18
$\begingroup$

Is it possible to deduce the software being run and its uses by listening to the magnetic, electromagnetic, and acoustic signals released by its operation?

Computers generate minute acoustic noise, variations in magnetic fields, and electromagnetic waves during operation. Typically much of this 'noise' is absorbed by the case and components. If you could build a probe able to bypass this shielding, could you deduce the software being run by a given computer (say if Microsoft Word is being run) and how that software is being used (say the contents of a Word document)? How small would these sensors have to be?

$\endgroup$
13
  • 1
    $\begingroup$ I have a poorly shielded aux cable in the car and can hear my daughters iPhone in the passenger seat doing things. You may be on to something .., $\endgroup$
    – Willk
    Apr 18 at 3:17
  • 2
    $\begingroup$ VTC.. multiple questions.. and I also doubt WB is the appropriate place to ask things about accessing MS-Word sessions without a network cable. $\endgroup$
    – Goodies
    Apr 18 at 13:46
  • 2
    $\begingroup$ Ok my tips: for Stack Exchange questions, see you have ONE question. Remove the "how small" part (=unanswerable) and specify the computer, the distance from the computer, the device you use to detect EM waves and the software you would like to detect. Then, copy-paste the thing to StackExchange - SuperUser $\endgroup$
    – Goodies
    Apr 18 at 14:15
  • 7
    $\begingroup$ My anecdote is that, as a professional computer tech, I was able to diagnose PSU, fan, HDD, and other issues just by putting my ear to the case and listening to what was going on. There's no way I could hear if a virus or Office was running, but there was plenty of other things to hear that were caused by software, including a PSU that static-y-beeped when the mouse scroll wheel was used. IDK why that happened, but the beeps only stopped after replacing the PSU. Fan speeds are often an indicator of high resource use, but not which specific process is using them. $\endgroup$ Apr 18 at 17:06
  • 2
    $\begingroup$ Please take a look at this attack: hackaday.com/2013/12/20/… $\endgroup$
    – abukaj
    Apr 19 at 14:44

7 Answers 7

46
$\begingroup$

Yes, you absolutely can.

These are known as side-channel attacks and are a thriving field of study at the moment. Side-channel attacks are all about deducing the computer's internal workings (what it has in memory, or the calculations it's performing) by examining different side effects of its operation.

Sounds and electromagnetic fields can be analyzed to give indications of what parts of the computer are drawing power (power-monitoring attacks) - which can tell you if a calculation is limited by CPU, GPU, memory, cache, etc. and give you an idea what class of calculation it is.

Outputs such as monitor cables can be examined to see if there is any electromagnetic leakage; this can be used to read data straight off the cable which (with a little guesswork as to the encoding) gives you whatever was being sent to the monitor, similar to van Eck attacks. You can also spy on the electromagnetic output of, say, a bus on the motherboard shuffling data into and out of memory.

$\endgroup$
10
  • 3
    $\begingroup$ Agreed. I've not worked on anything relating to sound. But I have worked on software that tried to infer what programs were active using some other approaches. I would consider doing this with sound very difficult for sure, but certainly well within the realm of possibility. The attacker would likely have to have some profile information about the machine already, since every machine would be different. But if I saw this in a movie, it would not threaten my suspension of disbelief. $\endgroup$ Apr 18 at 4:55
  • 4
    $\begingroup$ @GrandmasterB I'm picturing a spy outside some government office with a laser microphone aimed at the window stealing a password by hearing which keys are being typed. Seems like a cool idea for a Mission: Impossible scene. $\endgroup$
    – Ryan_L
    Apr 18 at 5:10
  • 5
    $\begingroup$ I was at seminar by Daniel Genkin (see that side-channel attacks link), and he basically showed an attack using a sausage (!) not even a microphone. The attack works by sendind a bunch of email messages and learning private key bits from the cpu noises. $\endgroup$
    – dEmigOd
    Apr 18 at 11:45
  • 2
    $\begingroup$ @GrandmasterB There's quite a few attacks known on typing using sound. That's much easier than using sound for CPU/GPU monitoring (I think that's gonna be hard since the fans generally make way too much noise) but maybe. $\endgroup$
    – DRF
    Apr 18 at 12:41
  • 2
    $\begingroup$ This has been a serious concern for many decades: en.wikipedia.org/wiki/Tempest_(codename) $\endgroup$
    – John Doty
    Apr 18 at 22:23
17
$\begingroup$

I remember years ago seeing on some TV program that a research group was able to reproduce what a CRT connected to a computer was showing by intercepting the electromagnetic noise produced by it. Modern displays are probably less noisy, but still use electronics, so I guess the principle still applies.

I remember also reading that it's is possible to train a software to recognize what somebody is typing on a keyboard just by listening to the typing sound, because each different key gives out a very recognizable sound. To exploit this feat you don't necessarily need a microphone inside the room, sometimes a laser pointed on the glasses of the room where the typing is taking place is enough to detect the sound induced vibrations on the glass itself.

$\endgroup$
2
  • 5
    $\begingroup$ Your first point about CRT eavesdropping is probably referring to the work of Wim van Eck, who made several demonstrations of that type of attack. $\endgroup$
    – Cadence
    Apr 18 at 4:42
  • 3
    $\begingroup$ Reproducing the image displayed by a primitive computer (such as my flimsy Romanian clone of a Sinclair ZX80) on a second TV set did not require any "research group". It was a common (and unwanted) occurrence which bit many of us in the good old days. $\endgroup$
    – AlexP
    Apr 18 at 8:52
16
$\begingroup$

Consider Acoustic Cryptanalysis.

Keyboard Acoustic Side Channel Attacks are a good one... reconstructing likely keypresses from the noise of buttons being pressed on a keyboard. Anything capable of picking up audio frequencies will be just fine, and there's an entire decades old industry dedicated to snooping on people talking and literally any of those device will do. Modern microphones can be the size of a fingernail or a section of pencil lead. Things like laser microphones or particulate flow detection microphones are rather larger, but you can set them up remotely to observe a target, and could potentially work on electromagnetically shielded devices if they weren't also in a well soundproofed location.

You need to use machine learning to build up a model of the keyboard being used and the typing style of the target... changing devices and typists can confound this to some degree, but you can keep recording audio and the more you have the better you'll get at working out what people are typing.

This of course doesn't tell you what people are reading, but only the notes/responses they're typing. Consider though that you could create a separate computer worm with the intent of getting it transferred onto an air-gapped network or computer by a careless (or malicious) employee and an infected storage device (eg. USB stick) which would generate audio signals that were out of the range of human hearing, but detectable by your audio bugs.

But, I'm assuming you're going to say, what if there's no audio device on the PC?

Turns out electronic equipment is hella noisy, and people have done all sorts of clever things merely by listening to the audio-frequency noises emitted by various electronic components. Consider RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis:

Many computers emit a high-pitched noise during operation, due to vibration in some of their electronic components. These acoustic emanations are more than a nuisance: they can convey information about the software running on the computer and, in particular, leak sensitive information about security-related computations. In a preliminary presentation, we have shown that different RSA keys induce different sound patterns, but it was not clear how to extract individual key bits. The main problem was the very low bandwidth of the acoustic side channel (under 20 kHz using common microphones, and a few hundred kHz using ultrasound microphones), many orders of magnitude below the GHz-scale clock rates of the attacked computers.

Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away.

Beyond acoustics, we demonstrate that a similar low-bandwidth attack can be performed by measuring the electric potential of a computer chassis. A suitably-equipped attacker need merely touch the target computer with his bare hand, or get the required leakage information from the ground wires at the remote end of VGA, USB or Ethernet cables.

So there you have it. With 2014-era technology, you could do this trick with a mobile phone. The brains of a modern smartphone without the big screen (and without the screen the battery size can shrink right down) will do the job for you just fine, just so long as you can get it close enough.


Not interested in audio signals? There's plenty of electromagnetic options, but I don't go into all of them here.

I will raise van Eck phreaking as a classic example, which does work on LCD displays as well as old-school CRTs, a detail that some of the other posters here have missed. Its range is limited, and whilst the radio antennae required needn't be very large you do need a reasonable capable computer in order to do the decoding for you. Of course, everyone carries a "reasonably capable computer" in their pockets nowadays. The lower the screen resolution and the longer the cable connecting the signal source to the screen, the easier the attack. This means that eg. iPhones are rather less vulnerable than a decade old government desktop PC.

$\endgroup$
5
$\begingroup$

Only in extremely limited circumstances

First, humans can only hear sounds, they cannot hear magnetic fields or electromagnetic waves.

Second, solid-state disks, which are very popular these days, have no moving parts and thus generate no noise. SSDs are common in laptops and other portable devices. Platter-based disks do have moving parts, but you're probably only going to find those in desktop computers.

Third, platter-based disks generally only make audible noises when the read head has to move around a lot. So, if the data for a program or large data file is very fragmented, a human may actually be able to hear the drive accessing the data. And if this happens frequently, the human may even learn to recognize the particular file.

But, the sounds will become unrecognizable if basically any of those particulars change:

  • if the files get defragmented
  • if the drive is replaced, even with an identical model
  • possibly if the drive controller (motherboard) or CPU changes

And also, the sounds will be unrecognizable if the computer performs any other operations on the same drive while reading the other file. So, if we imagine that Photoshop is a giant program that happens to be very fragmented on this computer, and the user opens Photoshop a dozen times a day for weeks, they may learn to recognize the sound. But if they run a virus-scanner today while opening Photoshop, the movement in the drive will be different, resulting in entirely different sounds.

$\endgroup$
5
$\begingroup$

Another side to it is that it was considered in the early days as a debugging tool. In fact at least one early machine (either Pilot Ace or Manchester Baby, so around 1950) was fitted with a connection from the logic to a small loudspeaker, so that you could tell what it was doing ... a regular buzz was a strong hint that it was stuck in an infinite loop.

Didn't take long for a bright intern (Christopher Strachey as it happens) to figure out how to abuse this diagnostic aid to play "God Save the Queen" at the end of a successful run, and computer music was born...

$\endgroup$
2
  • $\begingroup$ Google for "music on dot matrix printer". $\endgroup$
    – gnasher729
    Apr 19 at 9:45
  • $\begingroup$ It was used to produce early sound effects for gaming, such as on the TRS-80. The movement of sprites produced noises that could pass for engine and gun sounds. $\endgroup$
    – barbecue
    Apr 20 at 19:45
5
$\begingroup$

The general term for this sort of thing is a side-channel attack, but more specifically what you're after is known as a TEMPEST attack. These have been around since at least as far back as the 1950's, although since this was classified military stuff it's hard to get an accurate timeline. Fortunately there has been a lot of public and amateur development since then, so we have some things to refer to.

In 1985 Wim van Eck published details on a method he'd developed for 'eavesdropping' on a computer monitor using $15 worth of electronics and a television, the first TEMPEST-style system I was able to find (in an admittedly brief period of searching) outside of military or intelligence agency remit.

Since then there have been plenty of other examples of public TEMPEST hacks: several methods for remotely reading keyboards, key stealing from RSA and ElGamal with cheap hardware, and even Elliptic Curve Cryptography isn't safe.

Of course there are ways to defend against this sort of thing, which is why there are several generations of TEMPEST shielding specifications. Heck, there are even fonts specifically designed to make it harder to decode EM from a CRT monitor. Which is pretty cool, when you think about it.

$\endgroup$
1
  • 1
    $\begingroup$ TEMPEST "known as emission security (EMSEC), which is a subset of communications security (COMSEC).[5] The NSA methods for spying on computer emissions are classified," $\endgroup$
    – Mazura
    Apr 18 at 23:37
5
$\begingroup$

In the 70's I used an Adage Graphics Terminal (30-bit, one's complement machine with analog 3D graphics) that had a huge disk drive cabinet about half the size of a refrigerator, containing 2 removal disk packs. The clicks of the disk seek mechanism were quite loud. The O/S and FORTRAN compiler used overlays extensively, since there was only 16KB of memory, and there was a tremendous amount of disk seeking during any compile. But you soon learned to recognize the rhythm of the compiler's I/O, and it was typical to start a compile, do some manual desk work, and let your subconscious alert you when the compilation was almost finished, just by recognizing the progressions of familiar sounds and rhythms from the drive.

$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .