Van Eck Phreaking(en.wikipedia.org)
en.wikipedia.org
Van Eck Phreaking
https://en.wikipedia.org/wiki/Van_Eck_phreaking
63 comments
I can hear it without an AM radio! It's very clear but extremely quiet. My machine is muted and I'm trying to work out where in the world the audio is coming from. I wonder if it's just the speakers in this monitor picking up the signal. Or one of my switched mode power supplies that also sometimes whines very quietly in the background.
I'd imagine it is the speakers in the monitor picking up the signal, with their wires acting as an antenna. AM is cool like that.
I always thought it requires a CRT screen, but I got a surprisingly clear signal from my LCD screen.
Why does this work? Where does the recoverable signal leak? I would expect a modern LCD to be full of digital signals sent in unpredictable, manufacturer-specific ways, and certainly not sequentially enough to leak as recognizable audio.
Why does this work? Where does the recoverable signal leak? I would expect a modern LCD to be full of digital signals sent in unpredictable, manufacturer-specific ways, and certainly not sequentially enough to leak as recognizable audio.
> full of digital signals sent in unpredictable
My opinion is digital signals are the very antithesis of "unpredictable", it's always an exact replication. Of course it may look like garbage (and sometimes even intentionally scrambled to garbage for electrical reasons) to the naked eyes without interpretation, but many things are possible after signal processing.
> manufacturer-specific ways
First, there are industrial standards on display interfaces, for example, there are well-defined ways to send a video signal, such as HDMI to the monitor, and LVDS (a specific version of LVDS) from the monitor to the LCD panel. The majority of LCD screens use these standard. Second, even when there's no standard, similar architectures are used across different systems, for example, most LCD drivers on the market are similar to each other. Discovering a way of doing it on a new system is not exactly a surprise.
> and certainly not sequentially enough to leak as recognizable audio.
All you need to do is doing something periodically. Even if the activity you're doing is at low frequency, often it influences some high frequency signals so that a signal can be modulated. As a thought experiment, if you write something to RAM with all 1s and all 0s once every few seconds, it's very reasonable to assume it creates a detectable burst of radiation on the RF spectrum even if the bus itself runs at a higher frequency. In practice it's more subtle and specific from system to system but there's often a way.
For example, it's possible to modulate a computer's memory bus to emit AM audio by accessing the memory in a specific pattern using a few lines of assembly code, whether on a PDP-11 or a MacBook, it's possible to modulate the mechanical vibration of inductor coils on the CPU power circuitry to emit audible music on a Thinkpad by rapidly changing the CPU power state, etc.
There are endless number of ingenious ways of doing it, if you have control over a process.
My opinion is digital signals are the very antithesis of "unpredictable", it's always an exact replication. Of course it may look like garbage (and sometimes even intentionally scrambled to garbage for electrical reasons) to the naked eyes without interpretation, but many things are possible after signal processing.
> manufacturer-specific ways
First, there are industrial standards on display interfaces, for example, there are well-defined ways to send a video signal, such as HDMI to the monitor, and LVDS (a specific version of LVDS) from the monitor to the LCD panel. The majority of LCD screens use these standard. Second, even when there's no standard, similar architectures are used across different systems, for example, most LCD drivers on the market are similar to each other. Discovering a way of doing it on a new system is not exactly a surprise.
> and certainly not sequentially enough to leak as recognizable audio.
All you need to do is doing something periodically. Even if the activity you're doing is at low frequency, often it influences some high frequency signals so that a signal can be modulated. As a thought experiment, if you write something to RAM with all 1s and all 0s once every few seconds, it's very reasonable to assume it creates a detectable burst of radiation on the RF spectrum even if the bus itself runs at a higher frequency. In practice it's more subtle and specific from system to system but there's often a way.
For example, it's possible to modulate a computer's memory bus to emit AM audio by accessing the memory in a specific pattern using a few lines of assembly code, whether on a PDP-11 or a MacBook, it's possible to modulate the mechanical vibration of inductor coils on the CPU power circuitry to emit audible music on a Thinkpad by rapidly changing the CPU power state, etc.
There are endless number of ingenious ways of doing it, if you have control over a process.
>I always thought it requires a CRT screen,
Probably you were right, in the past, because it has become much easier to do this with LCD screens as their resolution has increased into a range which demands fine control of higher-frequency digital data -- high enough (a function of the Nyquist frequency, I guess) to reproduce an analog radio signal with sufficient control to carry a recognizable audio signal
Probably you were right, in the past, because it has become much easier to do this with LCD screens as their resolution has increased into a range which demands fine control of higher-frequency digital data -- high enough (a function of the Nyquist frequency, I guess) to reproduce an analog radio signal with sufficient control to carry a recognizable audio signal
I think it's mostly the power draw that's leaking. Timing the pulses with those thick white and black bars is what lets you do it so easily. Pulling individual pixels off the screen would be a much more difficult task.
My guess is that it's leaking in multiple places. Since it's relatively crude by alternating "all black" and "all white" pixels at different "switch rates", it generates recognizable noise in multiple places. That seems to match all the different frequencies you see people reporting to find it. And people finding it regardless of how the signal is getting to the monitor, LVDS, HDMI, VGA, etc.
The "requires a CRT screen" was, I think, referencing the much more fine grained ability to actually recreate what was displayed on a screen. Though that's been replicated for LCDs now also.
The "requires a CRT screen" was, I think, referencing the much more fine grained ability to actually recreate what was displayed on a screen. Though that's been replicated for LCDs now also.
Cheap HDMI cables typically leak image information quite nicely. With the right equipment, it's really easy to get a decent resolution image of the radiation picked up from an HDMI cable even over tens of meters.
Does anyone have a link to a demonstration of this? I'm not sure what keywords I should be searching.
Keywords: HDMI RF leakage attack. Putting them in a search engine, I was able to find an article about it quickly.
* DVI (HDMI) and DisplayPort digital video interfaces in electromagnetic eavesdropping process
https://sci-hub.se/https://doi.org/10.1109/EMCEurope.2019.88...
You can also search for "side-channel" and "TEMPEST".
---
The signals analyzed below are LVDS and VGA, not exactly HDMI, but also an interesting read - because the LVDS signal is used to drive the LCD panel and it's also a major source of leakage.
* Exposing Computer Monitor Side-Channel Vulnerabilities With TempestSDR
https://hackaday.com/2020/07/15/exposing-computer-monitor-si...
The author of the program even wrote a paper on that for a master degree.
https://raw.githubusercontent.com/martinmarinov/TempestSDR/1...
* DVI (HDMI) and DisplayPort digital video interfaces in electromagnetic eavesdropping process
https://sci-hub.se/https://doi.org/10.1109/EMCEurope.2019.88...
You can also search for "side-channel" and "TEMPEST".
---
The signals analyzed below are LVDS and VGA, not exactly HDMI, but also an interesting read - because the LVDS signal is used to drive the LCD panel and it's also a major source of leakage.
* Exposing Computer Monitor Side-Channel Vulnerabilities With TempestSDR
https://hackaday.com/2020/07/15/exposing-computer-monitor-si...
The author of the program even wrote a paper on that for a master degree.
https://raw.githubusercontent.com/martinmarinov/TempestSDR/1...
Isn't EMC testing supposed to uncover this kind of flaw, and what does the FCC say about equipment which leaks like this?
They do, but it would fall under "unintentional radiators", and the measurements are made at some distance from the device. Something like this language:
Except for Class A digital devices, the field strength of radiated emissions from unintentional radiators at a distance of 3 meters shall not exceed the following values:
Frequency of emission(MHz) Field strength (microvolts/meter)
30-88 100
88-216 150
216-960 200
Above 960 500For civilian applications, EMC standards and tests primarily ensure the RF leakage is not severe enough to create harmful interference to other devices or users of the RF spectrum, and that your device is robust enough to handle reasonable interference from others. But, it's not designed to eliminate information leakage and protect you from enemy actions. There are specialized (often military) EMC standards that are designed to do this, most famously, TEMPEST by the U.S. government. But you're unlikely to see it in any consumer electronics. Heavy shielding is required.
I remember when a character started rambling paragraphs about Van Eck Phreaking in Cryptonomicon, it was immediately obvious that this would become a plot device later in the book.
Yes, I first learned about this from Cryptonomicon. Apparently it wasn't performed using LCD screens until 5 years after the book was published.
Say what you want about Stephenson's writing, but he definitely has a knack for understanding concepts before they enter the public consciousness.
Is that still true? Honest question.
Cryptonomicon did such a wonderful job of capturing a certain something from the 1990ies. I haven't enjoyed his more recent books as much. Seveneves was depressing. Dodge had really bad reviews and I haven't bothered with it.
Cryptonomicon did such a wonderful job of capturing a certain something from the 1990ies. I haven't enjoyed his more recent books as much. Seveneves was depressing. Dodge had really bad reviews and I haven't bothered with it.
Snow Crash is parody literature, but the fantasy is built around very good predictions about the future. He coined the word "avatar" for virtual characters, and the book contains a direct inspiration for google maps.
Earth, initially. Keyhole cited Snow Crash as direct inspiration for their EarthViewer application, what became Google Earth post-acquisition.
No, Randy Farmer and Chip Morningstar coined the word "avatar" for virtual characters in 01986, and Snow Crash wasn't published until 01992: http://habitatchronicles.com/2008/08/on-language-avatar-nyti...
I was always under the assumption that they independently coined the word. At the very least, "avatar" wasn't well-known until Snow Crash came out, so it's possible Stephenson didn't know it was an existing word and came up with it for the same reasons as Farmer and Morningstar. It's also a near-certainty that the wider tech community only adopted the word "avatar" after reading it in Snow Crash due to the book's popularity, so even if he didn't independently co-coin the word, he's still the one who popularized it.
(if you're familiar at all with TVTropes, the latter is the difference between the concept of a Trope Maker and a Trope Codifier)
(if you're familiar at all with TVTropes, the latter is the difference between the concept of a Trope Maker and a Trope Codifier)
> I was always under the assumption that they independently coined the word.
I guess it's possible? I certainly hadn't heard of Habitat in 01992, or indeed until after I met Chip, and the correspondence with the Hindu concept is quite arresting. But then again, I never had a Commodore 64, and Neal Stephenson always loves to be plugged into everything that's trendy. Farmer and Morningstar gave a paper http://www.fudco.com/chip/lessons.html at The First International Conference on Cyberspace in 01990, which seems like the kind of thing you would maybe go to if you were writing a novel like Snow Crash in 01990. But they say Habitat (or rather Club Caribe) only had 15000 users at the time.
> (if you're familiar at all with TVTropes,
I love TVTropes! If we're talking about the cyberspace avatar trope rather than the use of the word "avatar" for it, you could maybe trace that back to Vinge's 01981 True Names, as mentioned in the talk I linked above.
I guess it's possible? I certainly hadn't heard of Habitat in 01992, or indeed until after I met Chip, and the correspondence with the Hindu concept is quite arresting. But then again, I never had a Commodore 64, and Neal Stephenson always loves to be plugged into everything that's trendy. Farmer and Morningstar gave a paper http://www.fudco.com/chip/lessons.html at The First International Conference on Cyberspace in 01990, which seems like the kind of thing you would maybe go to if you were writing a novel like Snow Crash in 01990. But they say Habitat (or rather Club Caribe) only had 15000 users at the time.
> (if you're familiar at all with TVTropes,
I love TVTropes! If we're talking about the cyberspace avatar trope rather than the use of the word "avatar" for it, you could maybe trace that back to Vinge's 01981 True Names, as mentioned in the talk I linked above.
Assume you mean applied rather than coined. Avatar in Hinduism = form / skin / incarnation
Yeah, of course I didn't mean they invented the word, just a new sense of it. It isn't the literal sense from Hinduism because game players aren't gods, and because typically the characters they play in the games don't exist until the players incarnate in them, but it's clearly a metaphorical extension of the Hindu concept, as explained in the article I linked above.
I really enjoyed Snow Crash; I felt that Seveneves was two completely different books that were coincidentally in the same universe, nether of which felt bad in isolation, but they definitely didn’t feel unified.
I wasn’t a fan of Quicksilver, but as that was the first historical novel I’ve listened to, and as it was award winning, I assume it must be more about my tastes than the quality of the writing?
I wasn’t a fan of Quicksilver, but as that was the first historical novel I’ve listened to, and as it was award winning, I assume it must be more about my tastes than the quality of the writing?
I liked the second part of Seveneves, but the first bit felt really depressing, and more than a bit unrealistic.
I liked Quicksilver, but could easily see how it's not everyone's cup of tea.
I liked Quicksilver, but could easily see how it's not everyone's cup of tea.
Apologies for breaking seveneves for you:
Why do they need to generate artificial Y chromosomes when there is a whole bunch of perfectly good ones in the last man alive who just died with them; and thousands upon thousands in the scattered genetic material in the frozen tin cans floating about in various orbits between earth and the shattered moon? And why does that have to lead to essentially speciation of the survivors?
Why do they need to generate artificial Y chromosomes when there is a whole bunch of perfectly good ones in the last man alive who just died with them; and thousands upon thousands in the scattered genetic material in the frozen tin cans floating about in various orbits between earth and the shattered moon? And why does that have to lead to essentially speciation of the survivors?
The tin cans heavily exposed to radiation? And in direct sunlight so more likely desiccated than frozen? And didn’t that guy just die of cancer? Though I was wondering why they didn’t start collecting semen and egg samples immediately after the total loss of the first samples.
Perhaps I’m misremembering, but I didn’t perceive the description as true speciation, more like socially defined racial groups.
Perhaps I’m misremembering, but I didn’t perceive the description as true speciation, more like socially defined racial groups.
What about the first bit seemed unrealistic? I mean, besides the hand of God smacking the moon into bits. I loved the commitment to rock hard scifi, and the slow decay of relations on board resonated.
The fact that they could eke out an existence in such a challenging environment after so much went wrong just seemed a bit far-fetched.
You know what, now that I think about it you're probably right. I think that the story just played into my feeling of a small team being able to carefully navigate where a large group takes on a mind of its own, and usually for ill. That's true in my experience for some things, but in space? With no backup? Probably doesn't carry over.
"Seveneves was depressing" - there's an understatement. Quite interesting sci-fi in it I thought, but did anyone really think a story about the end of the world would be a fun read?
Dodge in hell was more micro level depressing, he starts of by killing one of the main characters from a previous book after all. But I found it enjoyable over all. I think he managed to convey what he wanted with the book, and unlike Seveneves it was a quite fun read.
Dodge in hell was more micro level depressing, he starts of by killing one of the main characters from a previous book after all. But I found it enjoyable over all. I think he managed to convey what he wanted with the book, and unlike Seveneves it was a quite fun read.
Seveneves is absolutely depressing, and so stressful! I loved it, but the agonizing sense of balancing on a wire doesn't end until they finally lock in on the peach pit. I can definitely see how it could cross the line from tense to unreadable, especially considering how jarring the third part is.
I just loved Anathem, Reamde and Fall.
I enjoyed Reamde a lot, some twists of fate left me cackling with delight. However, it felt much more meandering than other Stephenson novels. Is Fall better in that respect?
I liked Anathem and Reamde. DODO was ok, although it leaves you hanging a bit and apparently the sequel is even worse from that point of view, from the reviews.
My favorites are The Diamond Age and Anathem, but thoroughly enjoyed Seveneves and Dodge.
I almost dropped Dodge 1/4 of the way in due to it being to dull. I thought Stephenson had lost his edge. Stuck through it, and loved it! It tackles a collection of related issues that are relevant today, and I think will continue to become more so in the near future, especially for the HN crowd. Ie his concepts of a post-truth-future, cultures emerging and isolating using controlled access to information etc. Speculative neuroscience too, ie how the brain constructs a cohesive model of the world.
Dodge seems to be the most polarizing Stephenson book.
I almost dropped Dodge 1/4 of the way in due to it being to dull. I thought Stephenson had lost his edge. Stuck through it, and loved it! It tackles a collection of related issues that are relevant today, and I think will continue to become more so in the near future, especially for the HN crowd. Ie his concepts of a post-truth-future, cultures emerging and isolating using controlled access to information etc. Speculative neuroscience too, ie how the brain constructs a cohesive model of the world.
Dodge seems to be the most polarizing Stephenson book.
Seveneves was spectacular, by far one of my all-time favorite books. To each their own, I suppose.
POSSIBLE VAGUE SPOILER
I don't recall it actually being a plot device though. It effectively just served to drive Waterhouse's panic that someone was watching him, but then it sort of fizzles out. Unless I missed some implied detail, nobody actually ever used it to spy on him.
I don't recall it actually being a plot device though. It effectively just served to drive Waterhouse's panic that someone was watching him, but then it sort of fizzles out. Unless I missed some implied detail, nobody actually ever used it to spy on him.
SPOILER:
It actually drives the climatic finale where Waterhouse performs an "epic hack" while in jail, modifying the linux kernel on his laptop to output the results of his cracking the encryption on the location of a cave full of gold as morse code in the form of his caps lock light going on and off. He also makes sure to write the code that will make these changes via hitting his space bar, which is translated to characters based on the amount of times he hits it, so that again the code to do the calculations is never exposed on screen. The only reason he is so careful about never exposing both the changes he is making to his laptop's code as well as the results of the calculations it runs is because Enoch Root visits him while he is in jail and basically warns him that people will be using Van Eck Phreaking to spy on the contents of his display.
So really, it is actually one of the most crucially import bits of technology in the whole book.
It actually drives the climatic finale where Waterhouse performs an "epic hack" while in jail, modifying the linux kernel on his laptop to output the results of his cracking the encryption on the location of a cave full of gold as morse code in the form of his caps lock light going on and off. He also makes sure to write the code that will make these changes via hitting his space bar, which is translated to characters based on the amount of times he hits it, so that again the code to do the calculations is never exposed on screen. The only reason he is so careful about never exposing both the changes he is making to his laptop's code as well as the results of the calculations it runs is because Enoch Root visits him while he is in jail and basically warns him that people will be using Van Eck Phreaking to spy on the contents of his display.
So really, it is actually one of the most crucially import bits of technology in the whole book.
ANOTHER POSSIBLE VAGUE SPOILER
IIRC the protagonists actually do use Van Eck phreaking later in the novel to read out what's on their adversary's laptop screen from the next hotel room over.
IIRC the protagonists actually do use Van Eck phreaking later in the novel to read out what's on their adversary's laptop screen from the next hotel room over.
SPOILERS
IIRC it's not an adversary but their fiend with whom they have a bet about whether Van Eck Phreaking works or not ;)
Also, Van Eck Phreaking's use by their adversaries is implied when Randy's in jail and working on his laptop decrypting the coordinates of the gold stash, again IIRC.
IIRC it's not an adversary but their fiend with whom they have a bet about whether Van Eck Phreaking works or not ;)
Also, Van Eck Phreaking's use by their adversaries is implied when Randy's in jail and working on his laptop decrypting the coordinates of the gold stash, again IIRC.
Here's the chapter in question with some helpful links. The bit of furniture erotica showing on the screen is hilarious (scroll towards the end)
https://lost-contact.mit.edu/afs/adrake.org/usr/rkh/Books/bo...
https://lost-contact.mit.edu/afs/adrake.org/usr/rkh/Books/bo...
[deleted]
TEMPEST is available now, for free, on github.
All you need is a $20 RTL-SDR.
https://www.youtube.com/watch?v=QjqpKtGNbQo
https://github.com/martinmarinov/TempestSDR
All you need is a $20 RTL-SDR.
https://www.youtube.com/watch?v=QjqpKtGNbQo
https://github.com/martinmarinov/TempestSDR
Didn't know the barrier to entry had fallen so low. Last I saw it was only under very specific conditions with lots of expensive equipment that this stuff could be recovered.
This video (https://www.youtube.com/watch?v=ZZ5HS8GWIec) linked at the bottom of the page shows the attack in action.
Why are there so few demonstration videos to be found of this? The one tyingq listed is one of the few concrete ones I've ever found. I remember reading about it in the 90's, but never being able to find it actually working.
from 2 years ago https://www.youtube.com/watch?v=BpNP9b3aIfY
Don't miss https://en.m.wikipedia.org/wiki/Tempest_(codename), which is at least as interesting.
https://en.wikipedia.org/wiki/Operation_RAFTER another sneaky one (highly recommend the book spycatcher, really unique perspective in that the author was a proper engineer on the frontline in the cold war)
[deleted]
When this was all still secret, I was at a conference in a conversation with some emanations security people and they were remarking on the internal case of a new Mac server at the time that had round perforations in it, likely to make the aluminum frame cheaper in raw materials, but they were noting how this would impede some of the interception capabilities.
I wonder how in-scope this would be for bug bounty programs. Getting a dev's-eye view into an application would be invaluable for determining attack vectors, and there's also snooping kanban boards for low-priority bugs and slack for lazy cred sharing.
If I didn't live out in the sticks (and had done research to make sure it would be legal) I'd give it a go.
If I didn't live out in the sticks (and had done research to make sure it would be legal) I'd give it a go.
[deleted]
This reminds me of reports in the early 2000's of collecting data from ethernet port leds if they were badly designed.
Reminds me of my favourite book series, the laundry files.
One of the more scary characters refuses to own a computer.
Because Van Eck Phreaking.
One of the more scary characters refuses to own a computer.
Because Van Eck Phreaking.
"Everything that oscillates, transmits"
https://www.youtube.com/watch?v=DlVM9xqGKx8
Plays Für Elise on a radio placed close to your monitor while you play that video full screen.