Reviving TEMPEST Attacks With An Injected Signal

TEMPEST attacks are often the most effective way to break air-gapped security: rather than directly accessing a computer, the attacker records the system’s unintended radio emissions and uses them to reconstruct its internal operations. This kind of attack was much more effective in the days of noisy, high-voltage CRT displays, and has gradually become less effective as electronics migrate to quieter, less powerful components. A group of researchers, however, has found that even modern electronics can become effective TEMPEST transmitters when irradiated with an RF signal.

The RF a device emits depends on the unintentional antennas in its internal structure. These are difficult to eliminate, and it’s usually not worth the effort; they’re usually small enough that they only effectively radiate at much higher frequencies than the electronics carry. The researchers’ technique, called InjectEave, radiated these electronics with a radio frequency tuned to their internal antennas, injecting that frequency into the circuit. Nonlinear electronic components, such as amplifiers, then mix the injected frequency with the internal signal, creating RF sidebands. This mixed signal then radiates out of the device and can be picked up and demodulated to recover the device’s internal signal.

In principle, almost any semiconductor device will perform mixing to some extent; in testing, the researchers had success with an amplifier, analog-to-digital converter, power converter, and switching MOSFETs, but detected no significant emissions without an injected signal. For a portable setup, the researchers used a USRP B210 SDR for transmission and a spectrum analyzer to demodulate the received signal.

This was able to recover audio from wired headphones, wireless headphones, and a wireless landline, and detect the state of a smart lamp and a smart fan. All of this worked over short distances, even through walls, and with a power amplifier, the range increased to 30 meters. Even with multiple devices present, they could focus on one by tuning the injection frequency to resonate with its internal antennas. Perhaps most impressive (or concerning) was a demonstration with the VoIP phone: the researchers were able to listen in on the person speaking, clone that person’s voice, synthesize new speech in that voice, and remotely inject it onto the phone call, altering the call in real time.

If the history of these attacks is any guide, it won’t be too long before we see an open-source implementation of this technique; we’ve already seen a few approaches to traditional TEMPEST. This kind of unintended nonlinear mixing can also be used to find bugs or electronics.