Schneier on Security

Clive Robinson • July 15, 2009 11:03 PM

@ Kermit the Bog,

“Sorry, couldn’t resist…”

No need, a little levity makes a day pass more lightly, all the more so for it’s unintended originator.

The contract is nearly up on this mobile phone (22days and counting) so I’m going to look for one with a spell checker built in.

The sad thing is for all it’s quirks (and now failings of controls) the original reason I decided on it still holds good (the browser is realy on the suppliers servers).

Clive Robinson • July 17, 2009 3:44 PM

@ Bruce Clement,

“on the other hand I’m sure those things lack any meaningful shielding and their RF emissions can be picked up by “more normal” tempest methods.”

Most laptops almost totaly lack effective shielding, they tend to try “spread spectrum” modulation of the master clock to fit inside the EMC mask.

The spreading code is very usually trivial and very well known to industry insiders. Even if it was not it would actually take very little time with an IQ receiver next to the same model to find out what it is.

And as I have noted befor this actually makes a “TEMPEST” attack much much easier. The radiated energy is obviously still there but just spread across a larger bandwidth so less energy per unit of bandwidth (to get inside those all important EMC masks).

Now obviously if you know the spreding sequence and you despread the signals then you get back the original quite high energy per unit of bandwidth (which would not have fit inside the EMC mask). I have seen some that have a 20dB difference which roughly gives you ten times the range.

However as an unexpected bonus, it also reduces by the same spread factor any other signals which obviously gives you quite a bit extra signal to noise advantage…

Also as the spreading codes are almost always simple linear feed back shift registers you can play around with filter masks around the spread signal to ge a few extra dB of margin.

With regards,

“As long as they have one technique the people don’t, the spooks and the military are ahead as they can simply buy all the civilian technology they want, apply their secret techniques on top and lead”

You have forgoton two things,

1, Government procurment times

2, technology development times.

Once upon an age ago (back when I wore short trousers) tech times where considerably greater than procurment times.

Now however technology development times appear faster than Moore’s Law whilst procurment actually takes way way longer (more than ten years is not unknown).

The net result is that by the time the glacial speed of Gov Proc has got to the point of equipment delivery in most cases the technology they have bought is 3 to 4 generations out of date (if it’s even still available).

Also the “spooks” actualy are not at all inovative they used to be supported by “industry friends” but the joy of the free market Regan & Thatcher espoused killed off the lucrative deals that defence contractors used to have and with it went exclusivity. Also anybody with half a brain realised there was more money to be made on the open market…

Clive Robinson • July 19, 2009 2:46 AM

@ neill,

“wonder if one could get any usable radio signal from me since there’s so much interferrence anyways”

Your’s is one of those generalised questions that has an both a positive and negative answer due to many things so please hang in for what is the “quick and dirty answer”, which unfortunatly is very long for a blog, as I’m not sure of the technical level of the overall audiance.

The answer is dependent on a number of factors the major ones for EmSec / TEMPEST being,

1, Effective radiation range of signal.
2, Signal cohearance.
3, Noise sources.
4, Information bandwidth.

The effective radiation range of a signal is effected by many things the first being “free space radiation”.

As with the light from your car headlights you have a “signal source” (hot wire in the bulb) and the further away you are the less usefull the “signal” (light) is as it’s “wave front” is spread out over a greater and greater area, and at some point it will be either to weak for your unaided eyes or below the level of other light sources around you, so you will not be able to perceive it unaided.

Also there is a theoretical limit below which it is not possible to measure the signal due to “thermal noise” from other objects.

So you have a number of range limitations which are dependent on many factors.

However these range limitations are also based on the effective “capture area” of the receiver to the wave front of the signal source usually this is via “antenna gain”.

As you may know the larger the area of a telescopes primary optic to it’s final optic the more effective range it has, due to the optical “gain”.

It is the same with radio waves a large antenna can focus more of the energy from the surface area of the “wave front” to the input of the receiver.

There is a further issue of if the signal is realy in free space or constrained to a “transmission line” that prevents the signals energy becoming either dispersed or “decoherant” (effectivly interfering with it’s self).

In the case of the car headlight if you put it in a long tube with highly reflective surfaces then the light wave front could not spread out further than the cross sectional area (CSA) of the tube.

These tubes are known as “light pipes”. However due to the very large CSA of the tube compared to the wave length of the light the signal interferes with it’s self and loses cohearance. This can be reduced by using very narrow light pipes which is one of the main reasons why fiber optic cables used for carrying data signals are as thin or thinner than human hair.

With regards radio energy it can be trapped by the surface of a metal conductor (think about the construction of coax leads used for TV antennas and video signals) however as metal is a considerably better conductor than free space radio signals will apear to stick to a conductor and follow it, and like a fast moving car it can only stay “on the road” as long as the corners are not to sharp, which gives rise to the single conductor transmission line known as the G-Wire.

The G-Wire has practical significance to TEMPEST range.

You may know that overhead power cables are known to conduct radio signals very great distances with little loss and have been known to carry signals over many times their free space range which is why motorists sometimes discover their local radio station being interfeared with by a signal from a distant local radio station.

Other examples for instance, are overhead power cables, overhead telephone cables and even farm fences that have been known to capture cordless phone conversations and coduct them ten or a hundred times their effective operating range. The signal can even “couple” (jump) from one conductor to another if their share a volume of space that allows it.

Effectivly one way to imagine it is like a 1:1 transformer (magnetic or H field coupling) another way the two plates of a capacitor (E field coupling). Thankfully the predomanant H field coupling has an inverse cubic relationship (ie volume related) and the E field coupling an inverse square law relationship (ie surface area related). However which is of greater concern in any given situation is due to the “efective shape and distance” of the conductors. In ordinary everyday use peole used to experiance this effect on telephone cables where they could faintly hear other peoples conversations which is why it is often called “cross talk”.

These effects apply to ANY and ALL conductors including the ground, plants and wood (due to the moisture they hold), they can all carry very weak signals many times their expected free space range. Structural metal work and internal wiring for lights and power are particular TEMPEST worries as they can carry signals out of a building or area unnoticably as they are effectivly hidden (it’s one of the reasons TEMPEST proofing a building is so inordinatly expensive as you literaly have to check everything) and due to weather etc you have to check several times at different times of the year.

Further conductors can act like lenses and focus a signal back just like the optics in a telescope. Of particlar worry to TEMPEST is what are effectivly “slot radiators” and “frame antennas”.

That is a split in a shielded enclosure like the edge of a door can be an incredably efficient radiator of a signal (it is one of the reasons why microwave oven doors have a very peculiar design and are thus usually just under an inch thick at the edges).

Back in the days of the “cold war” it was noticed that reception of long range signals being monitored went up dramaticaly for a distinct period. It was found to be coicident to an anuall fair and it was realised that the frame of the ferris wheel atraction (seen in the film the “third man”) was responsable which was the reason it became a fixed feature.

However there is also the issue of interferance and it’s effects on TEMPEST activities. Put simply there are well established ways to “null it out” by using multiple directional antennas (works just like the “very long baseline” VLB radio telescopes) and more recently IQ receivers and baseband DSP filtering, estimating and averaging techneiques.

Put simply the techneiques can view a “tree trunk in the middle of a wood from the paddock” with little difficulty.

With computers what actually aids this is Electro Magnettic Compatability masks…

Manufactures who where not quite making the masks realised they could use “whitening” spread spectrum techniques to spread the energy of their interfering signals across a large bandwidth.

Ufortunatly it does not make the energy go away it just spreads it with a simple linear code, which means it can just as easily be despread and the energy recovered. Having had to use whitening to just get inside the mask some manufactures have realised that it is effectivly “a cure all” for EMC ills, and has enable them to remove expensive filtering components simply by increasing the spreading rate. Which means that it is a gift from heaven for those carrying out TEMPEST attacks as the spreading margin can be as high as 100:1, when compared to the effect that despreading actually spreads interferance out the real effect for TEMPEST can be an advantage of 10,000:1…

So do not regard interferance as being of benifit it realy is not.

Clive Robinson • July 20, 2009 7:29 AM

@ neill,

“”

That’s alright.

The problem with

“i hope, also the energies are very low (eg PCIe with 1.2V at 2.5GHz)”

Is the low voltage of the supply belies the actuall energy in the circuit.

At 2.5GHz the freespace wavelength is 12-13cm and depending on the PCB (FR4, RT Duroid etc) may be getting down to half that. Which is easily comparable with the PCB track lengths so it realy does radiate rather well if proper transmission line techniques have not been taken into account during layout.

Often the quality of a PC Motherboard is difficult to see as the PCB can be more critical to the design than the components used.

Also the case can be an oddity sometimes it radiates less with the outer case off that it does with it on (slot radiator problem).

EMC/TEMPEST proofing realy is a difficult problem above low VHF and neigh on impossible to do cost effectivly above the high UHF/low microwave bands.

To design a suitable case that is good from ELF to mid microwave (kind of old style DC to Daylight 😉 is not just difficult it is very expensive and to be honest you’ld be best at looking at a blade type solution to spread the cost across as many users as possible.

The last “secure box” I built for some one it was cheaper to actually build it inside a low cost safe and “filter & fringe” than it would have been to design or procure a suitable case…

The economies of COTS can be found in some strange places.