GPU Turned Into Radio Transmitter To Defeat Air-Gapped PC

Another week, another exploit against an air-gapped computer. And this time, the attack is particularly clever and pernicious: turning a GPU into a radio transmitter.

The first part of [Mikhail Davidov] and [Baron Oldenburg]’s article is a review of some of the basics of exploring the RF emissions of computers using software-defined radio (SDR) dongles. Most readers can safely skip ahead a bit to section 9, which gets into the process they used to sniff for potentially compromising RF leaks from an air-gapped test computer. After finding a few weak signals in the gigahertz range and dismissing them as attack vectors due to their limited penetration potential, they settled in on the GPU card, a Radeon Pro WX3100, and specifically on the power management features of its ATI chipset.

With a GPU benchmarking program running, they switched the graphics card shader clock between its two lowest power settings, which produced a strong signal on the SDR waterfall at 428 MHz. They were able to receive this signal up to 50 feet (15 meters) away, perhaps to the annoyance of nearby hams as this is plunk in the middle of the 70-cm band. This is theoretically enough to exfiltrate data, but at a painfully low bitrate. So they improved the exploit by forcing the CPU driver to vary the shader clock frequency in one megahertz steps, allowing them to implement higher throughput encoding schemes. You can hear the change in signal caused by different graphics being displayed in the video below; one doesn’t need much imagination to see how malware could leverage this to exfiltrate pretty much anything on the computer.

It’s a fascinating hack, and hats off to [Davidov] and [Oldenburg] for revealing this weakness. We’ll have to throw this on the pile with all the other side-channel attacks [Samy Kamkar] covered in his 2019 Supercon talk.

Continue reading “GPU Turned Into Radio Transmitter To Defeat Air-Gapped PC”

Hams Gone Wild: Amateur Radio Field Day 2019

Of all the images that amateur radio conjures up, the great outdoors doesn’t usually figure heavily. People seem to think hams sit in a dark room at a desk heavy with radio gear, banging out Morse code into late into the night and heedless of the world outside the window. All of which sort of sounds like hard-core gaming, really.

And while that image certainly applies in a lot of cases, hams do like to get out and about at least once a year. That day is upon us with the 2019 Amateur Radio Field Day. Hams across North America reserve the fourth full weekend of each June to tear themselves out of their shacks and get into the world to set up operations in some kind of public venue, generally a park or other green space. Part cookout, part community outreach, and part slumber party – it lasts all weekend and goes around the clock – hams use field day as a chance to show the general public where amateur radio really shines: real-time worldwide communications under austere conditions.

It’s also a chance to get folks excited about getting their license, with many Field Day locations hosting “Get on the Air” stations so that unlicensed folks can try making a contact under the supervision of a licensed operator. Licensed but underequipped hams also get the chance to spin the knobs on someone else’s gear, and maybe line up that first rig purchase. And there are plenty of opportunities to learn about new modes as well, such as FT8 and WSPR. As an example your scribe is looking for some guidance on getting started with APRS, the automated packet reporting system that’s used for things like high-altitude balloon tracking.

If you have any interest at all in learning how to properly operate radio equipment, you owe it to yourself to track down the nearest Field Day location and stop by. The American Radio Relay League (ARRL) has a ton of Field Day information, from a map to locate the 1500 Field Day sites to rules for the contests that will be run that weekend to guides for setting up and operating an effective Field Day setup. There will be 40,000 hams out there this year, and they’d all be thrilled if you drop by and ask a few questions.

Continue reading “Hams Gone Wild: Amateur Radio Field Day 2019”

The $50 Ham: Entry-Level Transceivers For Technicians

Last week , I covered the ridiculously low barriers to entry to amateur radio, both in terms of financial outlay and the process of studying for and passing the FCC examination. You’ve had seven days, so I assume that you’ve taken the plunge and are a freshly minted amateur radio operator. The next big question may be: Now what?

We briefly mentioned the image that ham radio is a rich old person’s hobby, and that reputation is somewhat deserved. For ham gear, there really is no upper limit on what you can spend. Glossy brochures and slick web pages hawk transceiver bristling with knobs and switches and loaded with the latest features, all of which will probably be obsolete within a few years when the Next Big Thing comes along and manufacturers respond with new, must-have models – looking at you, ICOM IC-7300. It’s no different than any other technology market, and enough people fall for that marketing to make it a going concern.

But thankfully, while there is no apparent ceiling on what you can spend on ham gear, there certainly is a floor, and it can be very, very low. Our $50 budget can go quite a long way to getting a new Technician on the air, if you’re willing to make some compromises and can forego the latest and greatest for a while.

Continue reading “The $50 Ham: Entry-Level Transceivers For Technicians”

Long-Range RFID With Feedback

Not long ago, we published an article about researchers adding sensor data to passive RFID tags, and a comment from a reader turned our heads to a consumer/maker version which anyone can start using right away (PDF). If you’re catching up, passive RFID technology is behind the key fobs and stickers which don’t need power, just proximity to the reader’s antenna. This is a much “hackier” version that works with discrete signals instead of analog ones. It will not however require writing a new library and programming new tags from the ground up just for the user to get started, so there is that trade-off. Sparkfun offers a UHF reader which can simultaneously monitor 25 of the UHF tags shown in this paper.

To construct one of these enhanced tags, the antenna trace is broken and then routed through a switching device such as a glass-break sensor, temperature limit switch, doorbell, or light sensor. Whenever continuity is restored the tag will happily send back its pre-programmed data, and the reader will acknowledge that somewhere one of the tags is seeing some activity. Nothing says this could not be applied to inexpensive RFID readers should you just want a temperature warning for your gecko terrarium or light sensor to your greenhouse‘s sealed controller.

Thank you, [Mike Massen], for your tip on RFID Doing More Than ID.

Continue reading “Long-Range RFID With Feedback”

Retrotechtacular: Information From The Days When Colour TV Was New

By the time colour TV came to the United Kingdom, it was old news to Americans. Most of the viewing public on the Western side of the Atlantic had had the opportunity to see more than black-and-white images for years when in 1967 the BBC started transmitting its first colour channel, BBC2.

For Americans and continental Europeans, the arrival of colour TV had been an incremental process, in which the colour subcarrier had been added to their existing transmission standard. Marketed as “compatible color” to Americans, this ensured that their existing black-and-white TV sets had no need for replacement as the new transmissions started.

The United Kingdom by contrast had been one of the first countries in the world to adopt a television standard in the 1930s, so its VHF 405-line positive-modulation black-and-white services stood alone and looked extremely dated three decades later. The BBC had performed experiments using modified round-CRT American sets to test the feasibility of inserting an NTSC colour subcarrier into a 405-line signal, but had eventually admitted defeat and opted for the Continental 625-line system with the German PAL colour encoding. This delivered colour TV at visibly better quality than the American NTSC system, but at the expense of a 15-year process of switching off all 405-line transmitters, replacing all 405-line sets, and installing new antennas for all viewers for the new UHF transmissions.

Such a significant upgrade must have placed a burden upon the TV repair and maintenance trade, because as part of the roll-out of the new standard the BBC produced and transmitted a series of short instructional animated films about the unfamiliar technology, which we’ve placed below the break. The engineer is taken through the signal problems affecting UHF transmissions, during which we’re reminded just how narrow bandwidth those early UHF Yagis must have been, then we are introduced to the shadowmask tube and all its faults. The dreaded convergence is introduced, as these were the days before precision pre-aligned CRTs, and we briefly see an early version of the iconic Test Card F. Finally we are shown the basic procedure for achieving the correct white balance. There is a passing reference to dual-standard sets, as if convergence for colour transmissions wasn’t enough of a nightmare a lot of the early colour sets incorporated a bank of switches on their PCB to select 405-line or 625-line modes. The hapless engineer would have to set up the convergence for both signals, something that must have tried their patience.

The final sequence looks at the hand-over of the new set to the customer. In an era in which we are used to consumer electronics with fantastic reliability we would not be happy at all with a PAL set from 1967. They were as new to the manufacturers as they were to the consumers, so the first generation of appliances could hardly have been described as reliable. The smiling woman in the animated film would certainly have needed to call the engineer again more than once to fix her new status symbol.

Continue reading “Retrotechtacular: Information From The Days When Colour TV Was New”

Fine Business, Good Buddy: Amateur Radio For Truckers

Summer is the season for family road trips here in the US, and my family took to the open road in a big way this year. We pulled off a cross-country relocation, from Connecticut to Idaho. Five days on the road means a lot of pit stops, and we got to see a lot of truck stops and consequently, a lot of long-haul truckers. I got to thinking about their unique lifestyle and tried to imagine myself doing that job. I wondered what I’d do hour after long hour, alone in the cab of my truck. I figured that I’d probably just end up listening to a lot of audio books, but then I realized that there’s a perfect hobby for the road — ham radio. So I decided to see how ham radio is used by truckers, and mull over how a truck driver version of me might practice The World’s Best Hobby.

Continue reading “Fine Business, Good Buddy: Amateur Radio For Truckers”