An Implementation of Tempest in GNU Radio | Hacker News Reader

An Implementation of Tempest in GNU Radio

github.com

93 pointsadulau35 comments

> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors

> GNU Radio [2] is a Free & Open-Source Toolkit for Software Radio

[1] https://en.wikipedia.org/wiki/Tempest_(codename) [2] https://gnuradio.org

> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors

I've always thought of TEMPEST as magic and incredibly cool. I get how this works for video, but why is it that infosec recommends for EM shielding of a datacenter? Wouldn't there be so much EM noise from a DC that the data you could pull off be .. noisy? lossy?

It's difficult, but it gets a lot easier if you can send requests in. If you can force some kind of deterministic (not salted) crypto calculation to happen with a particular piece of key material, over and over again, you can use the same correlation technique that works for extracting GPS signals from hundreds of dB below the noise floor.

People have also done this with analysis of the power consumption of crypto hardware. I believe this was used against Trezor devices.

> GPS signals from hundreds of dB below the noise floor

Nitpick: GPS is more like 20 dB below the noise floor

[1] https://sdrgps.blogspot.com/2016/02/find-signal-in-noise.htm...

But yeah, theoretically you can cook up as much process gain as you need, it just might take a while.

My old boss always said "There isn't 200 dB in the entire universe". Of course if you compare the diameter of the universe to a quark, it's 10,453 dBmeters, so I guess there is.

That's a pretty good rule of thumb until you get into some really weird stuff.

The link budget for bouncing radio signals off the moon (EME) is something like 260 dB. A while ago I had a chance to see the ground station at NASA Goldstone where they manage the radio links to Mars and the outer planets. There was a terminal open with ~single digit bits / second coming in from one of the Voyager probes. Having a 70 meter dish and a cryogenic receiver helps, but the link budget there has got to be truly staggering...

200dB is the one way freespace path loss to Geo orbit.

Back when I learned this I was shocked that satellite communications work at all.

I can only imagine how much loss you have trying to hear communications from the Voyager probes now.

318 dB for Voyager 1 at X-band.

> Back when I learned this I was shocked

Care to explain? I'm not following..

Every 3dB is roughly a halving of the power level. It's hard to wrap a human brain around the orders of magnitude difference, the numbers are so far outside of anything we can encounter in the human scale.

Still, I will try to make an analogy. Start with the smallest transistor we make today, (7nm) and scale it up by the equivalent of 200dB and it would be 258 million km across, or about the same as the diameter of the Earth's orbit around the sun.

what does that mean? can you dumb it down at all for a non-signals person?

My old boss worked on the Apollo mission comms, specifically the large dish antennas on the ship. It was just his way of joking about large numbers.

10 dB (deci-Bells) is an order of magnitude ratio; 10 dB = 10Log(10). For non ratios you tack on units, such as 30 dBHz = 10 Log(1 kHz). It just a way of expressing large values in engineering, and you can add the dB instead of multiplying in linear domain. You begin to think in dB after doing it for years.

The path losses stated in the replies are good examples when the rule is broken. The path loss is 22 dB + 20*Log(distance/wavelength). My universe/quark is just a joke of the most extreme ratio I can think of; I’m sure there are others larger.

The national debt ought to be in dB$.

>> TEMPEST [1] (or Van Eck Phreaking) is a technique to eavesdrop video monitors by receiving the electromagnetic signal emitted by the VGA/HDMI cable and connectors

IIRC, I think it originally used the analog signals generated by controlling the electron gun in a CRT.

Yes, but no.

https://www.cl.cam.ac.uk/~mgk25/pet2004-fpd.pdf

tl;dr The signal from a DVI cable can be detected but at much more reduced ranges. See also; RAGEMASTER (Snowden leak) a range extending implant for video cables.

TEMPEST was also the codename of the NSA project for leveraging emissions. And it has become code for machines modified to protect against such things. So a "tempest computer" (if you ever see one) is a computer hardened against emissions.

They're stupid expensive, those machines. A lot of places are finding that it's less expensive to maintain an EMSEC zone and run COTS equipment.

I've heard about them being used for an opposite reason. Rather than for security, they are used in places where you don't want to risk them interfering with other equipment, like a room with radar equipment that might be sensitive.

I always thought it was Transient ElectroMagnetic ProteEction STandard.

Wikipedia says: TEMPEST (Telecommunications Electronics Materials Protected from Emanating Spurious Transmissions)

This says it is "Telecommunications and Electrical Machinery Protected from Emanations Security"

https://www.patton.com/solution/Tempest-EMI-RFI-Data-Securit...

Why would it be protected from emanations security? Achieving emanations security is the goal of these protections!

Aren't all of these are probably backronyms for an originally randomly selected codeword?

Replying with a burner account: TEMPEST is and has always been a code name, not an acronym. I've been seeing forced acronyms to TEMPEST for decades, all of them wrong because there is no acronym.

It is an intelligence community convention to write codewords in ALL CAPS to differentiate them from the normal use of the same word. This doesn't indicate that they are acronyms. The appearance, though, combined with the fact that they are often in mixed use with acronyms, leads to a tendency for people to make up expansions of codewords which aren't intended to have one. Codewords were intentionally selected to have little if any relationship to what they describe.

To further muddy the waters, the military is just as fond of writing things in all caps as the intelligence community is, but they usually actually are acronyms or abbreviations. In contrast to TEMPEST consider PAVE PAWS, which is an acronym, and USSPACOM, which is abbreviation.

I'm reading Cryptonomicon of Neal Stephenson and I discovered this attack some days ago. It's mind blowing

Fun fact: TEMPEST is the reason that asterisks are substituted for passwords onscreen.

Not simply because people can look over your shoulder?

Light is a TEMPEST emission :) It too is EM.

But yeah, you're right. Shoulder surfers are very much why * are used.

Asterisks for passwords predate TEMPEST by many years.

That would be surprising, since Tempest dates from the early 1950's.

What's a common antenna setup for something like this? UHF Yagi?

Wide band antennas like this PCB Vivaldi slot are popular with the SDR crowd.

http://www.w6rz.net/IMG_0069.JPG

https://www.amazon.com/RFSPACE-Wideband-Antenna-600-6000-Viv...

Obligatory recommendation: https://en.m.wikipedia.org/wiki/Cryptonomicon

Agreed! Would recommend this book.

I would recommend it too. It's also one of few Neal Stephenson books in which the ending isn't completely missing or feels too phoned in (beware it IS somewhat unsatisfactory if you wanted more closure). The author unfortunately has a longstanding position where he "doesn't owe the reader a specific type of ending" and the real world doesn't provide textbooks ending either, if I remember correctly.

Such a shame because his books are on average excellent until the last 10-20%.

I do not! I liked the book, I find parts of it memorable, but I never recommend it as an introduction to Neal Stephenson. Unfortunately, Anathema is also a difficult book to recommend as an introduction.

> [The characters'] goal is to facilitate anonymous Internet banking using electronic money and (later) digital gold currency, with a long-term objective to distribute Holocaust Education and Avoidance Pod (HEAP) media for instructing genocide-target populations on defensive warfare.

The Holocaust education tidbit caught my eye, there was a Twitter post just a few days ago about using Filecoin to preserve genocide data https://twitter.com/dietrich/status/1258128262615773187

Does this work with HDCP?

Reply on news.ycombinator.com