Van Eck phreaking

Van Eck phreaking is a form of eavesdropping in which special equipment is used to pick up side-band electromagnetic emissions from electronics devices that correlate to hidden signals or data for the purpose of recreating these signals or data in order to spy on the electronic device. Side-band electromagnetic radiation emissions are present in and, with the proper equipment, can be captured from keyboards, computer displays, printers, and other electronic devices.

Van Eck phreaking of CRT displays is the process of eavesdropping on the contents of a CRT by detecting its electromagnetic emissions. It is named after Dutch computer researcher Wim van Eck, who in 1985 published the first paper on it, including proof of concept.[1] Phreaking is the process of exploiting telephone networks, used here because of its connection to eavesdropping.

Van Eck phreaking might also be used to compromise the secrecy of the votes in an election using electronic voting. This caused the Dutch government to ban the use of NewVote computer voting machines manufactured by SDU in the 2006 national elections, under the belief that ballot information might not be kept secret.[2][3] In a 2009 test of electronic voting systems in Brazil, Van Eck phreaking was used to successfully compromise ballot secrecy as a proof of concept.[4]

Basic principle

Information that drives the video display takes the form of high frequency electrical signals. These oscillating electric currents create electromagnetic radiation in the RF range. These radio emissions are correlated to the video image being displayed, so, in theory, they can be used to recover the displayed image.

CRTs

In a CRT the image is generated by an electron beam that sweeps back and forth across the screen. The electron beam excites the phosphor coating on the glass and causes it to glow. The strength of the beam determines the brightness of individual pixels (see CRT for a detailed description). The electric signal which drives the electron beam is amplified to hundreds of volts from TTL circuitry. This high frequency, high voltage signal creates electromagnetic radiation that has, according to Van Eck, "a remarkable resemblance to a broadcast TV signal".[1] The signal leaks out from displays and may be captured by an antenna, and once synchronization pulses are recreated and mixed in, an ordinary analog television receiver can display the result. The synchronization pulses can be recreated either through manual adjustment or by processing the signals emitted by electromagnetic coils as they deflect the CRT's electron beam back and forth.[1]

In the paper, Van Eck reports that in February 1985 a successful test of this concept was carried out with the cooperation of the BBC. Using a van filled with electronic equipment and equipped with a VHF antenna array, they were able to eavesdrop from a "large distance". There is no evidence that the BBC's TV detector vans actually used this technology, although the BBC will not reveal whether or not they are a hoax.[5]

Van Eck phreaking and protecting a CRT display from it was demonstrated on an episode of Tech TV's The Screen Savers on December 18, 2003.[6][7]

LCDs

In April 2004, academic research revealed that flat panel and laptop displays are also vulnerable to electromagnetic eavesdropping. The required equipment for espionage was constructed in a university lab for less than US$2000.[8]

Communicating using Van Eck phreaking

In January 2015, the Airhopper project from Georgia Institute of Technology, United States demonstrated (at the Ben Gurion University, Israel) the use of Van Eck Phreaking to enable a keylogger to communicate through video signal manipulation keys pressed on the keyboard of a standard PC computer, to a program running on Android cellphone with earbud radio antenna.[9][10][11]

Tailored Access Batteries

A tailored Access Battery is a special laptop battery with Van Eck Phreaking electronics and power-side band encryption cracking electronics built-into its casing, in combination with a remote transmitter/receiver. This allows for quick installation and removal of spying device by simply switching the battery.[12]

Countermeasures

Countermeasures are detailed in the article on TEMPEST, the NATO's standard on spy-proofing digital equipment. One countermeasure involves shielding the equipment to minimize electromagnetic emissions. Another method, specifically for video information, scrambles the signals such that the image is perceptually undisturbed, but the emissions are harder to reverse engineer into images. Examples of this include low pass filtering fonts and randomizing the least significant bit of the video data information.

Another approach is to randomly shift the frequency of the clock used on keyboards with a custom chip containing a pseudorandom number generator (PRNG) with a long length and use an identical synchronized PRNG at the reception end to confound such attacks.

See also

References

  1. 1 2 3 Van Eck, Wim (1985). "Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk?" (PDF). Computers & Security. 4 (4): 269–286. doi:10.1016/0167-4048(85)90046-X.
  2. ↑ Dutch government scraps plans to use voting computers in 35 cities including Amsterdam (Herald tribune, 30. October 2006)
  3. ↑ Use of SDU voting computers banned during Dutch general elections (Heise, October 31. 2006)
  4. ↑ "Brazilian Breaks Secrecy of Brazil's E-Voting Machines With Van Eck Phreaking". Slashdot. November 21, 2009.
  5. ↑ Carter, Claire (27 September 2013). "Myth of the TV detector van?". The Daily Telegraph. Telegraph Media Group. Retrieved 27 September 2015.
  6. ↑ Van Eck Phreaking
  7. ↑ The Screen Savers: Dark Tip - Van Eck Phreaking
  8. ↑ Kuhn, M.G. (2004). "Electromagnetic Eavesdropping Risks of Flat-Panel Displays" (PDF). 4th Workshop on Privacy Enhancing Technologies: 23–25.
  9. ↑ Air-gapped computers are no longer secure, TechRepublic, January 26, 2015
  10. ↑ Original Whitepaper
  11. ↑ Airhopper demonstration video, Ben Gurion University
  12. ↑ White paper, FDES institute, 1996, page 12.

External links

This article is issued from Wikipedia - version of the 12/2/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.