Clive Robinson • November 1, 2014 5:39 AM

@ Figureitout,

That demo of using an FM receiver to exfiltrate data has been seen on this blog before but without the details. If you remember I tracked the prof down and found strong links to German IC money.

As it happens like many things from the early days of computers it’s been “rediscovered” and “updated”. Back in the 60s/70s when computers were still made with discrete transistors and CPU clock speeds were down at 1MHz or less, it was not unusual to find a speaker in the control area that could be connected to “bus lines” for debugging, and also an AM radio that would warble along in some not quite random way, unless the programe got stuck in a loop in which case a crude tone would be heared. Later in the mid 70s we had Van Eck who remonstrated that the high power unshielded signals around a CRT that got accidently broadcast, could be received by a VHF low band (ie 45Mhz) receiver and used to rebuild the image on a VDU screen from quite a distance away.

So nothing particulary unkown, just a new way of using the idea.

With regards the Wifi Yagi, as you have no doubt found they are a little large in size and stand out quite a way. Have a look for a “bow tie” or “figure of eight” loop antenna mounted on a “back fire” array reflector for a lower profile. Or my “covert” favorite the “coax collinear” omnidirectional that can be easily put into a plastic drain pipe used as the top of a flag pole. You can also put them infront of a large reflector an appropriate distance apart and get gains aproaching 30dB without too many problems. Back many years ago you would see “phasing stub” collinear designs in “corner refectors” for radar systems that would sit under the main dish used for IFF systems.

However for a simple design have a look first at low end UHF design,

http://www.rason.org/Projects/collant/collant.htm

To get an idea of what you are doing.

Then look at what you will do to squeaze every “dog biscuit” you can out of it at the low microwave band of 2.4Ghz where the mechanical details have to be a lot more exacting,

http://www.nodomainname.co.uk/Omnicolinear/2-4collinear.htm

The thing to remember is that these antennas are around twice the length they could be due to the fact that every other length is not being used as a radiating element only for phasing. Thus you can with care make “hair pin” phasing stubs/ elements and fold a compleat collinear out of a length of stiffish copper wire you can then clamp between a couple of bits of plastic for support.

Clive Robinson • November 1, 2014 6:01 AM

@ Bruce,

I happened to be in the Nat Hist Museum shop just a couple of days ago, and saw this image in the rather nice book of the 2014 photos, and I nearly purchased a copy of it to hang in the hall. However after some persuasion applied via my ear 😉 I went for a whale one to match the other five I have hanging on my dining room walls.

Clive Robinson • November 1, 2014 8:50 AM

@ Jacob,

RIPA due to its wording actually covers any network connected directly or indirectly to the UK, so is actually extrajudicial in scope.

As for the requesting of data from the US it’s the old game of you spy for me and I’ll spy for you. Because warrants cannot “time travel” you cannot get one for eavesdropping on the past, so RIPA does not apply. Now how far in the past does that mean, well as far as I can tell “anything prior to the issue of a warrant”. So if they don’t apply for a warrent then they are “golden”.

Issac Azimov once wrote a story about “chronoscopes” which could look back in time and present it like a “fly on the wall” TV reality program. In the story it was strictly under the control of the Government, as was any of the technology behind it even in only losely related fields. But a couple of scientists discovered a way to simply build one a different way that they then published in a “home build project” magazine. At the end of the story the authorities bust the door down to arrest them not knowing about the mag that had hit the news stands. The agent explains to them why chronoscopes make perfect spying tools and that’s why the government controls them. When one of the scientists tells the agent about the mag, the agent walks away in disgust with the line “Welcome to the Goldfish bowl”.

Although written in the fourties or fifties like the works of Orwell it is oddly uptodate in perspective…

Clive Robinson • November 1, 2014 12:53 PM

@ Bitstrong,

The second MIT article you point to is not realy new, it’s the same as “Power Analysis” carried out on smart cards in the late 1980s through 90’s that eventually gave rise to Differential Power Analysis (DPA).

Thus all the things that were tried and failed on smart cards will fail to solve this attack, which includes the article sugestion of injecting random data.

The reason this side channel exists is fairly easy to understand depending on which way you look at it.

The First way is to consider the PC as an oscillator connected in series with a load across a battery. As the computer draws more current from the battery the PD across the load goes up. If the load is some kind of loop as you would expect with PCB traces then not only does it’s impedance increase with frequency, but it’s ability to radiate the signal likewise increases. If you also consider that the oscilator is effectivly in the middle of a dipole radiator formed by the network cable on one sideand the human on the other then it’s easy to see why the signal would radiate.

But secondly this gives rise to a second issue, in that any element that radiates energy is just as efficient at picking it up. As the PC is effectivly changing it’s impedence it’s acting as a data dependant variable load on the dipole. Thus if you illuminate the dipole with a signal some of the signal energy will be taken from the illuminating field and transfered to the variable load. If you have a second antenna in the field you can measure the change of energy in the field caused by the PC.

If you look back on this blog I’ve mentioned a few times in the past that I was performing this on vulnerable electronic gambling games and wallets back in the 1980s. You will also see from RobertT’s comments I was not alone in this.

I did more than just used the field to listen in to the devices I actually adjusted it to quite a high level and modulated it with signals to induce faults in the equipment that had I been a crook would have been most benificial.

However the academic field did not catch up untill just a few years ago when two researchers used an EM field to cause problems in a hardware random number generator taking it’s effective entropy from over four billion to around a hundred.

It’s interesting to note that the Israeli student had not mentiond the second effect and how you can also use it to induce faults, I guess they will have to do a bit more research to play catchup to get to the point I was at a third of a century ago…

What the student might also find is a rather angery man waving his over reaching DPA patents at him demanding royalties and the like, but hey the patents are not realy valid due to prior art. So wave all he likes the patents are not enforceable where the student is working…

Clive Robinson • November 1, 2014 11:05 PM

@ Wael,

Hmm! Did I overpower the broadcast signal or did I interfere with the remote discriminator?

The operative word you use is “interfere” and I use “overpower”…

Now the tank circuit in the discriminator canbe regarded as an energy storage device just like a pendulum.

Now ask yourself the question,

If I have a pendulum swinging in sympathy with an external excitation signal, and I apply a second excitation signal, using vector analysis of the three components, how strong will the second excitation signal have to be to reduce the effect of the first excitation signal to negligible levels and over what period of time (expressed in turms of compleate swings of the pendulum).

Having worked it out would you say the second signal is less than or greater than the first and by how much?

On a side note did you know that during WWII the German forces could reliably radio direction find an SOE spy set from over five kilometers away when it was only receiving?

The local oscillator in early bipolar transistor radios used to be “re-transmitted” up the receivers antenna because they did not have any isolation between the antenna and the local oscillator. The reason for this is that transistors with an ft of 300MHz were considerably more expensive than those with an ft of 5MHz or less used in the IF amp discriminator and audio amp. Thus only the local oscilator and mixer transistors had suitable ft figures, there was no RF amplifier, that is the antenna fed a tuned circuit that provided some preselection but mainly matched the antenna into the base impedance of the mixer transistor, the local oscilator would also be matched into the base of the transistor, but to make the mixing process work the local oscilator needed sufficient amplitude to turn the transistor on and off which needed about 1 volt on the mixer transistor base and was thus often larger due to manufacturing tolerance, and could get close to twice the battery voltage peak to peak. Thus you could have due to matching more than 3 volts of LO actually on the antenna, because the LO would be well within the bandwidth of the preselector tank when the I.F. was around 450KHz…

It was not untill the FM bands got crowded and EMC specs were brought out in the 1980/90s that semiconductor radios started to get issolation by the use of front end RF amplifiers, dual conversion or HF IFs and the use of dual gate FETs. These days it’s cheaper to use compleate ICs than discrete transistors so providing LO to RF port issolation on the mixer is much easier using the likes of “long tailed pairs” and front end amplifers of two or more stages is fairly standard, often with AGC to ensure suitable levels out of the IF to drive a PLL FM demodulator. However even this is on the way out, with the transistors in ICs having ft figures above 6GHz digital processing is crawling up the chain towards the antenna, some car radios are now SDR designs as are most of those TV/DAB/FM USB dongles.

Clive Robinson • November 2, 2014 12:22 AM

OFF Topic :

More reporting on the scanner/printer air gap jumping,

http://securityaffairs.co/wordpress/29551/hacking/hacking-air-gapped-networks.html

Whilst this is not impossible it is highly improbable, and fairly easy to prevent ie don’t have a scanner/printer connected to your air gapped network, or if you need to put it out of range of windows etc.

I would be a lot more concerned about what “Intel ‘had put’ Inside” in the form of system monitoring and control that uses the RF part of the EM spectrum, which is much harder to screen.

Speaking of lasers and drones, many are aware that a laser can be used as a microphone, by measuring the vibrations of objects. But most are not thinking about the fact that a pulse modulated laser can make objects vibarate. The higher the frequency of vibration generaly the more efficient the conversion process. Now think about this in terms of the BadBIOS ultra sound air gap crossing. I suspect this would be more likely and practical than the scanner/printer method, if for no other reason the laser would work quite happily in the invisable to humans IR range of the EM spectrum, and the sound would travel down coridors and around corners unlike a blue light laser.

On a less improbable note, it would appear that the focus of APT vitriol is moving from China to Russia,

http://www.bloomberg.com/politics/articles/2014-10-30/security-firms-tie-russian-government-to-utilities-hacks

As I’ve said all along it’s not just China, it’s many other Nations as well including the Russians, Israelis, France and for that matter all other Western and First world nations, and with the “tools for sale” it’s also open to third world dictators as well just like military equipment.

However if power and communication utilities are under attack or are in fact “owned” it does align with Putin’s policy towards Russia’s immediate neighbors that we have seen in the past.

Clive Robinson • November 3, 2014 4:24 AM

@ Wael, and others interested in regen recivers,

There are quite a few designs out on the net for both regenerative and super-regenerative receivers using dual gate FETs.

There us this quite clever regen design, where the bipolar transistor is used as a grounded base RF amp to feed the FET as well as either an emitter folower or common emitter amplifier in the oposite direction for the audio,

http://www.m0dgq.co.uk/Simple%20regen%20receiver.html

Then of the “food for thought” variety there is this super-regen experiment with spectrum analyser displays that tell some of the horrors of such receivers,

http://www.amalgamate2000.com/radio-hobbies/radio/super%20regen%20at%20HF.htm

One asspect alluded to is that these receivers are transmitters, or more correctly “on frequency repeaters”, it’s an effect that can be utilised to advantage when doing surveilance type activities.

Oh and one of the more useful patents on modern super-regens,

http://www.google.co.uk/patents/US5742902

Enjoy 🙂