TEMPEST and Emanation Security

Learning Objectives

1. Explain what electromagnetic emanations are and how they leak information
2. Use PortaPack Looking Glass for wideband spectrum survey
3. Reconstruct a VGA display signal using TempestSDR and HackRF
4. Understand HDMI emanation capture and CNN-enhanced recovery
5. Identify keyboard emanation signatures
6. Apply countermeasures and assess mesh network implications

Part 1: Emanation Theory (25 min)

Every electronic device radiates electromagnetic energy as a side effect of normal operation. Displays, cables, and keyboards all produce unintentional emissions that can be captured and reconstructed at a distance.

Van Eck phreaking (1985): Wim van Eck demonstrated that CRT display contents could be reconstructed from electromagnetic emanations at a distance, using inexpensive equipment.

How video emanations work: Display cables carry high-frequency signals (pixel clocks of 25-600 MHz). These signals radiate from unshielded or poorly shielded cables and can be received with a wideband SDR, then demodulated by synchronizing to the pixel clock, horizontal sync, and vertical sync.

Lab 1: Spectrum Survey (30 min)

Use the PortaPack H4M in Looking Glass mode for a wideband spectrum survey to identify emanation peaks from lab equipment.

1. Power on the HackRF H4M with PortaPack (Mayhem firmware from SD card)
2. Navigate to Looking Glass (wideband spectrum view)
3. Set range: 50 MHz - 500 MHz (covers VGA pixel clocks)
4. Turn on a VGA monitor connected to a test laptop
5. Identify the emanation peak -- note center frequency and bandwidth
6. Change the display content (white screen vs. text) and observe signal changes

Expected result: Visible peaks near the monitor's pixel clock frequency (typically 25-165 MHz for VGA).

Lab 2: VGA Reconstruction (35 min)

Reconstruct a VGA display signal using TempestSDR with HackRF tethered to a laptop.

1. Connect HackRF H4M to laptop via USB (tethered mode, not standalone)
2. Start TempestSDR:

   # Clone and build TempestSDR
   git clone https://github.com/martinmarinov/TempestSDR.git
   cd TempestSDR/JavaGUI
   make
   
   # Launch with HackRF backend
   java -jar JTempestSDR.jar

3. Set the target resolution (e.g., 1024x768 @ 60 Hz for VGA)
4. Tune to the emanation frequency identified in Lab 1
5. Adjust frame rate and resolution until the image locks
6. Move the HackRF antenna to find optimal reception angle and distance

Expected result: Recognizable (noisy) image of the target VGA display at 1-3 meters.

Lab 3: HDMI and deep-tempest (35 min)

deep-tempest (Correa-Londono et al., LADC 2024) uses a convolutional neural network to enhance noisy HDMI emanation captures. The CNN is trained on pairs of (noisy capture, clean original) to denoise and sharpen the reconstructed image.

# deep-tempest setup (requires Python 3.10+, CUDA recommended)
git clone https://github.com/emidan19/deep-tempest.git
cd deep-tempest
pip install -r requirements.txt

# gr-tempest for raw capture
# Build the GNU Radio OOT module for TEMPEST reception
git clone https://github.com/nash-pillai/gr-tempest.git
cd gr-tempest && mkdir build && cd build
cmake .. && make && sudo make install

Workflow: Capture raw IQ with gr-tempest, feed into deep-tempest CNN for enhanced reconstruction.

Keyboard Emanations (20 min)

Vuagnoux and Pasini (2009) demonstrated that wired and wireless keyboards emit detectable electromagnetic signatures for individual keystrokes, recoverable at distances up to 20 meters.

Key insight: Even encrypted wireless keyboards leak timing metadata. Emanations are a physical-layer attack that bypasses encryption entirely.

Countermeasures (20 min)

For most community mesh operators, distance and awareness are the practical countermeasures. Full TEMPEST protection is primarily relevant for high-security environments.

Mesh Implications (15 min)

TEMPEST attacks are relevant to mesh operators because:

• Encryption does not protect screen content -- AES-256 encrypts radio traffic, but what you display on screen radiates in the clear
• Air-gapped workflows are not immune -- a TAILS session on a laptop still emits video emanations
• Operational security must include physical-layer awareness -- where you read sensitive messages matters

Cross-references:

• Mesh Network Security -- encryption layers, threat modeling
• TAILS and Secure Communications -- 5-layer OpSec model
• Stealth Mode Guide -- reducing device RF signature

Equipment

Software

References

• Van Eck, W. (1985). "Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk?" Computers & Security, 4(4), 269-286.
• Kuhn, M.G. (2004). "Electromagnetic Eavesdropping Risks of Flat-Panel Displays." 4th Workshop on Privacy Enhancing Technologies.
• Vuagnoux, M. and Pasini, S. (2009). "Compromising Electromagnetic Emanations of Wired and Wireless Keyboards." USENIX Security Symposium.
• Correa-Londono, S. et al. (2024). "Deep-TEMPEST: Using Deep Learning to Eavesdrop on HDMI from its Unintentional Electromagnetic Emanations." LADC 2024.