Slashdot Mirror
Georgia Institute of Technology Researchers Bridge the Airgap
An anonymous reader writes Hacked has a piece about Georgia Institute of Technology researchers keylogging from a distance using the electromagnetic radiation of CPUs. They can reportedly do this from up to 6 meters away. In this video, using two Ubuntu laptops, they demonstrate that keystrokes are easily interpreted with the software they have developed. In their white paper they talk about the need for more research in this area so that hardware and software manufacturers will be able to develop more secure devices. For now, Faraday cages don't seem as crazy as they used to, or do they?
I was working at a defense contractor in the '80's when the whole "Tempest" program started.
Rather than shield equipment, we simply added a small amount of broadband noise.
The problem isn't to limit emission: The problem is to frustrate detection.
Missing from the summary: THEY HAVE SOFTWARE INSTALLED ON THE VICTIM LAPTOP that modules the CPU usage.
You don't need any fancy equipment, any AM radio will do.
security measures are security measures, whether the threat is real or perceived is irrelevant.
wireless keyboards are easier to read keys from
When I was with the government, we had to have specially shielded computers for classified material viewing (albit maybe not as good as they claimed). My office did not even possess the devices so we were only able to receive classified correspondence by secure phones or packages. This could be a problem like the rf id credit cards..you have to know what your doing to protect yourself. Maybe Apple Pay works the same way?
Faraday cages around what?
If you can get that near to a keyboard, you'd just use an electronic device recording the reflection of photons off the keyboard.
It's called a camera.
A typo in Faraday -- on a site supposedly from geeks for geeks. Tsk, tsk.
Little known fact about Farraday cages. Conductance depends on the frequency of the signal. Just putting your computer in say a metal case does not work. It is already in a metal case.
Somehow I don't think a secure location is going to be too worried about this type of attack unless someone can show it working with an extremely small receiver which is also able to log the data for later use. Also note that even at the slow rate she was typing it still missed characters.
So while academically interesting, this seems to be something of very limited concern. Of course, if you see an antenna like that in the coffeeshop you might want to leave.
Seems like there are some really easy ways to prevent some sort of EM signature from leaking.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
BTW FCC radiation limits prevent CPU from emitting too much radiation.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
As others have already noted, this is an old, old tactic. I'm a bit surprised that you can correlate enough of the broadband scream produced by a modern laptop to tease out keystrokes reliably, but not that suprised.
It's only "crazy" if you're spending disproportionate time, effort and money to conceal your boring, inconsequential data. And in these days of big-data sieves and ubiquitous surveillance, "boring" and "inconsequential" aren't what they used to be.
Firstly this is old news,
Secondly almost the first thing said in the video is that they had to install a driver on the target to force it to emit signals they could pull out of the noise. So its a nice idea that if you have access to put software on the PC you can later get it to emit information, but it you are going to do that then why not use what else is there because how often is all the targets other wireless interfaces fully disabled. I suspect unless your name is Snowden, not very often. Further, if you are that worried about leaking information that you go fully air gapped you would not be trusting a malleable OS to run from, much better to run from a live CD.
Back in the late 70's to mid 80's, this was a common enough technique that the US developed a secret system known as Tempest Shielding. In simple terms it was an active radio/electronic field around a sensitive device that was designed to block such electronic snooping. Georgia Tech has successfully recreated a technique used long before any of the researches existed.
Tempest goes back to WWII when they were actually studying an Enigma machine and discovered that it created a predictable curve in an oscilloscope that was across the room whenever a key was pressed.
these guys are so smart and they don't understand how videos should be recorded?! that drives me nuts
Resurfacing again and again. This has been done since at least the mid 1990s with EMR from the video display, keyboard, etc.
That's a good idea, particularly if you either raise the noise level high enough or ring the computers with a circle of such devices. Meeting Tempest standards is very costly. Adding noise isn't. It's a bit like the suggestion that microphone bugging can be defeating by playing talk radio or similar sounds in the same room. One voice drowns out another.
I've sometimes wondered what would have happened if the Germans had been clever enough to mix in with their usual Enigma traffic bogus messages made up of random letters that still fit the pattern of German words and sentences. German units with code books would have quickly noticed which messages meant nothing. But quite a bit of the daily labor at Bletchley would have been frustrated, particularly if the bogus messages went out early in the day.
But that, of course, requires the Germans to know that Enigma was being read and, if that were so, they'd have change their encryption instead.
There was a reason DoD was concerned about this sort of monitoring many decades ago. Electronics were shielded to prevent EM tradition form being used to deduce what was being done.
I'm a consultant - I convert gibberish into cash-flow.
There used to be an option in BIOS'es (may still be there, don't know) to enable spread spectrum clocking. This basically caused the system to slightly vary (spread out) various clocking signals in order to lower emissions at a particular frequency in order to pass FCC inspections.
This thing requires malware to be installed anyway, at that point it's trivial to do anything. You could send things through any port which many computers have webcam lights, backlights and status indicators that can be controlled quick enough for any human to notice.
Custom electronics and digital signage for your business: www.evcircuits.com
source code or it never happened...
Surprised no one posted about this error. In the video, he says "6 or 7 feet", not meters.
Computer cases used to be metal. And a grounded metal case makes for a good Faraday cage. As some have added, a small noise source doesn't hurt. I worked for a 3 letter agency (recently mentioned on /.) and they had some tempest enclosures on equipment, but mostly just tempest'ed the whole building (metal shielding even over outside windows). There are well known methods that could pick up the display of CRT's from a room away (high voltage sweeps were easily strong enough to pick up from the next hotel room), but LED and LCD displays don't run at 50,000 volts, they typically operate on 5 volts. The good news is that the front of the screen is no longer a dust magnet, the bad part, you can't tempest-hack the CRT. So the next best thing: either the controller chip in the keyboard, or the CPU.
Geez, 30 years ago we were given a demonstration of snooping on non-Tempest equipment, with a van parked outside of our offices, showing keystrokes and fuzzy images of our monitors.
When I went to work at the RASC at Camp Kinser, just north of Naha (The mainframes were all housed in a building on the south side of the base, closest to the piers), there was always one or two Soviet "Fishing" vessels docked, with all sorts of crazy antennas (directional ones pointed at Camp Kinser), satellite dishes and such.
This is really, really old news. I've heard of far more exotic wireless, remote listening stuff, from phreaking sources back in the day, but I'm not sure that stuff has even been declassified yet.
Years ago it was shown that electronic noise emitted by keyboards and mice could be easily retrieved with some cheap off the shelf hardware even from across a street. That is the reason why many government agencies are dusting off the mechanical typewriters.