If a couple of generations of spy movies have taught us anything, it’s that secret agents get the best toys. And although it may not be as cool as a radar-equipped Aston Martin or a wire-flying rig for impossible vault heists, this DIY TEMPEST system lets you snoop on computers using secondary RF emissions.
If the term TEMPEST sounds familiar, it’s because we’ve covered it before. [Elliot Williams] gave an introduction to the many modalities that fall under the TEMPEST umbrella, the US National Security Agency’s catch-all codename for bridging air gaps by monitoring the unintended RF, light, or even audio emissions of computers. And more recently, [Brian Benchoff] discussed a TEMPEST hack that avoided the need for thousands of dollars of RF gear, reducing the rig down to an SDR dongle and a simple antenna. There’s even an app for that now: TempestSDR, a multiplatform Java app that lets you screen scrape a monitor based on its RF signature. Trouble is, getting the app running on Windows machines has been a challenge, but RTL-SDR.com reader [flatfishfly] solved some of the major problems and kindly shared the magic. The video below shows TempestSDR results; it’s clear that high-contrast images at easiest to snoop on, but it shows that a $20 dongle and some open-source software can bridge an air gap. Makes you wonder what’s possible with deeper pockets.
RF sniffing is only one of many ways to exfiltrate data from an air-gapped system. From power cords to security cameras, there seems to be no end to the ways to breach systems.
Cool, but I would to say that the challenge is your computer which you are monitoring from have also an rf waves, how do you catch the all others rf but not yours, it can influence the results mostly when your target is not so far from you. I now also that it exists some covers which can stop the waves and make some perturbations on your results
A directional antenna would help a lot, for both ignoring the receiving computer and detecting the target.
Cool, I never had the need to use this method but I guess if with the advenced kind of walls and the advenced in the domain of civil engineering, still work or the hacker need to be indoor the building
Ez, a directional antenna just like the Russians used.
Well. There’s a reason for that super annoying use of light grey text on a white background that’s been growing like a cancer on the web and in software since Windows Vista inspired so many ignorant designers to think low contrast colors are “cool” instead of stupid.
Set your theme to all low contrast colors and not only is it very difficult for anyone over 40 (or anyone with any sort of color vision issues) to read, it’s impossible for cheap TEMPEST hacking to display.
A printed page of text has a contrast ratio typically less than 50:1
Even with 80% grey on 100% white, your monitor is actually displaying a greater contrast ratio between the background and the text. How come then it looks so different? Because it’s so much brighter than the reflected light off of paper. If you increase the ambient light, or decrease backlight brightness^ it starts to look alike. It’s only in contrast to the dark surroundings that the monitor appears washed out. Try holding a sheet of paper up to the monitor at some distance and see how much dimmer it is. That’s why in the stores they always put bright halogen lights around the cheap TVs to make their picture look better – and when you take one home and turn down the lights to watch a film… it’s a washed out mess.
So the moral of the story: put proper lighting in your room/office and grey-on-white text on screen becomes perfectly legible. It also improves your vision and reduces eye strain. People typically have something like 50-100 lux lighting in their homes, especially nowadays with energy saving bulbs which don’t actually deliver the same amount of light as the incandecent bulbs they claim to replace. The recommendation for office and working spaces is 300-500 lux, so you can probably triple whatever lights you have.
^(The brightness/contrast setting on a monitor actually changes contrast, as they don’t usually dim the backlight to keep the color temperature constant, they just shift the light and dark points of the LCD drive)
First:
Paper can have a higher contrast ratio… use laser/toner printers instead of inkjet… Oh maybe use genuine inks in the inkjet and don’t use economy/draft setting?
That’ll improve things a lot.
LCDs… the more modern LCD displays have a nice contrast ratio… Especially in phones where I’ve mistaken an LCD for an AMOLED…. unless pitch black in the room.
The backlight is PWM modulated (LED) or voltage-offset (CCFL) where the LED ones keep their color temperature over most of their dimming, but they flicker when the PWM is too low.
There are backlight systems that at 80% brightness setting in the OSD-setup the backlight is actually at maximum brightness and the “aperture” of the pixels are adjusted so they’re more sensitive when they reach 255-brightness per sub-pixel.
There are some displays that no matter the settings: Full black and you can still see straight through the glass albeit not very well, especially if viewing angles are bad… which mostly is down to how the backlight distribution filters work… pull a bad viewing angle LCD apart, power the lights and try to get even light at an angle… If that is good then they cheaped out on the LCD and not the lighting.
Source:
Fixed too many monitors!
Still says no when someone asks me to fix their out-dated CRT monitor/TV.
>”Paper can have a higher contrast ratio”
Yes, good dark ink on glossy paper can have up to 200:1 but regular copier paper won’t do that, even with a laser printer. Cheap inkjets do something like 15:1
” energy saving bulbs which don’t actually deliver the same amount of light as the incandecent bulbs”
WTF are you talking about, incandescent is mostly IR and energy saving bulbs put out plenty of light, and a hell of a lot more per watt than the old heatbulbs.
What, you can’t see IR light?
I’m saving the world by burning incandecent bulbs, as the electricity for this place comes from hydroelectricity, while the heat comes through pipes in the ground from a nearby thermal plant. By using less efficient lighting, I’m producing less CO2 and other air pollution.
That’s the irony, because peope heat their homes with gas, heating oil, even coal in some places. As the electric grid greens up with wind power and whatnot, they should be switching to electric heat, and so the energy saving lightbulbs are actually counterproductive.
From a grid perspective, that doesn’t necessarily make a lot of sense, and is a fairly dangerous argument. If you didn’t use as much electricity, that efficient hydroelectric power would simply go somewhere else. Any additional power you use on top of your average, especially lighting during peak hours, adds to the total national peak electric load, and is almost exclusively provided by natural gas…
Put another way, if you weren’t using the say 45 extra watts for a 60W incandescent, there would be 45 watts fewer watts of CO2 burned. This is because the only plant that is capable of ramping down quickly enough in most regions is going to be natural gas plant. I would double check, but I believe hydroelectric can ramp down quite quickly as well, but since everyone wants to maximized environmentally friendly power sources, I would imagine it’s frequently maxed out already.
With that said, it’s possible that natural gas plant would be still more efficient than burning petrocarbons at your house, so it’s still not an unreasonable argument.
Your argument obviously depends on region. In hot climates, like where I live, I’m glad I have an LED, because the cost and environmental savings on air conditioning is substantial.
I agree with your sense of how much lighting you need to keep a room sufficiently bright, and the BS’d lumen outputs on most energy efficient lighting; as such, I usually recommend taking that into account and adding more bulbs, or really just using luminaires specially designed for LEDs. Having attempted to design a standard A-socket LED bulb before, you quickly realize that LED technology has a vastly different thermal requirements compared to light bulbs (virtually no radiant heating from the die, almost all conducted). I would say this is largely the reason why most LED bulbs end up being underrated – somewhere below 60W equivalent lumens was the sweet spot for simple LED thermal design. You rarely find higher power LEDs in an A-socket layout. Lower light densities in practice tend to translate to higher efficiencies as well.
I was never a fan of CFLs, which tended to also have grossly overrated lifetimes, which ultimately made the very readily cost more than incandescent bulbs; with LEDs, the failure rate and mode doesn’t seem nearly as bad, and so far it looks like I’ll be able to not have to replace them for a decade.
Also, I just realized this comment is on an article about TEMPEST, not lighting…
I’m talking about the fact that energy saving bulbs have exaggerated lumen values, and the incandecent bulbs they compare them to, like “60 Watt equivalent” is equally downplayed by assuming a worse luminous efficacy. (hint: incandecent bulb luminous efficacy goes up with wattage 14 – 25 lm/W)
So you get packaging that claims some 6-7 Watt LED is equivalent to a 60 Watt lightbulb. Well, the LED is going to put out maybe 500-600 lm after it’s warmed up some and aged a little, and dropping, while the incandecent bulb will put out anywhere from 800-900 lm till the filament burns. 1200 lm if it’s a halogen bulb.
So people end up with -30% -50% light in their homes by swapping out the bulbs.
I just checked my cupboard for my stash of lightbulbs that are no longer allowed to be sold. There’s a bunch of 77 Watt ones producing 1350 lm for 17 lm/W and I’ve unfortunately ran out of the 105 Watt ones so I can’t check out what they were rated for. In any case, the difference is remarkable when you screw in one of these bulbs vs. some pissy CFL or LED.
If you’re using Firefox, the “Stylish” extension may solve that problem for you; once installed you can find user contributed styles for the current site, or create your own. There are already some contributions for rtl-sdr.com, and of course HAD too.
To be fair adventurous makey geeks pretty clearly get the best toys, we are our own Q division; spies have to act all vanilla and carry deniable stuff.
As an example of cool stuff I present all of the pocket sized HAD projects the one in including TFA, rick one together on a Pi-0 and see what you end up recording.
I want to see a spy movie where Q like people have to collect secret parts and build gadgets in secret for 007.
you guys got it all wrong. this is the very reason i flood all my offices with FCC illegal RF garbage on nearly every frequency. Try and see my trees through that forest of junk :P
BTW cool job on this hack.
I wish there was a quick list of deps for compiling on Ubuntu.
This is cool enough to do some cut pasting to compile but not enough to throw an hour at without knowing it will work.
Like dump1090 and other cool but compile-it-yourself projcts I have gotten it working and then moved to a new machine where I have to get it working again.
Hunting deps and compiling everything new and cool is for the 1990s, though to be fair by my calendar it is only Mon the 8854th of September in 1993, so who am I to judge.
the recovered image is too blurry to get any useful data ok you can see a checkerboard and some box on screen but you cant read it.
I wonder what display he’s using and how it is connected:
Displayport or eDP (embedded displayport):
then he is looking in the 200 to 300Mhz ranges or above and that is assuming a single video path (Single uni-directional lane mode), though in single-lane Displayport mode I’d thought the picture would be sharp and clear on his RF capture.
LVDS:
He has the following signals over separate pairs:
Pair #1… Red0-7+green0-3,
pair #2… Green 4-7+blue0-3,
Pair #3… Blue4-7+Vsync+hsync+CS/enable
Pair #4… serial synchronization clock
Also there maybe DDC/EDID EEPROM in some machines.
DVI / HDMI / TMDS / Displayport++(DVI emulation mode):
Same as LVDS however guaranteed to have EDID and with some extra stuff including data-mirroring modes chucked in for better cable length without distortion… Hence Transition Minimized Differential Signalling.
VGA:
Has separate coax cables within the main VGA cable for RED, GREEN and BLUE channels, also some have COAX/shielded wires for Hsync and Vsync and there is the EDID cables… sometimes more cables.
Only Displayport would be easiest to fully reconstruct… assuming leakage of the data transfers. The rest, having to capture what is closest to the most suspicious thing the target is looking at and then further filtering out all the channels by averaging and differencing the data for each color.
so the GUI runs on linux, but there is no plugin for RTLSDR or HackRF so no go ;(
the only supported front-end for linux seems to be UHD, so only USRP..
oops, i meant SDRPlay instead of HackRF, don’t have one of those sadly..
it also opens recordings, but is it very unclear on what format it wants, from the plugin src it doesn’t seem to want IQ recordings .. i tried recording some signals in the 350-400 MHz range that clearly came from my (dell dvi) monitor, but the software can’t make any sense of it. Possibly because i threw unsigned 8bit IQ samples at it .. It wouldn’t be too difficult to code a plugin using osmocom’s library, i might take a stab at it later if no one else has by then..
That’s pretty scary! Have there been any developments with this tech?!
Is there a way of stopping your devices being hacked using this method and what methods are available in catching hackers using this method