Van Eck Radiation

Van Eck phreaking, also known as Van Eck radiation, is a form of eavesdropping in which special equipment is used to pick up side-band electromagnetic emissions from electronic devices that correlate to hidden signals or data to recreate these signals or data to spy on the electronic device. Side-band electromagnetic radiation emissions are present in (and with the proper equipment, can be captured from) keyboards, computer displays, printers, and other electronic devices.

In 1985, Wim van Eck published the first unclassified technical analysis of the security risks of emanations from computer monitors. This paper caused some consternation in the security community, which had previously believed that such monitoring was a highly sophisticated attack available only to governments; van Eck successfully eavesdropped on a real system, at a range of hundreds of metres, using just $15 worth of equipment plus a television set.

As a consequence of this research, such emanations are sometimes called "van Eck radiation", and the eavesdropping technique van Eck phreaking. Government researchers were already aware of the danger, as Bell Labs had noted this vulnerability to secure teleprinter communications during World War II and was able to produce 75% of the plaintext being processed in a secure facility from a distance of 80 feet (24 metres). Additionally, the NSA published ''Tempest Fundamentals, NSA-82-89, NACSIM 5000, National Security Agency'' (Classified) on February 1, 1982. Also, the van Eck technique was successfully demonstrated to non-TEMPEST personnel in Korea during the Korean War in the 1950s.

While phreaking is the process of exploiting telephone networks, it is used here because of its connection to eavesdropping. Van Eck phreaking of CRT displays is the process of eavesdropping on the contents of a CRT by detecting its electromagnetic emissions.

Basic principle

Information that drives the video display takes the form of high-frequency electrical signals. These oscillating electric currents create electromagnetic radiation in the RF range. These radio emissions are correlated to the video image being displayed, so, in theory, they can be used to recover the displayed image.

CRTs

In a CRT the image is generated by an electron beam that sweeps back and forth across the screen. The electron beam excites the phosphor coating on the glass and causes it to glow. The strength of the beam determines the brightness of individual pixels (see CRT for a detailed description). The electric signal which drives the electron beam is amplified to up to around one hundred volts from TTL circuitry. This high frequency, high voltage signal creates electromagnetic radiation that has, according to Van Eck, "a remarkable resemblance to a broadcast TV signal". The signal leaks out from displays and may be captured by an antenna, and once synchronization pulses are recreated and mixed in, an ordinary analog television receiver can display the result. The synchronization pulses can be recreated either through manual adjustment or by processing the signals emitted by electromagnetic coils as they deflect the CRT's electron beam back and forth.

In the paper, Van Eck reports that in February 1985 a successful test of this concept was carried out with the cooperation of the BBC. Using a van filled with electronic equipment and equipped with a VHF antenna array, they were able to eavesdrop from a "large distance". There is no evidence that the BBC's TV detector vans used this technology, although the BBC will not reveal whether or not they are a hoax.

Van Eck phreaking and protecting a CRT display from it was demonstrated on an episode of Tech TV's The Screen Savers on December 18, 2003.

LCDs

In April 2004, academic research revealed that flat panel and laptop displays are also vulnerable to electromagnetic eavesdropping. The required equipment for espionage was constructed in a university lab for less than US$2000.

Communicating using Van Eck phreaking

In January 2015, the Airhopper project from Georgia Institute of Technology, United States demonstrated (at Ben Gurion University, Israel) the use of Van Eck Phreaking to enable a keylogger to communicate, through video signal manipulation, keys pressed on the keyboard of a standard PC, to a program running on an Android cellphone with an earbud radio antenna.

Tailored access batteries

A tailored access battery is a special laptop battery with Van Eck Phreaking electronics and power-side band encryption cracking electronics built-into its casing, in combination with a remote transmitter/receiver. This allows for quick installation and removal of a spying device by simply switching the battery.

Potential risks

Van Eck phreaking might also be used to compromise the secrecy of the votes in an election using electronic voting. This caused the Dutch government to ban the use of NewVote computer voting machines manufactured by SDU in the 2006 national elections, under the belief that ballot information might not be kept secret. In a 2009 test of electronic voting systems in Brazil, Van Eck phreaking was used to successfully compromise ballot secrecy as a proof of concept.

Further research

Markus Kuhn has discovered several low-cost techniques for reducing the chances that emanations from computer displays can be monitored remotely. With CRT displays and analog video cables, filtering out high-frequency components from fonts before rendering them on a computer screen will attenuate the energy at which text characters are broadcast. With modern flat panel displays, the high-speed digital serial interface (DVI) cables from the graphics controller are a main source of compromising emanations. Adding random noise to the least significant bits of pixel values may render the emanations from flat-panel displays unintelligible to eavesdroppers but is not a secure method. Since DVI uses a certain bit code scheme that tries to transport a balanced signal of 0 bits and 1 bits, there may not be much difference between two-pixel colors that differ very much in their color or intensity. The emanations can differ drastically even if only the last bit of a pixel's color is changed. The signal received by the eavesdropper also depends on the frequency where the emanations are detected. The signal can be received on many frequencies at once and each frequency's signal differs in contrast and brightness related to a certain color on the screen. Usually, the technique of smothering the RED signal with noise is not effective unless the power of the noise is sufficient to drive the eavesdropper's receiver into saturation thus overwhelming the receiver input.

See also

* TEMPEST, a United States government standard for limiting electric or electromagnetic radiation emanations from electronic equipment
* RINT, the acronym for Radiation Intelligence, military application
* Air gap (networking)
* Near sound data transfer

References

External links

Van Eck phreaking Demonstration

Tempest for Eliza
is a program that uses a computer monitor to send out AM radio signals, making it possible to hear computer-generated music in a radio.

Video eavesdropping demo at CeBIT 2006
by a Cambridge University security researcher

eckbox
– unsuccessful or abandoned attempt in spring 2004 to build an open-source Van Eck phreaking implementation

Sniffing wireless keyboard link

system-bus-radio
– an implementation of Van Eck phreaking using certain processor instructions on a general purpose computer

{{DEFAULTSORT:Van Eck Phreaking
Surveillance
Phreaking
1985 in science
Telecommunications-related introductions in 1985