Re: About TEMPEST

From: Berke Durak (obdk32768_at_ouvaton.org)
Date: 06/13/04


Date: Sun, 13 Jun 2004 19:45:47 +0000 (UTC)

On 2004-06-13, David Wagner <daw@taverner.cs.berkeley.edu> wrote:
> But here is some speculation on what NONSTOP might be, from a
> crypto mailing list:
> http://www.mail-archive.com/cryptography@c2.net/msg04493.html
> http://www.mail-archive.com/cryptography@c2.net/msg04502.html
> See also the following NSA document about TEMPEST for some
> mentions of NONSTOP and some other interesting tidbits:
> http://cryptome.org/tempest-2-95.htm
> See also JoelM's TEMPEST page for some further speculation:
> http://www.eskimo.com/~joelm/tempestintro.html#HIJACK

Thanks, I already did read those except for Reinhold's message.
I will try to summarize.

Phenomena
---------

P1.Modulation of black signals by red signals.

P2.Illumination of red equipment to induce modulation
of the illuminating signal with red signals.

P3.Near-field magnetic emissions from RED equipment
escape the Faraday cage and induce modulation of communication
signals outside, but near the cage.

P4.Optical, acoustic or thermal emissions. However any reasonable
kind of shielding room would protect agaisnt those.

P5.Physical effects not known in the mainstream, such as
curl-free modulation of the A field.

P6.Power line modulation

Hypothesis 1
------------

P1 = HIJACK, P2 = NONSTOP. P3 = still classified or negligible in
practice or easily defended against or incorporated into HIJACK.
P4 = maybe still classified but easily defended against. P5 = non
existent, unknown or heavily classified. P6 = trivial and doesn't
need a codeword.

This seems to be the mainstream position.

Hypothesis 2
------------
H2. P5 = NONSTOP. P1,P2 = HIJACK.

This position is motivated by Joel's assertion that :

  HIJACK is a classified codeword that apparently relates to a form of
  compromising emanations, but involves digital versus electromagnetic
  signals. An attack is similar in nature to a TEMPEST attack, where the
  adversary doesn't need to be close to the device that's being
  compromised. It does require access to communication lines (these can
  be wire or wireless). The adversary uses antennas, receivers, a
  display device, a recording device, and one additional piece of
  equipment (a special detection system that is supposedly very
  sensitive and very expensive; and there are not very many of them in
  existence - sorry, I don't have any other details). Also, the
  technician using this special equipment will supposedly require a
  great deal of training and experience.

If we are to believe this, what then is the "very special" piece of
receiving equipment ? Joel talks of antennas, which might include
a microwave illuminator, or maybe even a MASER. Why would one need
a very special receiver for this ?

I don't really buy that illumination-by-MW idea either. Sure, we all
know the soviets illuminated a hollow cavity concealed in a gift with a
MW beam, the cavity being modulated by acoustic waves, resulting in a
modulation of the beam. And I bet you can illuminate a keyboard to get
signals at a distance, too. (Maybe even by satellite ?)

However these NONSTOP and HIJACK things deal mostly with shielded
facilities, right ?. How would planar waves penetrate such a room ?
Unless they are sending gamma or X-rays, they would have trouble.
See this :

  Mid-1970s Polish intelligence is caught by KGB intercepting power line
  emanations from military building in Moscow; Soviet cipher machines
  determined by KGB to be vulnerable to HIJACK attacks until replaced
  with steel enclosures with noise generators(causing interference to
  televisions as far as 1 mile away) and clean motor generators.

So maybe HIJACK = P6 ? This seems to be corroborated by the fact
that the terms "power line modulation" appear exactly once in
(redacted) NACSEM 5202 in a place where it feels like it should
have been redacted.

  Machines also determined to be vulnerable because of recent KGB
  breakthroughs in flooding intercept technology methods that included
  use of X-rays and radioactive isotopes.

Maybe by injecting isotopes into US communication officers and then
flooding the room with X-rays, by some physical process, plaintext
signals modulate scattered or transmitted X-rays ? Counter-measure :
lead.

Now I must stress out that I'm no physicist either. I barely understand
Maxwell's equations. However, I feel there is some nasty "conceptual
jamming" around things like the A field, the Ahoronov-Bohm effect, and
so on. I feel that there is a greater-than-usual number of lunatics
and semi-lunatics ranting about those subjects. Of the "national
security topics", TEMPEST is certainly well connected to theoretical
electromagnetics.

My suggestion is that : maybe the illumination is not done with usual planar
waves, but by twiddling with the magnetic field in some other way.
Gravitational waves, maybe ? That starts to be wild. But the AB effect
is a good candidate I think.

Can someone literate in TEMPEST stuff and who understands those physical
subjects enlighten us ?

-- 
Berke Durak


Relevant Pages

  • United States Patent 5,159,703
    ... with silent sounds, ... low or very high audio frequency range or in the adjacent ultrasonic ... ultrasonic frequency spectrum said signals modulated with information ... The type of modulation may be any type suitable for subliminal ...
    (sci.logic)
  • Re: Redshift without expansion
    ... Modulation and polarisation are entirely different ... be able to see anything except for unmodulated signals. ... when in fact it remains an analogy. ... different speeds. ...
    (sci.astro)
  • Re: The AC-30 Tremolo/Vibrato Sound
    ... Note that "vibrato" in this context is a bit of a misnomer, ... Clearly either channel gets enhanced by a positive swing ... and phase response-- not the actual amplitudes of the signals. ... modulation of the preamp signal from P1, which is the flatter of the ...
    (alt.guitar.amps)
  • Re: time shift between two sine waves
    ... compared the phases of the modulation on the send & return signals. ... They used a low frequency sine wave modulation to determine the coarse ... length difference between the direct & ground bounce paths. ...
    (comp.dsp)