Slashdot Mirror
Monitoring Your Monitor
bje2 writes "Rememeber this story from a couple months ago about reconstructing data from the blinking LEDs of modems...well, CNet is running a story about reconstructing the display of a computer by using special hardware and the reflected glow of the monitor." Kuhn's paper (400k PDF) is available.
Same article appeared on /. back in March, dinnit?
The real danger here, I think, isn't some kind of "national security" or "bank fraud" or anything like that -- security schmecurity. The real danger, is Quake cheating!
Think about it. If I can reconstruct what is on your monitor, I can tell where you are. Are you down the tunnel? In the water? Are you on top of that goddamnfucking sniper tower? I could reconstruct your screen and determine exactly where you are in the Quake map.
Quick, someone, solve this problem before it tears society apart!!
-- Ken Kinder ken@_nospam_kenkinder.com http://kenkinder.com/
Now I can begin selling my high-tech, computer privacy protection devices.
I will call them curtains.
"Until that's resolved, the safest solution is to compute with the lights on. "
Or just close the window shades.
It seems like you can read the contents of a monitor under optimal conditions, but how often do you get optimal conditions? More often that not, a person sits in front of a monitor as he or she works. At best, then, you'd only be able to get bits and pieces of what's on the screen. You also have to contend with different grades of wall paint and/or wallpaper (not to mention furniture behind you) which might make this endeavor fruitless in most cases.
It's a nice trick in a lab, and probably worth publishing. But I think there are too many uncontrollable variables to make this practical.
Now I can justify the 21 LCD at work on the grounds that the CRT poses a risk of industrial espionage.
Nope, no sig
Now you can reconstruct Slashdot from the reflected glow of old stories!
First of all, they're not electrons, they're photons, the quantegy of light. Your CRT has an electron gun that directs a narrow beam of electrons onto a phosphorus coated glass (the 'screen'). The phosphorus then glows, and radiates photons.
While LCD panels don't have an electron beam to radiate phosphorus, they still radiate photons. Otherwise you wouldn't be able to see them.
Basically, if your monitor is radiating photons (read: turned on) someone can intercept those photons and reconstruct an image, given the right equipment and circumstances.
I suppose given the right equipment and circumstances, they can read your mind as well, so we're screwed anyway.
"A terrorist is someone who has a bomb but doesn't have an air force." -William Blum
Imagine a van driving slowly down the streets of a neighborhood every 10 minutes, monitoring the blue TV glow coming out of windows.
Not reconstructing the actual image - just watching the gross flicker patterns, and matching them against all TV stations in real time.
If it finds someone that's not on a known TV station, it pauses for a minute and logs a longer sequence of flickers to match against the flicker patterns of a large library of videos.
Talk about precise marketing info!
Talk about potential blackmail material - ("Did you enjoy your viewing of 'Under-age Girls' last night Mr. Politician? Doing a bit of research, were you?" What about the previous 15 nights?")
Maybe we need to extend "peeping tom" laws to cover any deliberate use of EM radiation coming out of our homes...
Basically, if your monitor is radiating photons (read: turned on) someone can intercept those photons and reconstruct an image, given the right equipment and circumstances.
If by "right equipment and circumstances" you mean direct vision or a mirror-like reflection, then that's true. However, this article is about a technique for reconstructing CRT images when the monitor is facing away from the window and the only reflections are off of rough surfaces, which thoroughly scramble the pixels. You cannot directly determine what part of the screen a photon came from, but you can determine when it was emitted. Since the CRT scans one dot at a time, that creates the possibility of turning a recording of brightness & color vs time back into a picture.
However, most flat-panel displays will set a number of pixels at the same time (for example, writing to an entire row at a time). This makes it impossible to separate out one pixel or even one small area of the screen by the time when the light arrives. Also, LCD's don't create light, it is created by the backlights, generally flourescent lights running on high voltage, high frequency AC -- so the only thing time analysis gets you is the high frequency flicker of the backlights. The liquid crystals retain most of their "set" between scans through the display, so the light passed through a pixel doesn't vary much depending on how long it's been since the pixel was scanned.
OTOH, unless your video cable and electronics is all shielded very well, you are probably transmitting radio waves that could be turned back into the picture. This might be even more difficult than reconstructing a CRT image from the visible light, but certain three-letter government agencies can do it when they really want to. One limitation to the radio ("Tempest) method is that you've got to be able to isolate the target computer's signal from all the others; with optical methods this probably requires just pointing the scope in the right direction (if you are lucky enough to get a strong enough reflection in any direction), but radio waves bend around corners, reflect, and merge more so it's pretty unlikely that Tempest could find the one computer bringing up atomic bomb diagrams in a college dorm (say) among the hundreds downloading MP3's, playing Quake, or whatever.
I'm not any sort of expert in this, however from what I know of video the process has to be something like this:
The phosphors in the CRT do not emit only when hit by the electron beam. They have a certain persistence, so a dot keeps on glowing while the beam moves on through other dots. If you get a perfect recording of the signal, then reconstructing the picture requires merely syncing onto the video scan by means of the long and short black intervals (vertical and horizontal retrace), calculating each pixel's actual output by subtracting the fading output of previous pixels, and feeding the resulting video and sync into your own monitor.
However in using this in a normal "spying" situation, you get room lights and other "noise" in the signal. You've got to guess at the average ambient level and compensate (subtract it out) so the picture isn't washed out. Then, you are probably working with such a low level of signal per pixel that quantum fluctuations add significant noise. Subtracting signals accentuates the noise, so you'll wind up with a pretty grainy picture -- after lots of trial and error adjustments to find the best background level compensation, pixel fade rate, etc. But most data on computers is presented in quite high contrast, and stays on the screen for quite a while, so you can improve the picture by averaging frames. So it does sound possible to get a good enough picture for most espionage purposes (extracting text and diagrams, or sometimes just finding out what the guy is reading).
What it probably won't do unless you get really close:
-Spy on your Quake rivals; (I assume, not being a
Quake player myself) the picture changes too fast for frame-averaging to help much, and in general it's a detailed, lower contrast picture so graininess would have a greater impact.
-Pirate the Playboy channel from your rich neighbor, unless you are so hard up that just staring at a screen of approximately fleshtoned grains and imagining there's a nekkid woman somewhere in there is enough...
-Steal passwords protected by the "*" character, unless the login was incompetently programmed and it shows the actual character for a frame before covering it up. And probably not even then, because frame-averaging will often be needed for legibility...
Just handwaving here, but I expect that if someone can get a camera where this process works for any of the above, they probably could have focused it right on the screen and also physically wire-tapped the machine.