- Hi everyone, my name is Paz Hameiri
and I'll be talking about the project I'm working on
named Tempest Radio Station.
First allow me to introduce myself.
I've been developing hardware and software
for more than 30 years and I'm working as a system engineer
for more than a decade.
I started my professional career very early.
During my teen years, I cracked games
and develop software tools.
One of the software tools that I've developed
was called the Message Sticker.
And during Defcon25, Inbar has showed code
that he had coded to deactivate the Message Sticker.
He called his software Unpazz and Undefpazz.
Okay, so what is Tempest?
Tempest is a US NSA specification and NATO certification.
The acronym refers to information leakage from a system
through unintentional radio signals or audio signals
or electrical signals and so on.
In 1985, the researcher Will Van Eck
published the first unclassified analysis of the problem.
He analyzed information leakage from computer monitors,
but government researchers were already aware
of the problem.
The US army became aware that the equipment the army
is using during World War Two was emitting unintentional
electromagnetic waves.
And that these electromagnetic waves,
the unintentional electromagnetic waves are carrying
valuable data, classified data out of the device.
And since the '50s,
the NSA is developing specification and certification
for classified devices
in order to reduce these unintentional emissions
by grounding the equipment,
shielding the equipment,
separating different types of data lines and so on.
Okay.
How did they ended up doing that project name,
Tempest Radio Station?
Well, I read "TEMPEST@Home-Finding Radio Frequency
Side Channels" by Davidov Oldenburg.
They wrote about their experiments
transmitting electromagnetic waves from a computer
to a remote receiver,
50 feet away,
and they manipulated the GPU clock
to control the transmission.
And one of the most important thing that I found
in their work was, until then I thought
or I guess that the electromagnetic waves emission
regulation tests are preventing computers and cars
from the emitting much energy into the air.
And I was wrong.
Another thing I learned from their work was the use
of software-defined radio receivers or SDRs receivers.
These are cheap radio receivers.
The most common radio receivers of this type are generable
from almost zero to two gigahertz and they have really good
reception quality.
So I bought one and I study the electromagnetic emissions
generated by my laptop,
and I got very interested by this work.
And I started wondering, what can I do with it?
How far can I transmit data using these emissions?
And is it possible to transmit audio in real time
and above all how hard can it be?
So to figure it out,
I decided to start the Tempest radio station project
transmitting audio in real time using these emissions
and who knows how hard can it be?
So first I have a project then I need to define
the project goals.
The first goal was tunable frequency,
and this is very important because if there are a lot of
computers in a single area,
and I want to extract data from one computer,
I need to separate the data
it is transmitting from the other.
And perhaps I want to receive more than one computer
in the same area.
So I need to have a dedicated frequency per computer.
Very similar to radio stations.
Each radio station has its own frequency.
And the second reason for tunable frequency
is that if you can choose the frequency,
then you can find a quiet,
relatively quiet
frequency band with as little interference as possible
and transmit the data in that frequency band
and get a good signal to noise ratio,
which is important for reception.
Another goal for the probe for the project was maximum
bit rate to maximize the audio quality.
The third goal was innocent looking software to avoid
detection for obvious reasons and last but not least,
trying to achieve maximum distance.
Okay.
So let's begin with the crash course
about radio waves transmission.
When you take a conductor and you pass time-varying
electric current through it,
it will emit electromagnetic radiation that will propagate
from it to space
and reception works the other way around,
if an electromagnetic radiation is close to a conductor,
it will generate time varying electric current in it.
And this is the transmission
and reception of electromagnetic waves in a nut shell.
This could be done with any conductor,
it could either be wires or for this project,
PCB traces, PCB is the printed circuit boards
that carry the electric components inside the computers.
Traces are the fine wires within the PCB
that connect between the terminals
of the electrical components.
And that's radio waves crash course.
Another important thing to understand about broadcasting
is modulation.
Modulation is the manipulation that we do
on the carrier wave, the expanding electromagnetic waves
in order to make it carry the data that we wanted to carry.
Most of you probably heard about amplitude modulation
and frequency modulation,
which are the two common methods used by commercial radio.
But there other types of population,
the most simple type of modulation is the On-Off Keying,
you have an energy source,
you turn it on it emits energy, you turn it off,
stops emitting energy,
and you can put the data or encode the data
in the duration of the purse.
And if the transmitter and receiver has the same protocol,
then they can pass the data from one to another.
The most common and known On-Off Keying modulation use
is Morse code.
Morse code has only two symbols, short pulse
and the long pulse and you use those two symbols
to transmit the whole alphabet, words,
sentences and so on.
Okay.
So we understand that we can turn PCB traces
in the computers into a electromagnetic waves generators.
And we know that if we can take a line
and make it emit energy at our will
and control the duration,
and stop the line from emitting energy at our will.
Then we have On-Off Keying modulation.
Now we need to have such a signal.
Okay.
So the signals I decided to use where the signals
between the GPU and the GDDR,
the GDDR is the memory installed in the graphic cards
and the GPU perform memory read and write operations
by operating the control and data lines of the GDDR,
here you can see in this slide,
a tiny diagram of GDDR6 which is a common memory type list.
And there are four major lines that the GPU is operating.
The two signals in the upper side of the graph,
are CK and CA, CA is the commanding signal.
And the GPU use the commanding signals
to command the memory to do a right operation
or a read operation.
And CK is the clock of CA it helps the GPU
to command the memory.
Similar to that the two lower signals,
the data signal carries the data itself.
And WCK is the clock of the data.
Whenever the GPU is performing a write operation
or a read operation,
it operates these lines when it is not performing a read
or write operation, it is not operating these lines.
And this is the key to the On-Off Keying,
meaning that when we want to transmit the symbol,
we start a memory read and write.
And ration of the operation is predefined by us.
And when it ends, the energy stopped being transmitted.
Okay, let's talk about the duration of the pulse.
The electromagnetic radiation, as I explained,
is submitted when the control and data lines are active,
it is not emitted when it is not active.
So we need now to control the duration.
There is almost linear connection between the time
it takes to write a batch of bytes
and the size of the batch
of the bytes.
So if we have a small volume of bytes to write,
it will be a short operation.
If we have big volume of bytes to write,
then it will be a very long writing operation.
And that's the key to control the symbol length.
Whenever we are performing a memory transfer,
a symbol will be transmitted,
and the duration is predefined by the amount of bytes
that are going to be read than written
during the memory transfer.
As I explained,
the connection between similar duration
and similar bite count is almost linear.
This is because the GPU hardware is using dedicated
hardware to perform a large memory transfers.
And this dedicated hardware is time deterministic.
So to define the On-Off Keying protocol
between the transmitter and the receiver,
I need to predefine to both what is a symbol.
And I define the symbols in the following manner.
The symbol duration equals two symbol value plus one
multiplied by a time constant that both the transmitter
and the receiver know in advance,
the plus one helps me to avoid a zero duration
if I have a zero symbol value.
In order to transmit these symbols,
I need to transfer a known amount of bytes.
So the symbol transfer size,
which is relative to the symbol duration
equals symbol value plus one multiplied by a bytes constant.
And as I explain,
there is a linear relationship between the time constant
and the byte constant.
So if I do a very large memory transfer
measure the time it takes to perform the transfer,
then I get the ratio between bytes constant
and time constant.
And that's the whole story.
Here you can see it graphically,
in the upper graph you see the energy being emitted
for three different symbols,
in the lower graph you can see the relation
between the calculation I showed you
in the last slide and the amount of time it takes
to transmit each symbol.
Here, you can see, for example,
the symbol value five, you add one to it you get six,
six multiplied by time constant.
And this is the size of the symbol.
Again, you can see it for a symbol value three
and symbol value eight.
Why using the GDDR memory.
When I chose the GDDR memory,
I had good reasons following the project goals,
the first and most important
was that it has tunable frequency.
You can set the memory,
the GDDR memory frequency by APIs that are available.
It's very easy to do so and I did it.
The second thing was because the hardware
is very time deterministic and it helped me
build solid, good symbols,
which are transmitted and then received
and because it is very time deterministic
I can get the same results over and over offer
on different computers and different hardware.
And most of the time,
the GPU is idle because when it's not in use it's idle.
And when it is idle is not doing anything
and it's a free resource, then why not use it?
So I used it.
This is Scotty.
Scotty is the transmission software
it is installed in the stolen the computer
that is broadcasting the data, the audio,
on the top left, you see a GPU list.
And here you select the GPU that you want to use,
the graphical card that you want, the graphics card, sorry.
And below that you have two check boxes
to start the transmission.
The first one is for intelligence testing
and the other one is to transmit the Wi-Fi.
The name of the Wi-Fi is written in the line down
below and to the right of GPU list you see memory clock.
This is WCK, the data memory clock.
To its right you can see a divided value and the data value,
the data value is the value of the data
that is being written in the memory.
And you can see memory based clock.
This is CA the command clock,
the relationship between the memory clock
and the base clock is in this case four.
And the values here are relative to each graphic card.
The graphic card can tell you the type of memory
that it is installed inside the graphic card.
Then from the parameters, it gives you,
you can get these numbers,
below memory clock you see base clock shift.
This is the way that I'm moving the base clock
and tuning the base clock
to its right you can see a shift frequency
checkbox that command the Scotty to perform the frequency
shifts and to its right you can see the center frequency.
This is the frequency that Scotty is calculating by adding
the memory based clock to base clock shift.
And this is the result,
more important is the indicator below it,
which is called measured transmission frequency,
because this is the transmission frequency
that the GPU is measuring.
And this is the actual frequency that is carrying the data.
Below base clock shift you see two bit rate indicators,
the lower one data bit rate
is showing you the data bit rate, but only the data.
This is the pure data bit rate and the raw bit rate
equals to the data bit rate plus additional bits
that are used for control and monitoring
to build a data packet.
The last indicator is data transmitted in percentage
which is the percentage of the data
that was transmitted from the Wi-Fi.
Okay.
So what does Scotty do?
Scotty is doing the foreign tests,
it's measuring the time required
to perform loud GPU memory transfers.
It is calculating the bytes constant
for a predefined time constant,
which is predefined for both transmitter and receiver.
It is setting the GDDR memory clock frequency,
or broadcasting frequency,
and it is loading a wave file and transmitting 8,000 audio
PCM samples every second.
I targeted the CK clock,
the command clock as my main broadcasting frequency.
And this is why I'm referring to setting
GDDR memory clock frequency as setting
the transmission frequency.
Okay,
so we have the wave file and it is broken by Scotty
every second to a thousand audio PCM samples.
And then it is transmitting the 8,000 audio PCM samples
in one second intervals.
And first it is encoding the 8,000 audio PCM samples.
Then it is bundling the data into packets,
according to protocol to a protocol, sorry,
and the protocol comprises header bytes,
Read-Solomon forward error correction parity bytes
to for error-correction recovery at the receiver,
audio packets counter to count how many packets
were already sent and G.726 encoded audio bytes.
This is the real payload and audio data checksum bytes
to see that the data is valid at the receiver.
Scotty is transmitting each packet symbol by symbol,
and when all 8,000 samples have been transmitted,
the software stops and waits for the one second interval
to elapse.
Okay.
So Scotty is now transmitting the data to free space
and the electromagnetic waves are propagating in the area.
And the reason why we'll talk now about the radio path
or the wave path.
Scotty is transmitting the data from the computer,
which is seen on the left,
to the right side of the graph you can see of the chart.
You can see the reception equipment,
which comprises an antenna that converts the electromagnetic
waves to time varying current.
After that you can see LNA is amplified
that amplifies these weak signals,
and then an SDR receiver that receive the signals samples
the signals and passes the samples to a reception computer
that runs a software named Spock
that is extracting the data from the signals.
In the middle you can see a photograph
of this reception equipment.
Hear you you can see how CK, the wave,
the electromagnetic waves that are emitted from the CK
PCB traces is received 50 feet away
from the source computer.
You see here, power versus frequency band,
and you should expect for a fixed frequency,
fixed clock frequent
to see all the energy concentrated on a single frequency,
the clock frequency, as you can understand,
this is not the case.
The manufacturers are shifting the clock
in small portions up and down, up and down.
And in this graph,
it would be right and left, right and left,
and they are doing so to reduce the average power
per frequency.
And why is that?
Both cars manufacturers and computer manufacturers
has to pass electromagnetic waves, emission tests.
These emission tests are required
to get a regulation approval.
And if all of the energy would have been concentrated
on a single frequency, they might not pass the test.
The power might be too large
and pass the threshold of the test
and the car or the computer will fail the test.
To better prepare for these tests
the manufacturer are spreading the energy on a small
frequency event,
and this way they are lowering the average
power period frequency.
And by this method,
they are improving the chances
of passing the regulation tests.
And this is why the signal looks the way it is.
Okay.
So we spoke about Scotty.
Now let's speak about Spock.
Here you can see the screen of Spock, on the left top side,
you can see the SDRs list.
These are these as the receivers available on the computer
and below that you can see center frequency,
which is the frequency that you need to set to receive
the data, below that you can see to gain controls.
They are used to set the system game, the SDR system game,
and to get the best result you need to
tune all three of them,
the center frequency, the gain reduction and the LNA state.
Once you set the frequency and the system gang,
and you get good reception,
all you need to do is to check the play audio checkbox below
the system gain and hear the audio.
In the middle portion of the screen,
you see the sample versus time graph.
Here you can see the wave forms.
The samples are creating wave forms.
And here you can see two symbols
and shape of the wave forms is highly influenced
by this breathing technique I explained earlier,
the spread spectrum club generation,
that shifts the clock up and down
or the graph right and left.
And this is how it looks like overtime.
Below that you can see three check boxes
are used for debugging.
The most important of them is the clear numbers
on the right, because it is clearing the statistics
on the right.
And on the right side of the screen,
you can see all sorts of information,
which helped me develop the software and analyze the quality
of the reception.
You can see how many samples are for iteration,
how many good packets were received,
last packets that are lost and the good packets ratio,
which is important because it is indicating the quality
of the reception and other types of data.
Okay.
What is Spock doing?
Well, it is doing a lot.
Spoke is doing two batches of tasks.
The first batch of task is dealing with the samples,
the raw samples that are being picked up from the air
and analyzing and processing these signals
and getting the symbols out of the samples.
And the second batch of tasks is working with the symbols
to recover the data.
So let's speak about the first batch of tasks.
Spock is setting up the SDR receiver.
It is receiving psychic batches of samples
from the SDR receiver.
It is calculating the absolute amplitude of the samples.
Don't be intimidated.
There's a graph in the next slide explaining better,
and it is filtering the data with the low pass filter.
It is calculating the amplitude threshold
to recover the symbols.
And it is recovering the symbols using all of this data.
And it saves the length of each symbol,
the duration of each symbol in a buffer.
You can see it in the graph,
and I hope it will be much clearer.
At the top graph we see the absolute value of the samples,
and you can see the symbols here, power versus time.
And in the middle graph,
you see the filtered value and it looks much more like
digital data.
And in the lower graph, you see the digitized data,
the recovered symbols.
As I spoke earlier,
Spoke is doing two batches of tasks.
This is the second batch.
Now that it has the duration of each symbol,
it has the symbol value.
So it is looking for the header bytes, the header symbols,
if you recall,
each packet starts with header bytes
and when you have the symbols,
it starts with header symbols.
Once it found the header symbol,
it can recover the packet.
So it is recovering the data packet from the symbols,
and then it is using for error correction,
the coding to correct errors in the data, if any,
and afterwards it's verifying packet validity.
If the packet is valid, then it is decoding the audio
using a G.726 decoder.
And it is storing the PCN samples in a buffer.
If there are any missing packets, lost packets,
it is filling the PCM samples a buffer with zeros,
and then it is playing the other.
That's the whole circle between Scotty and Spock.
Let's talk about tests,
the first batch of tests that they did
had the following properties,
time constant was set to 14 microseconds.
The data packet structure was four header bytes,
20 Reed-Solomon forward error correction parity bytes,
a single audio packets counter, and 63 encoded audio bytes.
And I used two beats per PCM encoding,
fair PCM sample encoding and last but not least two audio
data checks and bytes.
Each packet was transmitted with four beats per symbol.
I took every byte divided into two nibbles
and transmitted four bits per symbol.
Here you can see the computers I use for the tests.
One was a laptop computer,
and one was a desktop computer.
You can see here the hardware of the two computers.
Here you can see the setup in my apartment,
on the left you can see the laptop computer on a table,
on the right you can see the reception equipment
and in the middle,
you can see the corridor inside the apartment.
And at one end, you see the laptop computer.
On the other end, you see the antenna.
Here you can see the same setup,
but for the desktop computer on the left,
you can see the desktop computer on the table,
on the right the reception equipment
and in the middle of the corridor with both sides.
Okay, let's see some tests.
Here you can see Scotty on a laptop.
It's in flight mode
and here it begins to transmit.
And now that you got a good sense of the raw bit rate time
working backwards through the reception equipment,
this is the reception equipment,
the antennae,
low noise amplifier and SDR receiver.
- [Announcer] Despite the striking fact
that most of the scientist that the world has ever known--
- Flight model of course.
And this is Spock.
- [Announcer] Scientific manpower is doubling every 12 years
in a rate of growth, more than three times,
that of our population-- - Lets clear the numbers.
- [Announcer] As a whole despite that best sketches
of the unknown
and the unanswered and the unfinished still far outstrip
our collective comprehension.
(static sound)
We chose to go to the moon in this decade
and do the other thing.
Not because they are easy,
but because they are hard because that goal
will fare to organize and measure the best of our energies
and skills, because that challenge is one
that we're willing to accept.
One we are unwilling to postpone
and one we intend to win and the other too.
(Audience claps)
- And that was the laptop.
This is the desktop, you can see raw bit rate.
And this is Spock.
- [Announcer] Scientific manpower is doubling
every 12 years in a rate of growth,
more than three times that about population as a whole,
despite that the best sketches of the unknown
and the unanswered and the unfinished
still far out step our collective comprehension.
(static sound)
We set sail on this new scene
because there is new knowledge to be gained
and new rites to be won, and they must be won a new
on the progress of all people.
- And that's the first batch.
Here are the test results.
I got a good audio and good the average bit rate
and I even got good packet ratio,
but I noticed something interesting.
I got on the desktop better ratio
when the monitor was turned off, then when it was turned on.
So I started to investigate this,
when examined,
the signals understood that the desktop computer
is the meeting signals, which Scotty did not generate.
And the computer stops transmitting these signals
once the monitor is turned off by the windows power plan.
So since I got better results with the monitor off,
I've decided to set the parameters,
the packet structure differently for a second batch of tests
and try to achieve better audio quality.
So I set the time constant to eight microseconds.
I used 4 Reed-Solomon forward error correction parity bytes
instead of 20 in the first batch.
And I used three bits first PCM sample and coding,
instead of two.
Let's see what I got.
This is the desktop of course.
And you can see a higher bit rate,
and this is Spock.
And as you can see, there are a lot of lost packets.
The audio quality is quite poor.
The reception quality is quite poor,
and this is because the monitor is still on.
So let's wait a few seconds to see how it will go
when the display will be off.
And this is with the display off.
You can see that the lost packets indicator has halted
and the good packets ratio is increasing
and we get good audio.
- [Announcer] The best man that's learned to use
the skins of animals to cover them.
Then about 10 years ago,
under this standard, man emerged from his caves
to construct other kinds of shelter.
- Clearing the numbers.
(static sound)
- [Announcer] Many years ago, the great British Explorer,
George Mallory,
who was to die on Mount Everest was asked,
why did he want to climb it?
He said, because it is there.
Well, space is there,
and we're going to climb it and the moon
and the planets are there,
and new hopes for knowledge and peace are there.
And therefore, as we set sail,
we have God's blessing on the most hesitant and dangerous
and greatest adventure on which man has ever embarked.
Thank you.
(Crowd applauds)
- It's a wonderful speech by JFK,
and I recommend you all to listen to it.
It's a great speech.
So these are the test results.
I got better audio and better bit rate
and better packet rate.
Then everything is great.
The whole project was designed around CK,
the command clock,
but it is important to remember that other signals
are being transmitted as well.
On the same time we have the four basic signals here,
but there are more derive the signals from these signals.
And there are a lot of signals being transmitted
at every symbol transmission.
So if you can't get your data on one frequency,
you might find it on different frequencies.
Let's see an example of that.
Here you can see the power versus frequency
of a signal which equals the command clock divided by two.
And you can see good power and here you can see that Spock
receives it well, we are at 99.6 good packets ratio.
The only difference you may see is in the wave forms,
the wave form of half of CK is different
from the wave form of CK.
And if you want to receive this signal instead of CK,
then you need to adjust Spock to process the samples
with this wave form to get the best results.
But as you can see,
this was not handled or tampered in any way
and it's just gives good reception.
Okay.
So let's talk about conclusions.
The first are fun conclusions.
First it works.
Yay.
The second conclusion is that my apartment is too small
for the range tests.
I had enough power I could have gone further,
but that's the length of the corridor.
So that was it for me.
And they got so excited that I've made the jingle
for Tempest Radio Station.
Let's hear it.
♪ Tempest Radio ♪
That is the jingle,
but let's talk about more alarming conclusions.
First, timed memory transfers are easy to produce.
It's only memory transfers and you can leak data
just like you can leak audio because as you saw,
the audio was already digitized,
they could have passed any other pillow that I could choose.
You can use this method on air-gap computer.
You look at an air-gap computer.
It doesn't have any radio based communication channel,
but if it has the GPU,
then you can use this method to get the information
out of it.
And this is most important during non-working hours
because the GPU is either, there is no supervision,
the monitor can be turned off to achieve maximum bit rate
either by the attacker or by the companies,
the IT policy and the attacker
can choose the time of transmissions.
For example,
it can hide the reception equipment in the parking lot
and choose the data to be transmitted from 9:00 PM
till midnight, and get the data.
Everything I spoke about is not supervised by any software,
not by antivirus, firewalls, port monitoring, software,
whatever.
And this is important not only to, for example,
extract plans and design from internal networks,
you can also do it on open networks,
networks that are connected to the internet
because nobody's monitoring this channel.
It's an open channel.
And since nobody is monitoring,
you can pass whatever you want.
And as long as you can hide the reception equipment
and get the data out, you can enjoy Tempest Radio.
Thank you very much for watching,
here are the links to the source code on GitHub
for both Scotty and Spock.
And here you can see the references from my work.
Thanks again.
And I hope you enjoyed it.