Hz etc.)
Entire frame
![Page 8: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/8.jpg)
11/8/2009
8
Blanking pulses
Front porch
Back porch
*Extracted : presentation slides “Electromagnetic eavesdropping on computers”, Markus Kuhn
Video timing of Display monitor
*
FT
Series of Equidistant Dirac Series of Equidistant Dirac with reciprocal
distance
Single pixel
Rectangular pulse Sinc function
FT
![Page 9: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/9.jpg)
11/8/2009
9
*
Samples of video information appearing across the entire spectrum
at very fp frequency.
Video pixel information Sampling at rate of fp
*Extracted : presentation slides “Electromagnetic eavesdropping on computers”, Markus Kuhn
![Page 10: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/10.jpg)
11/8/2009
10
*Extracted : presentation slides “Electromagnetic eavesdropping on computers”, Markus Kuhn
…
Video Detection System
Bw> =10MHz
1.Receive antenna
2.Receiver of at least 10MHz Bandwidth
DSI TEMPEST
Receivers
Every fp frequencyReject all other
transmissions Amplify
![Page 11: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/11.jpg)
11/8/2009
11
*Electromagnetic eavesdropping on computers, Markus Kuhn
•Trade off between image reconstruct quality with receiver
Bandwidth.
• Higher bandwidth will have higher noise level.
Van Eck
Markus Kuhn
Sync
Generation units
TV aerial
Target
PC
Receivers
Detection System built in the past
![Page 12: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/12.jpg)
11/8/2009
12
•Detection is a challenge in the fully occupied radio
spectrum.
•Random noise from the external environment.
•Requires at least S/N ratio of 10dB.
•Periodic averaging to improve S/N of the video image
http://www.youtube.com/watch?v=YcTM0dqVz14&feature=related
Actual Detection System
Semi-Anechoic chamber
to provide a clean spectrum
for detailed analysis
Measurement
of TEMPEST signals
EMRL chamber in
NTU 10m
9kHz to 18GHz
![Page 13: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/13.jpg)
11/8/2009
13
Effective radiator
Every traces on the PCB carries
current.
The amount of radiation depends:-
1.Speed of transitions
2. The length of the traces.
e.g. for 30MHz the length must be at
least 2.5m for it to emit effectively.
f
c=λ
Where :
c = speed of light
f= frequency
λ = lamda
The E and the H fields will
then be in phase and
orthogonal to each other
producing plane waves
R >>
R <
The E and the H fields are not
in phase and orthogonal to
each other producing
inductive or capacitive load
![Page 14: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/14.jpg)
11/8/2009
14
RF attenuation over distance
1/r
Free Space Loss = 32.45 + 20log(d) + 20log(f)dB
(where d is in km and f is in MHz)
RF attenuation over distance
FSPL is a function of d and f
*For every twice in distance increase
we will have 6dB of RF attenuation.
![Page 15: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/15.jpg)
11/8/2009
15
Shielded
fabric
Laptop inside
Both hands inside
to prevent keyboards emission
Do we have to work inside a shielded box???
http://rayannelutenerblog.files.wordpress.com/2008/06/body-laptop-interface-lorax.jpg
Source image from :
Mitigation measures
Shielded fabric tent Wide band jammer
Shielded PC or laptop
![Page 16: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/16.jpg)
11/8/2009
16
Mitigation measures
Architectural shielding3M shielded
film
Mitigation measures
Signal Jamming ??
*Countermeasures to prevent eavesdropping on Unintentional Emanations from personal computer
![Page 17: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/17.jpg)
11/8/2009
17
Mitigation measures
Mitigation measures
1.Soft fonts
2.Message hiding (Dithering)
Software
![Page 18: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/18.jpg)
11/8/2009
18
1.Soft fonts ( Low pass Filtering)
Mitigation measures
Conventional fonts Filtered (30% of horizontal spectrum)
*Soft Tempest: Hidden Data Transmission
Using Electromagnetic Emanations, Markus Kuhn and Ross Anderson.
University of Cambridge
Markus Kuhn and Ross Anderson, University of Cambridge
1.Soft fonts
Normal text With Soft-fonts
*Soft Tempest: Hidden Data Transmission
Using Electromagnetic Emanations, Markus Kuhn and Ross Anderson.
Mitigation measures
![Page 19: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/19.jpg)
11/8/2009
19
*Evaluation and Improvement of the Tempest Fonts
Hidema Tanaka, Osamu Takizawa, and Akihiro Yamamura
National Institute of Information and Communications Technology
21 inch CRT
NANAO FlexScan 77F
SONY VAIO PCG-V505
notebookOriginal Text
1.Soft fonts (Gaussian and Low Pass Filters)
Mitigation measures
2.Message hiding (Dithering)
1. High frequency BLACK/WHITE dither pattern creates strongest signal
with highest emission.
2. Constant color provide the minimize emissions
Mitigation measures
![Page 20: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/20.jpg)
11/8/2009
20
Software Define Radio (SDR)
- Advancement in digital
electronics
Where hardware like ADC, mixer ,
modulator and demodulator can
be implemented in Software.
Gnuradio provides some available
software .
Miniaturize Detection system
Technical specifications
![Page 21: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/21.jpg)
11/8/2009
21
Experiment using the
ETTus USRP2
LAN Port
Target
IF out
Extract to Matlab
![Page 22: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/22.jpg)
11/8/2009
22
Target laptop : Toshiba CDX 440
Display resolution: 800 x 600
Xt = 1056 and yt =628
Dynamic science receiver
Center frequency = 350 MHz
Bandwidth = 20MHz
SDR was set to capture the IF output signal at
frequency of 30MHz with sampling rate of
about 25Msamples/sec.
Raster the image using the absolute
values of I and Q
![Page 23: Video display eavesdropping RF-slides · 11/8/2009 2 Phenomenon of video eavesdropping 1. All electronics equipment emit RF emissions 2. Classified information may ride onto these](https://reader033.fdocuments.in/reader033/viewer/2022042111/5e8c05f3867d2374564bf97c/html5/thumbnails/23.jpg)
11/8/2009
23
Raster the image using the complex I
and Q
DEMO