|

TEMPEST Paper | | A brief look into the history and evolution of compromising emanations. | | Nicole King CIS 284s Winter 2013 | 2/1/2013 | |

Introduction

TEMPEST stands for “Telecommunications Electronics Material Protected From Spurious Emanating Transmissions”. It also is used to refer to security preventing any exploitation of vulnerabilities created by compromising emanations of electrical devices. Basically when electrical devices operate, they generate electromagnetic signals that can be intercepted and used to reconstruct sensitive information. “Listening” for these signals is known as “eavesdropping”. With the right equipment an eavesdropper can be hundreds of feet from the signal. This presents a real problem when a computer is processing classified information. The NSA (National Security Agency) has developed the TEMPEST standard which consists of several industry measurements to avoid such leakage. These computers have heavy metal cases, different power supplies and some additional modifications.

History

TEMPEST came about in 1918 by a man named Herbert Yardley. He and his Black Chamber staff were instructed by the U.S. Army to find ways to detect and exploit combat radio transmitters and telephones. Yardley determined that normal equipment was allowing secret information to be passed to the enemy via technical vulnerabilities. A program was then created to find ways to prevent the compromising emanations. Even though the initial project was not called TEMPEST (that term came about in the late 60’s or early 70’s) it became known by that term. Today, the term is obsolete. It has been changed to Emissions Security or EMSEC.

EMSEC involves designing circuits to limit compromising emanations. This includes shielding, bonding, grounding, radiation screening, alarms, and isolation devices. All of these methods work to reduce stray signals that could be reconstructed and analyzed.

TEMPEST Signal Types

RED Baseband Signals.-This, simplified, means reading a computer remotely. The proper definition is: “The most easily recognized CE is the RED baseband signal in attenuated but otherwise unaltered form, since it is essentially identical to the RED baseband signal itself. This emanation can be introduced into electrical conductors connected to circuits (within an Equipment Under Test) which have impedance or a power source in common with circuits processing RED baseband signals. It can be introduced into an escape medium by capacitive or inductive coupling, and especially by radiation with RED baseband signals of higher frequencies or data rates.”

Modulated Spurious Carriers. This, simplified, means that a signal changes either the amplitude or frequency of another signal. The proper definition is: “This type of CE is generated as the modulation of a carrier by RED data. The carrier may be a parasitic oscillation generated in the equipment, i.e., the chopper frequency of a power supply, etc. The carrier is usually amplitude or angle-modulated by the basic RED data signal. Or a signal related to the basic RED data signal, which is then radiated into space or coupled into Equipment Under Test external conductors.”

Impulsive Emanations. This means that something you are doing on the computer can be seen on a line or through the air. The proper definition is: “Impulsive emanations are quite common in Equipment Under Test's processing digital signal, and are caused by very fast mark-to-space and space-to-mark transitions of digital signals. Impulsive emanations can be radiated into space or coupled into Equipment Under Test external conductors.”

TEMPEST Signal Emission

There are four ways TEMPEST signals can escape. They are: Electromagnetic Radiation, Line Conduction, modulation of an intended signal (Fortuitous Conduction), and Acoustics. The following are definitions I found during my research:

Electromagnetic Radiation: Whenever a RED signal is generated or processed in equipment, an electric, magnetic or electromagnetic field is generated. If this electromagnetic field is permitted to exist outside of equipment, a twofold problem is created; first the electromagnetic field may be detected outside the Controlled Space (CS); second the electromagnetic field may couple onto BLACK lines connected to or located near the equipment, which exit the CS of the installation.

Line Conduction: Line Conduction is defined as the emanations produced on any external or interface line of equipment, which, in any way, alters the signal on the external or interface lines. The external lines include signal lines, control and indicator lines, and a.c. and d.c. power lines.

Fortuitous Conduction: Emanations in the form of signals propagated along any unintended conductor such as pipes, beams, wires, cables, conduits, ducts, etc.

Acoustics: Characteristically, plaintext processing systems are primarily electrical in function. However, other sources of CE exist where mechanical operations occur and sound is produced. Keyboards, printers, relays -- these produce sound. and consequently can be sources of compromise.

Equipment

Tempest standard for equipment is broken down into three main categories; Approval Type 1, Type 2 and Type 3. Type 1 is extremely secure and used for national security purposes. Type 2 is for unclassified cryptographic equipment used by U.S. Government Agencies. Type 3 is for unclassified commercial cryptographic equipment that implements an algorithm registered with the National Institute of Standards and Technology (NIST). It is used to protect sensitive information, like a corporation’s network communications. In order for equipment to be approved, the electromagnetic waves emitted by the device must have been reduced to a point where it would be extremely difficult for anyone to gather information from the waves. TSCM (technical surveillance counter measures) includes all countermeasures employed to prevent or detect the interception of sensitive, classified or private information. TSCM is typically an inspection by a technician or engineer of a physical item or place. This is necessary to locate possible covert surveillance devices, technical security weaknesses, and technical security hazards. There are companies who provide these services. More importantly, there are courses available to become a trained professional.
Legalities

A man named Wim van Eck published a white paper on electromagnetic eavesdropping. This brought a well-known hardware security vulnerability that existed in composite computer monitors out into the public eye. What van Eck presented is referred to as “Raster Analysis” or reconstruction of high bandwidth composite signals based on a repeating synchronization signal like radar and video. While van Eck’s engineering was valid, a lot of con-artists capitalized on it, selling pseudo-equipment. Raster Analysis eavesdropping products exist, however they are highly restricted and controlled. Any possession, attempted sale, attempted purchase or building of such a surveillance product or device is highly illegal. The “Omnibus Crime “Control Act of 1968” prohibits offering the pubic anything that is primarily used for covert surveillance. The U.S. Government takes all crimes pertaining to the exploitation of signal leakage or compromising emanations very seriously and will prosecute at the federal level for all crimes, intent, supplying parts or equipment, advertising, attempting to purchase or sell conspiracy or hoaxing of surveillance devices.
Conclusion

Personally, I am intrigued by the vulnerabilities presented in the documentation I reviewed. According to the information available, the threat of compromising emanations can only be reduced to a level of “extremely difficult for an attacker to gain information”. My determination is that the threat of information compromise cannot be totally eliminated; therefore no information that is processed electronically can be completely secure.

References

1. A History of U.S. Communications Security ; David G. Boak Lectures, National Security Agency, 1973, pp. 85-97 Retrieved from http://www.governmentattic.org/2docs/Hist_US_COMSEC_Boak_NSA_1973.pdf 2. http://www.sst.ws/tempest_standards.php 3. J. Loughry and D. A. Umphress. Information Leakage from Optical Emanations (.pdf file), ACM Transactions on Information and System Security, Vol. 5, No. 3, August 2002, pp. 262-289 4. http://cryptome.org/jya/nacsim-5000/nacsim-5000.htm 5. Kuhn, Markus G. (December 2003). “Compromising emanations: eavesdropping risks of computer displays” (PDF).