Compromising Emanations: Eavesdropping Risks of Computer Displays
Total Page:16
File Type:pdf, Size:1020Kb
UCAM-CL-TR-577 Technical Report ISSN 1476-2986 Number 577 Computer Laboratory Compromising emanations: eavesdropping risks of computer displays Markus G. Kuhn December 2003 15 JJ Thomson Avenue Cambridge CB3 0FD United Kingdom phone +44 1223 763500 http://www.cl.cam.ac.uk/ c 2003 Markus G. Kuhn This technical report is based on a dissertation submitted June 2002 by the author for the degree of Doctor of Philosophy to the University of Cambridge, Wolfson College. Technical reports published by the University of Cambridge Computer Laboratory are freely available via the Internet: http://www.cl.cam.ac.uk/TechReports/ ISSN 1476-2986 Summary Electronic equipment can emit unintentional signals from which eavesdroppers may re- construct processed data at some distance. This has been a concern for military hardware for over half a century. The civilian computer-security community became aware of the risk through the work of van Eck in 1985. Military “Tempest” shielding test standards remain secret and no civilian equivalents are available at present. The topic is still largely neglected in security textbooks due to a lack of published experimental data. This report documents eavesdropping experiments on contemporary computer displays. It discusses the nature and properties of compromising emanations for both cathode-ray tube and liquid-crystal monitors. The detection equipment used matches the capabilities to be expected from well-funded professional eavesdroppers. All experiments were carried out in a normal unshielded office environment. They therefore focus on emanations from display refresh signals, where periodic averaging can be used to obtain reproducible results in spite of varying environmental noise. Additional experiments described in this report demonstrate how to make information emitted via the video signal more easily receivable, how to recover plaintext from em- anations via radio-character recognition, how to estimate remotely precise video-timing parameters, and how to protect displayed text from radio-frequency eavesdroppers by us- ing specialized screen drivers with a carefully selected video card. Furthermore, a proposal for a civilian radio-frequency emission-security standard is outlined, based on path-loss estimates and published data about radio noise levels. Finally, a new optical eavesdropping technique is demonstrated that reads CRT displays at a distance. It observes high-frequency variations of the light emitted, even after diffuse reflection. Experiments with a typical monitor show that enough video signal remains in the light to permit the reconstruction of readable text from signals detected with a fast photosensor. Shot-noise calculations provide an upper bound for this risk. Acknowledgments I would like to thank my former supervisor Ross Anderson for making this entire project possible and for encouraging my initial experiments with his ESL 400 emission monitor. I am also much in dept to Tony Kruszelnicki of TK Electronics in Lincoln for an extended loan of a Dynamic Sciences R-1250 receiver and various accessories. The technical staff of the Computer Laboratory and in particular Piete Brooks earned my thanks for their pa- tience and competent assistance. Robert Watson contributed useful GPIB/TCP gateway software for instrument control during his brief stay as a visiting student. Simon Moore provided a storage oscilloscope and Richard Clayton helped reverse-engineer an annoying problem with its firmware. Richard Clayton, Ross Anderson, and Gareth Evans provided valuable comments on the draft text and were along with Sergei Skorobogatov and David Wheeler available for useful discussion. The purchase of some of the equipment used was made possible through the TAMPER hardware security laboratory support provided by NDS and Hitachi. I was supported by a European Commission Marie Curie training grant. Contents 1 Introduction 9 1.1 Historic background and previous work . 10 1.1.1 Militaryactivities. 10 1.1.2 Openliterature ............................. 12 1.2 Motivationandscope.............................. 14 2 Foundations and test equipment 19 2.1 Antennatypes.................................. 19 2.2 Receivers..................................... 23 2.3 Receivercalibration. 26 2.3.1 Impulsebandwidth ........................... 28 2.3.2 Impulsestrength ............................ 31 2.4 Signalcorrelation ............................... 33 3 Analog video displays 37 3.1 Video-signaltiming............................... 37 3.2 Analogvideo-signalspectra . 40 3.3 Eavesdroppingdemonstration . 45 3.3.1 Realtimemonitoring . 45 3.3.2 Experimentalsetup. 47 3.3.3 Results.................................. 47 3.4 Radio character recognition . 54 3.5 Hiddentransmissionviaditherpatterns. 57 3.6 Filtered fonts as a software protection . ...... 60 4 Digital video displays 67 4.1 Casestudy:Laptopdisplay .......................... 68 4.2 Case study: Digital Visual Interface . 77 5 Emission limits 85 5.1 Existingpublicstandards. 86 5.1.1 Ergonomicstandards . 87 5.1.2 Radio-frequency interference standards . ..... 87 5.2 Considerations for emission security limits . ..... 89 5.2.1 Radionoise ............................... 91 5.2.2 Radiosignalattenuation . 92 5.2.3 Power-line noise and attenuation . 94 5.2.4 Antennagain .............................. 95 5.2.5 Processinggain ............................. 96 5.3 Suggestedemissionlimits. 97 6 Optical eavesdropping of displays 105 6.1 Projective observation with telescopes . 105 6.2 Time-domain observation of diffuse CRT light . 106 6.3 Characterization of phosphor decay times . 107 6.3.1 Instrumentation. .108 6.3.2 Measurementmethod. .110 6.3.3 Results..................................111 6.4 Opticaleavesdroppingdemonstration . 116 6.5 Threatanalysis .................................120 6.5.1 Directobservation . .120 6.5.2 Indirectobservation. .122 6.5.3 ObservationofLEDs . .123 6.6 Receiver design considerations . 124 6.7 Countermeasures ................................126 7 Review, outlook and conclusions 129 A Electromagnetic fields 143 A.1 Maxwell’sequations............................... 143 A.2 Quantitiesandunits ..............................146 A.3 Electromagneticemanations . 146 A.4 Transmissionlinesandantennas. 148 A.5 Time-domain characterization of antennas . 151 B Notes on experimental setups 157 B.1 Impedance-matchedattenuators . 157 B.2 Videosyncsignalgeneration . 158 C Glossary 161 Chapter 1 Introduction “It has long been a dream of cryptographers to construct a ‘perfect’ machine [. .] The development in the last twenty years of electronic machines that accumulate data, or ‘remember’ sequences of numbers or letters, may mean that this dream has already been fulfilled. If so, it will be the nightmare to end all nightmares for the world’s crypt- analysts. In fact, the people who live in the vicinity of the National Security Agency think that there already are too many cipher and de- coding machines in existence. The electronic equipment plays havoc with their television reception.” — D.T. Moore, M. Waller: Cloak & Cipher, 1965 [1, p. 153] Computer and communication equipment receives and emits energy in various forms, such as electrical currents, heat, light, conducted and radiated electromagnetic waves, sound and vibrations. Most energy consumed will be released as heat or is used to form intended symbols on communication channels. Some of the rest is correlated in various ways to processed data and can form unintended information leaks. This opens unconventional opportunities for technically sophisticated outsiders to get unauthorized access to processed confidential information. Compromising electric, electromagnetic, optic, acoustic, ultrasonic, mechanic, etc. emana- tions can be a potential computer security threat if information is emitted in a form that can be practically separated from background noise and decoded at sufficient distance us- ing compact and available equipment. It can then be used to bypass commonly employed physical, cryptographic, and software access-control mechanisms at the operating-system, network, and application level. Such exploitable emanations can occur as a result of: the normal operation of a system • deliberate or accidental exposure of a device to an unusual environment • the execution of software that was designed to modulate data into emitted energy • Carefully chosen software measures can sometimes be applied to control the emitted signals. They can emit data in a form particularly suited for easy remote reception or 9 10 1.1. HISTORIC BACKGROUND AND PREVIOUS WORK they can render the otherwise feasible remote reconstruction of data far less practical. In the latter case, such measures can be a welcome low-cost alternative for, or an additional protection layer to, hardware shielding. Digital computers and telecommunication equipment have penetrated our civilization over the past half century, and at the same time, many aspects of human society have become significantly dependent on the availability, integrity, or confidentiality of automatically processed information. The risk posed by malicious abuse of this information infrastruc- ture is widely recognized today, as is demonstrated by the significant current media in- terest in computer security incidents and the growth of an information security industry that offers a wide range of countermeasures. Historically, most practical outsider attacks on information systems have involved some form of access to communication links, in order to eavesdrop exchanged data or imper- sonate