[117078] in Cypherpunks
Re: Eavesdropping Vulnerabilites & the Law
daemon@ATHENA.MIT.EDU (Dave Emery)
Thu Aug 26 01:46:28 1999
Date: Thu, 26 Aug 1999 01:26:10 -0400
From: Dave Emery <die@die.com>
To: Vin McLellan <vin@shore.net>
Cc: cypherpunks@toad.com
Message-ID: <19990826012609.G5055@die.com>
Mail-Followup-To: Vin McLellan <vin@shore.net>, cypherpunks@toad.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
In-Reply-To: <E11JjYe-0007Qi-00@polaris.shore.net>; from Vin McLellan on Wed, Aug 25, 1999 at 04:22:09PM -0400
Reply-To: Dave Emery <die@die.com>
On Wed, Aug 25, 1999 at 04:22:09PM -0400, Vin McLellan wrote:
> Dwight Hines <Hunger99@AOL.COM> wrote:
>
> >> What are the different ways that a laptop and desktop can be
> >> compromised? I am not concerned about what is called
> >>"Tempest" techniques.
>
>
> (The only "Tempest attack" I ever heard of was in Europe in the
> 1980s, where a phony IBM repairman was let into a secure facility and
> managed to add something physically to a target CRT which allowed a remote
> listener to easily distinguish the emanations from that CRT from many others
> in the same location.)
I know from people in the business that TEMPEST technology was
discovered and used in the 1950s. The CRT radiation issue was a
latecomer, the first actual use of TEMPEST was detecting the spark gap
transmitter formed by the high power electromagnets and mechanical
switches in old fashioned teletype machines. This turned out to be a
dandy way around crypto gear (the mechanical kind) as the spark gap
transmitter signals from the machine sending a paper tape or receiving
messages got into the audio, radio or DC telegraph circuits carrying the
ciphertext as detectable impulses (noise). Thus no decryption was
needed... and this was in the mid to early 50s. This apparently was
discovered accidently in a real intercept situation when the "noise"
impulses on the line got noticed and someone thought to try to build a
decoder for them.
>
> Anderson and Kuhn focus on the CRT emanations -- the classical
> Tempest attack -- and defenses against it (now incorporated into PGP!), but
> Durak's work makes it clear that the CRT is not the only part of the system
> that could be modified through software to extend and enhance the
> transmission of data, even pre-selected data.
>
I worked on redesigning a third party memory board for Sun
computers in the late 80s that used (for somewhat obscure reasons having
to do with emulating Sun ECC behavior) a primative fast microprocessor
(Signetics 8X200) to handle ECC exceptions. This processor did nothing
except on rare errors, and I seriously considered making it transmit
the contents of memory as an FSK signal by varying loop lengths in its
idle loop. This produced quite detectable radiation at the loop
frequency... I quickly decided to give up my hack when I learned to my
horror that a major customer for the boards was the CIA...
>
> I also heard, several times in the late 1980s, that the FBI had a
> four-man team wandering the nation with a version of the Van Eck device,
> working on intelligence assignments. Never got decent confirmation on that,
> but a prominent NY-based infosec maven swore that he knew it was true.
>
I have seen Van Eck devices in electronic surplus material sold
by the intelligence community. So they exist and someone spent money
to buy them years ago. Some date from the 70's based on parts dates...
> Robert A. Jacoby <jacoby@LAW.LAW.SC.EDU> suggested:
>
> >Isn't that another argument in favor of laptops, though? Since they
> >have LCD panels they aren't broadcasting any EM radiation. Of course
> >now LCDs are becoming popular for desktops too. Hmmm, ban the use of
> >LCDs, or require an EM chip (a la the V-chip) that will do
> >the broadcasting. . .
>
> Again, check out the Durak paper. CRTs are not the only source of
> RF emanations from your computer. And if savvy bad guys (with or without
> badges) are able to get physically to your machine to insert something
> (hardware or software), they can probably listen and record to their
> heart's content.
I suspect that while data broadcasting software loops running
in the OS produce a much stronger signal, there exists plenty of
current technology to monitor keyboard micro operation, and other
things that emit useful data... after all do you know what your keyboard
micros are doing the other 99.99 percent of the time you aren't hitting
a key ? And what about that serial data running about the cables
to the keyboard... how detectable is that ?
Of course it has always fascinated me that laptops always seem
to contain enable video chips designed to create analog video streams
even though laptops are relatively rarely hooked to monitors...
--
Dave Emery N1PRE, die@die.com DIE Consulting, Weston, Mass.
PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2 5D 27 BD B0 24 88 C3 18
