[117040] in Cypherpunks
Eavesdropping Vulnerabilites & the Law
daemon@ATHENA.MIT.EDU (Vin McLellan)
Wed Aug 25 16:41:12 1999
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Law & Policy of Computer Communications <CYBERIA-L@listserv.aol.com>,
CYBERIA-L@listserv.aol.com
From: Vin McLellan <vin@shore.net>
Cc: cypherpunks@algebra.com
Message-Id: <E11JjYe-0007Qi-00@polaris.shore.net>
Date: Wed, 25 Aug 1999 16:22:09 -0400
Reply-To: Vin McLellan <vin@shore.net>
Dwight Hines <Hunger99@AOL.COM> wrote:
>> What are the different ways that a laptop and desktop can be
>> compromised? I am not concerned about what is called
>>"Tempest" techniques.
Berke Durak's new paper -- "Hidden Data Transmission by Controlling
Electromagnetic Emanations of Computers," at
<http://altern.org/berke/tempest/#jbsscc> -- and Markus Kuhn and Ross
Anderson's 1998 paper -- "Soft Tempest: Hidden Data Transmissions Using
Electromagnetic Emanations," at
<http://www.cl.cam.ac.uk/~mgk25/ih98-tempest.pdf> -- should both give you
pause.
Tempest tech has been a humongous boondogle -- a black hole into
which billions were sunk for RF shielded rooms and DoD/NATO Tempest-grade
crt and cpu shielding -- but the fact that the secret "formula" for
effective Tempest defense shielding was used to mint money for multiple
defense contractors is not a valid reason for dismissing the very real
vulnerabilities and risk of loss or theft of data through RF emanations.
(Pause and enjoy the fact that the software hacks that Marcus and
Ross came up with are probably equivalent in effectiveness to whole classes
of defensive Tempest shielding that the NATO allies spent _billions on.
Open market tech really does rule -- especially when compared to the stunted
constipated norm in classified environments.)
Wes Morgan <Wes_Morgan@DATABEAM.COM> responded:
>> Why not? Those may present a more interesting legal question. It
>> is possible to capture the EM radiation from a screen/CRT from some
>> distance (even outside a building) and reconstruct/record what is
>> displayed in realtime. Now, I believe that the necessary equipment
>> is rather expensive today, but we all know that most technology
>> approaches commodity pricing within a few years. When LE are able
>> to sit outside my house and "snag my screen," will/should they need
>> a warrant to do so? After all, I'm just broadcasting that stuff
>> into the air...
I agree. It is a fascinating legal question.
I always wondered if avoiding that question was one reason that both
the offensive and defensive aspects of RF emanation eavesdropping were
subjected to such strict and inane secrecy requirements.
(Others would argue that the logic was more traditional. As with
crypto-less cellular phones and radio phones, the military and intelligence
agencies are more than willing to freely sacrifice the privacy and
confidentiality of their own unprivileged citizens, in order to maintain
their offensive infowar and eavesdropping capabilities.)
The hardware cost of a simple Van Eck device to remotely capture CRT
emanations is zilch, maybe $100 at Radio Shack. (The operational problem,
as I understand it, is in merely sorting out a single target CRT in a
RF-rich environment.) Durak makes some startling claims about the potential
for remotely eavesdropping -- certainly from, say, an adjoining apartment, a
few meters away; sometimes from _kilometers_ away -- on the target's CPU's
bus and other hardware components.
Both the Kuhn/Anderson paper and the Durak paper make clear what
anyone who has tracked the Tempest issue knows, with the insertion of a
piece of attack code into a targeted system, it is much easier to identify
and record remotely either screen images (from the crt) or other data
flowing thru internal CPU components (e.g., keyboard hits).
(The only "Tempest attack" I ever heard of was in Europe in the
1980s, where a phony IBM repairman was let into a secure facility and
managed to add something physically to a target CRT which allowed a remote
listener to easily distinguish the emanations from that CRT from many others
in the same location.)
Anderson and Kuhn focus on the CRT emanations -- the classical
Tempest attack -- and defenses against it (now incorporated into PGP!), but
Durak's work makes it clear that the CRT is not the only part of the system
that could be modified through software to extend and enhance the
transmission of data, even pre-selected data.
Back in '85, Van Eck, a Dutch PTT researcher, shook up the user
community with a purposely incomplete description of a modulator which could
pick up CRT emanations at some distance. (A British TV network had
recreated his device and, on national TV, did some eavesdropping from a van
outside an office building on national TV.) I did a couple articles on Van
Eck and others who were playing with this technology, despite the overt
hostility of the national defense establishment.
At one Wall Street brokerage, the IT manager tossed a summer intern
a the task of creating a so-called "Van Eck" device to validate the threat.
She was quite successful, at a total expendature of less than $150, he told me.
I also heard, several times in the late 1980s, that the FBI had a
four-man team wandering the nation with a version of the Van Eck device,
working on intelligence assignments. Never got decent confirmation on that,
but a prominent NY-based infosec maven swore that he knew it was true.
Robert A. Jacoby <jacoby@LAW.LAW.SC.EDU> suggested:
>Isn't that another argument in favor of laptops, though? Since they
>have LCD panels they aren't broadcasting any EM radiation. Of course
>now LCDs are becoming popular for desktops too. Hmmm, ban the use of
>LCDs, or require an EM chip (a la the V-chip) that will do
>the broadcasting. . .
Again, check out the Durak paper. CRTs are not the only source of
RF emanations from your computer. And if savvy bad guys (with or without
badges) are able to get physically to your machine to insert something
(hardware or software), they can probably listen and record to their
heart's content.
The aspect of digital eavesdropping that I find repeatedly
overlooked in the public policy discussions is the relative economics of
telephonic eavesdropping versus eavesdropping on digital data flows (mail,
etc.)
The average federal telephone wiretap costs probably $50k to $100K,
mostly in LEA manpower listening on the phone (much more if there is ongoing
translations necessary.) If voice-transcription is coming, it ain't in use
on the front lines yet.
I figure that the Justice Department could have set up a computer
with a wiretap on Microsoft's Redmond office buildings and probably sorted
and captured all e-mail and file-transfers to and from the whole executive
class of Microsoft for, what? an amortized cost of maybe $20.
Thought-provoking, what? Think of it the next time Mr. Freeh or
General Reno declares that their demand for the privilege to tap and
decipher digital traffic is simply an attempt to maintain the status quo.
The capability to eavesdrop on digital data flow has the same
relationship to telephone wiretapping that a computer with a fast disk drive
has to a warehouse of paper in filing cabinets.
Suerte,
_Vin
--------
"Cryptography is like literacy in the Dark Ages. Infinitely potent, for
good and ill... yet basically an intellectual construct, an idea, which by
its nature will resist efforts to restrict it to bureaucrats and others who
deem only themselves worthy of such Privilege." _A Thinking Man's Creed
for Crypto _vbm
* Vin McLellan + The Privacy Guild + <vin@shore.net> *
