Schneier on Security

Clive Robinson • November 4, 2019 5:55 PM

@ Franz,

You can use paper and pencil. No Tempest emanation at all.

You wish…

Remember certain fundemental rules of physics, that give,

1, All coherant energy / state changes to a decoherant state when work is done.

That is,

2, No process of work is 100% efficient. By the process of radiation transport, all waste energy steps down to heat by the process of radiation and absorbtion, each step in the chain being less coherant and less discernable at distance.

Thus the mechanical energy of writing, gets transported away by conduction and radiation. The bulk of that radiation is acoustic and has very definate coherant information superimposed / modulated upon it.

Further whilst TEMPEST uses “passive” EmSec techniques, there is a much larger cannon of “active” EmSec attacks. In the case of you writing, a suitably high frequency RF source can be used to “illuminate” your hand and the writing implement. All conductors and dielectrics in such an EM field distort it. Thus if they move the field becomes modulated by the movment. Such modulation can be detected by standard doppler techniques. If two or more receivers are used you can come up with mathmatical transforms that will fairly accurately describe the movments, the hand and writing instrument make, thus in effect “see the words written”…

@ EvilKiru,

and destroy not only the top sheet of your plaintext writing pad when done, but also the next 2 to 5 sheets below it.

There is a simple way to avoid this issue, which I’ve mentioned once or twice befor. And trust me when I say you don’t want to leave blank sheets of paper you have written on around, and destroying them effectively can attrack quite a bit of attention…

Thus one way to avoid these problems is find a realy hard substance, such as the glass in a photo frame. Tear of each sheet off the pad before you write on it and place it on the glass surface then write on it.

You will be quite hard pressed to leave any indentations on the glass. However it’s possible using ESDA techniques to show the pattern left on the glass in the residual static electricity (you can do this with laser printer toner dust). So when you have written on a sheet, remove it from the glass and use a soft cloth of silk or other static electricity related material to “wipe the glass down” immediatly, which destroys any residual pattern in the static charge.

Members of staff having framed pictures of their family / loved ones on their desk is fairly common, as is a cloth to wipe dust off of objects in a draw. Thus neither is particularly suspicious to have around, unlike a noisy shredder or ash tray full of burnt ashes and the air reaking of burning paper.

Clive Robinson • November 5, 2019 8:56 PM

@ Petre Peter,

Another reason why you should switch to an LCD

For what?

If you mean for your computer display, it won’t get you much.

The reason being it’s still the same cable carrying the image signal down to most display devices.

It’s the signal radiated from that computer to display cable that most attackers would go for by choice.

Clive Robinson • November 13, 2019 4:00 AM

@ Steve Russelle,

Nobody believes TEMPEST is a genuine threat.

Some of us do and have done for many decades.

I also know that a lot of the old advice about how to deal with it[1] such as suround yiur VDU with lot’s of other VDU’s is nearly compleatly pointless.

But times have moved on and TEMPEST is now a decreasing subset of the more rapidly growing EmSec field of endeavor. Not least of which is TEMPEST is “Pasive EmSec” whilst there are lots of interesting tricks with “Active EmSec” that I –probably amongst several other engineers– was independently investigating back in the 1980’s. One of which would now be called “Active Fault Injection Attacks via an EM carrier” using both CW and modulated carriers.

Then of course we now have the delight of all the “Over The Air” (OTA) systems with their myriad of faults, all clunked in way down the computing stack. Old examples of the “Evil Maid” type atacks on Firewire and USB are just the known tip of the iceberg.

One concern some of us “olduns” have is that the ICTsec industry appears to only live in the current moment. That is many practitioners appear not just to be “not learning from history” the appear to be more or less compleatly “unaware of history”. Thus “lessons learned” are now as if “they never happened”. Worse this lack prevents them looking into future to new instancrs of attack based on old classes of attack…

[1] Some old advice that used to be given was “drown it in noise” from other sources. It did not work back then and it certainly does not work today. The reason it was given was based on two assumptions,

1, Only one receiver in use.
2, The noise was random.

Neither of which was true back then nor is it true today. Two or more receivers enable you to phase shift the signals and thus gain advantage not just like a Very Long Baseline Radio Telescope in two dimensions but also in effect move the virtual antenna in three dimensions. You can find out how when looking at modern day equivalent found under MIMO. But also people are now begining to understand the difference between,

1, Determanistic noise.
2, Chaotic noise.
3, Pesudo random noise.
4, True random noise.

With modern IQ recievers such as the much mentioned SDR drvices, when precisely aligned in time and the fact they can record hours of very high resolution signals, backend procrssing alows analysis to strip off the first two types of noise, and thr third if not cryptographically produced. Thus the desired signal rises like Poseidon from the depths to be come clearly obvious. Building such receivers needs little more than a good quality antenna, a better quality SDR front end (LimeSDR make good value in that respect), an acurate time refrence (GPS 1PPS works) and a high end laptop or desk top computer with lost of fast storage.