EFI from cables is something every ham loves to hate. What if you modulated, that, though, using an ordinary cable as an antenna? If you used something ubiquitous like a video cable, you might have a very interesting exploit– which is exactly what [Xieyang Sun] and their colleagues have done with TEMPEST-LoRa, a technique to encode LoRa packets into video files.
The concept is pretty simple: a specially-constructed video file contains information to be broadcast via LoRa– the graphics card and the video cable serve as the Tx, and the Rx is any LoRa module. Either VGA or HDMI cables can be used, though the images to create the LoRa signal are obviously going to differ in each case. The only restriction is that the display resolution must be 1080×1920@60Hz, and the video has to play fullscreen. Fullscreen video might make this technique easy to spot if used in an exploit, but on the other hand, the display does not have to be turned on at the time of transmission. If employed by blackhats, one imagines syncing this to power management so the video plays whenever the screen blanks.
According to the pre-print, a maximum transmission distance of 81.7m was achieved, and at 21.6 kbps. That’s not blazing fast, sure, but transmission out of a totally air-gapped machine even at dialup speeds is impressive. Code is on the GitHub under an MIT license, though [Xieyang Sun] and the team are white hats, so they point out that it’s provided for academic use. There is a demo video, but as it is on bilbili we don’t have an easy way to embed it. The work has been accepted to the ACM Conference on Computer and Communications Security (2025), so if you’re at the event in Taiwan be sure to check it out.
We’ve seen similar hacks before, like this one that uses an ethernet cable as an antenna. Getting away from RF, others have used fan noise, or even the once-ubiquitous HDD light. (And here we thought casemakers were just cheaping out when they left those off– no, it’s security!)
Thanks to [Xieyang Sun] for the tip! We’ll be checking the tips line for word from you, just as soon as we finish wrapping ferrites around all our cables.
code: https://github.com/XieyangSun/TEMPEST-LoRa
Is that different from the first link in the post?
Here is the demo video on Youtobe: https://www.youtube.com/watch?v=HDbdAZd6cLw
“If employed by blackhats, one imagines syncing this to power management so the video plays whenever the screen blanks. ”
I’m curious how often that is viable these days. I don’t think it’s intended to be a security feature; but I’ve noticed an ongoing decline basically since CRTs(with the slope somewhat less dramatic on VGA-connected LCDs) in computer/monitor pairings that don’t immediately notice(normally to do some unhelpful rearranging of icons, crashing fullscreen programs, or moving remaining screens around) the second a monitor goes inactive.
Certainly nothing you couldn’t quietly slip an EDID dongle into the signal path to solve(since they sell those more or less because of all the systems that freak out every time a TV goes to sleep); but the newest setup where that wasn’t, at least, something you had to fight the system about has to be at least a decade old at this point.
Getting working LoRA is pretty neat, however.
Does the cable need to be physically connected? If no than you could just stick it to any spare HDMI port or to any headless setup.
There are places where people don’t switch off computers while leaving and places where switching monitor off when not using a PC is mandatory as a part of eco policy.
The cable is your antenna, so expect reduced signal power.
If I had an airgapped system I would put every cable in copper pipes.
It’s absurd how many various ways data can be stolen nowadays. If you told me 20 years ago that people would be pulling stuff off like they do now… I would have said you got a cool movie on your hands.
:( I guess you have to publish to traditional sources to be referenced in traditional sources. My LoLRa stuff got 1.5 miles off a GPIO.
Gotta Github link or other code repo?