Emission Security - Revision history

141.20.21.149 at 12:51, 3 February 2005

2005-02-03T12:51:04Z

← Older revision		Revision as of 12:51, 3 February 2005
Line 160:		Line 160:

	[[Image:MarkusKuhnRossAnderson_SoftTempest.jpg\|left\|Source: 1]]		[[Image:MarkusKuhnRossAnderson_SoftTempest.jpg\|left\|Source: 1]]
⚫	Source: [1]




















































		⚫	Source: [1]
	== Links ==		== Links ==

Gf: /* Attacks */

2005-01-25T00:05:51Z

Attacks

← Older revision		Revision as of 00:05, 25 January 2005
Line 97:		Line 97:
	waves. But not all informations can be reconstructed from emanations. Letters produce a wide band signal because of their thin vertical lines. Texts contain many redundancy because they use only a subset of all possible pixel-patterns. So Texts are easy to reconstruct.		waves. But not all informations can be reconstructed from emanations. Letters produce a wide band signal because of their thin vertical lines. Texts contain many redundancy because they use only a subset of all possible pixel-patterns. So Texts are easy to reconstruct.
	But there is no procedure known to rebuild colour information. So pictures are difficult to reconstruct.		But there is no procedure known to rebuild colour information. So pictures are difficult to reconstruct.


	== Attacks ==		== Attacks ==
Line 111:		Line 112:

	[Eck1985]		[Eck1985]


	=== Keyboard Acoustic Emanations ===		=== Keyboard Acoustic Emanations ===
Line 120:		Line 122:

	[Asonov2004]		[Asonov2004]


	=== Radiation from RS-232 Cables ===		=== Radiation from RS-232 Cables ===
Line 128:		Line 131:

	[Smulders1990]		[Smulders1990]


	== Countermeasures ==		== Countermeasures ==

Gf: /* Physical Backgrounds */

2005-01-25T00:04:57Z

Physical Backgrounds

← Older revision		Revision as of 00:04, 25 January 2005
Line 81:		Line 81:
	Many published research about Emission Security were made for example about Vulnerabilities of smart cards (Markus Kuhn and Ross Anderson 1996) and Vulnerabilities of crypto-systems (Paul Kocher). Kuhn and Anderson also published a paper showing that compromising emanations from PCs could be countered with measures in software.		Many published research about Emission Security were made for example about Vulnerabilities of smart cards (Markus Kuhn and Ross Anderson 1996) and Vulnerabilities of crypto-systems (Paul Kocher). Kuhn and Anderson also published a paper showing that compromising emanations from PCs could be countered with measures in software.
	1995 were also basic information of the TEMPEST standard published.		1995 were also basic information of the TEMPEST standard published.


	== Physical Backgrounds==		== Physical Backgrounds==

	----

	The strongest transmitters in PCs are displaying devices like graphic cards, video cables or monitors, because they work with high frequencies and they need much power. So the emanation of these devices is high energetical and it has high ranges. In addition are visual signals periodical (e.g. the output of visual memory of a graphic card is 70-100 times in one second). Periodic signals are easy to eavesdrop, because the noise can be reduced by middling.		The strongest transmitters in PCs are displaying devices like graphic cards, video cables or monitors, because they work with high frequencies and they need much power. So the emanation of these devices is high energetical and it has high ranges. In addition are visual signals periodical (e.g. the output of visual memory of a graphic card is 70-100 times in one second). Periodic signals are easy to eavesdrop, because the noise can be reduced by middling.
Line 97:		Line 97:
	waves. But not all informations can be reconstructed from emanations. Letters produce a wide band signal because of their thin vertical lines. Texts contain many redundancy because they use only a subset of all possible pixel-patterns. So Texts are easy to reconstruct.		waves. But not all informations can be reconstructed from emanations. Letters produce a wide band signal because of their thin vertical lines. Texts contain many redundancy because they use only a subset of all possible pixel-patterns. So Texts are easy to reconstruct.
	But there is no procedure known to rebuild colour information. So pictures are difficult to reconstruct.		But there is no procedure known to rebuild colour information. So pictures are difficult to reconstruct.


	== Attacks ==		== Attacks ==

Gf: /* Countermeasures */

2005-01-25T00:04:04Z

Countermeasures

← Older revision		Revision as of 00:04, 25 January 2005
Line 130:		Line 130:
	[Smulders1990]		[Smulders1990]

⚫	== Countermeasures ==

		⚫	== Countermeasures ==
	----

	=== Countermeasures against bugs ===		=== Countermeasures against bugs ===
Line 161:		Line 160:
	[[Image:MarkusKuhnRossAnderson_SoftTempest.jpg\|left\|Source: 1]]		[[Image:MarkusKuhnRossAnderson_SoftTempest.jpg\|left\|Source: 1]]
	Source: [1]		Source: [1]


	== Links ==		== Links ==

Gf: /* Attacks */

2005-01-25T00:03:32Z

Attacks

← Older revision		Revision as of 00:03, 25 January 2005
Line 101:		Line 101:
	== Attacks ==		== Attacks ==

			=== Video Display Units ===
	----
			In the early 80's the Dutch PTT (Post, Telephone, and Telegraph) has tested monitors and keyboards connected to telephone lines in homes for sending and receiving mail. During the tests some users complained about interference from their neighbor's units. Several persons were able to read a neighbor's mail as the neighbor viewed electronic mail on the screen at home.
	to do

			Wim Van Eck at the Dr. Neher Laboratories was assigned the task of developing an inexpensive detection unit to monitor RF electromagnetic radiation to evaluate monitors to help with installation problems.

			It was considered very difficult to reconstruct the data hidden in the radiated field, only possible for professionals with access to very sophisticated detection and decoding equipment. Van Ecks research proofed this to be wrong. He made a demostration with material for less than $220, based on a modified TV set.

			The structure of the video signal shows remarkable resemblance to a normal broadcast TV signal. The pixel rate may even be located inside the TV broadcast bonds, only the synchronisation
			information is missing and has to be reconstructed. The signal is emited by the CRT itself and by the cable connecting the display with the hardware generating the image. As a result even LCD displays are sensitive to the attac. Try out [http://www.erikyyy.de/tempest/ Tempest for Eliza] to see that this is more than theory.

			[Eck1985]

			=== Keyboard Acoustic Emanations ===
			The sound of clicks produced when typing on a PC keybord can differ slightly from key to key, although the clicks of different keys sound very similar to the human ear. A neural network can be trained to differentiate the keys to successfully carry out an attack. The keyboard plate acts like a drum, and each key hits the drum in a different location and produces a unique frequency or sound that the neural networking software can decipher.

			The attac is very cheap. All you need is a computer, standard software to record the clicks and to train a neural network (available for free - read the paper) and a microphone.

			The attac is simple. It is non-invasive - no physical intrusion into the system is needed and the quality of the sound is not very important. It can be recorded from substantial distance (even with a cell phone).

			[Asonov2004]

			=== Radiation from RS-232 Cables ===
			Experiments on eavesdropping RS-232 cable signals prove that it is possible to intercept data signals running along an RS-232 cable, by picking up and decoding the electromagnetic radiation produced by the cable. The rise and fall times of the data signal are very short. Consequently, they correspond to high frequency components resulting in considerable radiation. In many cases, the RS-232 cables are not shielded, or the shield is not adequately
			connected to the equipment. Usually, the data is coded in well-known character sets, like ASCII.

			The interception-distance is limited to several meters, but the needed equipment is small, simple and cheap: a pocket radio receiver, a tape recorder and a computer to analyse the data.

			[Smulders1990]

	== Countermeasures ==		== Countermeasures ==

Gf: /* History */

2005-01-24T22:38:10Z

History

← Older revision		Revision as of 22:38, 24 January 2005
Line 31:		Line 31:
	* '''High-frequency optical signals'''		* '''High-frequency optical signals'''
	LED status indicators on data communication equipment, under certain conditions, are shown to carry a modulated optical signal that is significantly correlated with information being processed by the device. [Loughry2002]		LED status indicators on data communication equipment, under certain conditions, are shown to carry a modulated optical signal that is significantly correlated with information being processed by the device. [Loughry2002]


	== History ==		== History ==
Line 80:		Line 81:
	Many published research about Emission Security were made for example about Vulnerabilities of smart cards (Markus Kuhn and Ross Anderson 1996) and Vulnerabilities of crypto-systems (Paul Kocher). Kuhn and Anderson also published a paper showing that compromising emanations from PCs could be countered with measures in software.		Many published research about Emission Security were made for example about Vulnerabilities of smart cards (Markus Kuhn and Ross Anderson 1996) and Vulnerabilities of crypto-systems (Paul Kocher). Kuhn and Anderson also published a paper showing that compromising emanations from PCs could be countered with measures in software.
	1995 were also basic information of the TEMPEST standard published.		1995 were also basic information of the TEMPEST standard published.


	== Physical Backgrounds==		== Physical Backgrounds==

Gf: /* Bibliography */

2005-01-24T22:36:52Z

Bibliography

← Older revision		Revision as of 22:36, 24 January 2005
Line 151:		Line 151:

	== Bibliography ==		== Bibliography ==

	----

	[1] Ross Anderson and Markus Kuhn - Soft Tempest: Hidden Data Transmission Using Electromagnetic Emanations [http://www.cl.cam.ac.uk/~mgk25/ih98-tempest.pdf http://www.cl.cam.ac.uk/~mgk25/ih98-tempest.pdf]		[1] Ross Anderson and Markus Kuhn - Soft Tempest: Hidden Data Transmission Using Electromagnetic Emanations [http://www.cl.cam.ac.uk/~mgk25/ih98-tempest.pdf http://www.cl.cam.ac.uk/~mgk25/ih98-tempest.pdf]

			[Eck1985] Van Eck - Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk?, 1985 [http://jya.com/emr.pdf pdf]

			[Smulders1990] Peter Smulders - The Threat of Information Theft by Reception of Electromagnetic Radiation from RS-232 Cables, 1990 [http://jya.com/rs232.pdf pdf]

			[SEPI1991]
			Symposium on electromagnetic security for information protection (SEPI'91), Proceedings, Rome, Italy, 21-22 November 1991

			[Asonov2004] Dmitri Asonov and Rakesh Agrawal - Keyboard Acoustic Emanations, 2004 [http://www.almaden.ibm.com/software/quest/Publications/papers/ssp04.pdf pdf]

			[Loughry2002] Joe Loughry and David A. Umphress - Information Leakage from Optical Emanations, 2002 [http://applied-math.org/optical_tempest.pdf pdf]

Gf: /* Types of compromising emanations */

2005-01-24T22:21:43Z

Types of compromising emanations

← Older revision		Revision as of 22:21, 24 January 2005
Line 17:		Line 17:
	* '''Electromagnetic waves radiated into free space or along metallic conductors'''		* '''Electromagnetic waves radiated into free space or along metallic conductors'''
	Cathode-ray tube (CRT) displays act as a parasitic transmission antenna, they emit video signal as electromagnetic waves. [Eck1985]		Cathode-ray tube (CRT) displays act as a parasitic transmission antenna, they emit video signal as electromagnetic waves. [Eck1985]


	* '''Cross-Talk'''		* '''Cross-Talk'''
	Where data and telephone lines share the same cable conduit for several meters information from one cable may be transmitted to the other.		Where data and telephone lines share the same cable conduit for several meters information from one cable may be transmitted to the other.


	* '''Power-supply current fluctuations'''		* '''Power-supply current fluctuations'''
	Line drivers for data cables have data-dependent power consumption, which can affect the supply voltage. [Smulders1990]		Line drivers for data cables have data-dependent power consumption, which can affect the supply voltage. [Smulders1990]

		⚫	* '''Vibrations, acoustic and ultrasonic emissions'''

⚫	* '''~~vibrations~~, acoustic and ultrasonic emissions'''
	Acoustic emanations of matrix printers can carry substantial information about the text being		Acoustic emanations of matrix printers can carry substantial information about the text being
	printed. [SEPI1991]		printed. [SEPI1991]
	PC keyboards are vulnerable to attacks based on differentiating the sound emanated by different keys. [Asonov2004]		PC keyboards are vulnerable to attacks based on differentiating the sound emanated by different keys. [Asonov2004]

		⚫	* '''High-frequency optical signals'''

⚫	* '''~~high~~-frequency optical signals'''
	LED status indicators on data communication equipment, under certain conditions, are shown to carry a modulated optical signal that is significantly correlated with information being processed by the device. [Loughry2002]		LED status indicators on data communication equipment, under certain conditions, are shown to carry a modulated optical signal that is significantly correlated with information being processed by the device. [Loughry2002]

Gf: /* Introduction */

2005-01-24T22:19:12Z

Introduction

@@ Line 1: / Line 1: @@
 == Introduction ==
 Computer and communications devices emit numerous forms of energy. It is part of their normal operation: the user wants feedback and needs to hear or to see something.
-But more emissions than most users are aware of, are the result of unintended side effects. E.g anything that can carry a current can act like an antenna. When a conductor drives an oscillating current, which is very common in digital devices, it emmits electromagnetic radiation carring both power and signals away from the source.
+But more emissions than most users are aware of, are the result of unintended side effects. E.g. anything that can carry a current can act like an antenna. When a conductor drives an oscillating current, which is very common in digital devices, it emits electromagnetic radiation carrying both power and signals away from the source.
-The trouble begins when the emitted energy carries information about processed data. An eavesdropper can intercept and analyze such compromising emanations to steal information.
+The trouble begins when the emitted energy carries information about processed data. An eavesdropper can intercept and analyse such compromising emanations to steal information.
 == History ==

Gf: /* Introduction */

2005-01-24T21:20:24Z

Introduction

← Older revision		Revision as of 21:20, 24 January 2005
Line 1:		Line 1:
	== Introduction ==		== Introduction ==

	Computer and communications devices emit numerous forms of energy. ~~Many~~ of ~~these~~ ~~emissions~~ ~~are produced as unintended side effects of~~ normal operation~~. For example, where these emissions take~~ the ~~form of radio waves,~~ ~~they~~ ~~can~~ ~~often~~ be ~~observed~~ ~~interfering~~ ~~with~~ ~~nearby~~ ~~radio~~ ~~receivers~~.		Computer and communications devices emit numerous forms of energy. It is part of their normal operation: the user wants feedback and needs to hear or to see something.

			But more emissions than most users are aware of, are the result of unintended side effects. E.g anything that can carry a current can act like an antenna. When a conductor drives an oscillating current, which is very common in digital devices, it emmits electromagnetic radiation carring both power and signals away from the source.
⚫	~~Some~~ of the ~~unintentionally~~ emitted energy carries information about processed data. ~~Under good conditions, a sophisticated and well-equipped~~ eavesdropper can intercept and analyze such compromising emanations to steal information.

		⚫	The trouble begins when the emitted energy carries information about processed data. An eavesdropper can intercept and analyze such compromising emanations to steal information.
	Even where emissions are intended, as is the case with transmitters and displays, only a tiny fraction of the overall energy and information content emitted will ever reach the intended recipient. Eavesdroppers can use specialized more sensitive receiving equipment to tap into the rest and access confidential information. Much knowledge in this area is classified military research.

			Much knowledge in this area is classified military research.
	Source: Encyclopedia of Cryptography and Security; van Tilborg, Kluwer, May 2005

	== History ==		== History ==