<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>
<channel>
	<title>Comments on: Video eavesdropping demo at CeBIT 2006</title>
	<atom:link href="http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/</link>
	<description>Security Research, Computer Laboratory, University of Cambridge</description>
	<pubDate>Sun, 06 Jul 2008 12:09:19 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.5.1</generator>
		<item>
		<title>By: alex</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-28146</link>
		<dc:creator>alex</dc:creator>
		<pubDate>Sun, 24 Feb 2008 15:00:22 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-28146</guid>
		<description>What do you think about this nice russian protection device:
http://www.npoanna.ru/Content.aspx?name=models.sonata-r2
you can translate using google
Are there any alternatives made in USA and public availalb esay on ebay ?</description>
		<content:encoded><![CDATA[<p>What do you think about this nice russian protection device:<br />
<a href="http://www.npoanna.ru/Content.aspx?name=models.sonata-r2" rel="nofollow">http://www.npoanna.ru/Content.aspx?name=models.sonata-r2</a><br />
you can translate using google<br />
Are there any alternatives made in USA and public availalb esay on ebay ?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: F. Kreutzer</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-23681</link>
		<dc:creator>F. Kreutzer</dc:creator>
		<pubDate>Tue, 21 Aug 2007 13:04:17 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-23681</guid>
		<description>Da ich ihrem namen entnehme das sievermutlich eutscher abstammung sind habe ich mal auf deutsch gepostet

Müsste mon soetwas ähnliches nicht auch mit tastaturen funktionieren da diese durch ihre architektur auch wie eine antenne wirken oder ist das signal schlicht und ergreifend zu schwach ?

P.S. was ksotet die oben gzeigte apparatur ?</description>
		<content:encoded><![CDATA[<p>Da ich ihrem namen entnehme das sievermutlich eutscher abstammung sind habe ich mal auf deutsch gepostet</p>
<p>Müsste mon soetwas ähnliches nicht auch mit tastaturen funktionieren da diese durch ihre architektur auch wie eine antenne wirken oder ist das signal schlicht und ergreifend zu schwach ?</p>
<p>P.S. was ksotet die oben gzeigte apparatur ?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Michal</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-21632</link>
		<dc:creator>Michal</dc:creator>
		<pubDate>Sun, 22 Apr 2007 21:58:32 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-21632</guid>
		<description>This is really scary. Hopefully they'll do something in order to prevent such "attacks".</description>
		<content:encoded><![CDATA[<p>This is really scary. Hopefully they&#8217;ll do something in order to prevent such &#8220;attacks&#8221;.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Akkerfeld</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-2057</link>
		<dc:creator>Akkerfeld</dc:creator>
		<pubDate>Sat, 23 Sep 2006 19:31:29 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-2057</guid>
		<description>Very impressive job Markus.
Just out of curiosity how much would this "cheap" equipment cost?
I checked on the net and the R1250 receiver isn't really available to the public.
Thanks.</description>
		<content:encoded><![CDATA[<p>Very impressive job Markus.<br />
Just out of curiosity how much would this &#8220;cheap&#8221; equipment cost?<br />
I checked on the net and the R1250 receiver isn&#8217;t really available to the public.<br />
Thanks.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Lars Friedrichs</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-1728</link>
		<dc:creator>Lars Friedrichs</dc:creator>
		<pubDate>Sun, 10 Sep 2006 12:09:43 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-1728</guid>
		<description>@Rob: 
Nobody said it would be a new technology. Actually this kind of attacks has a long history beginning in the 1970s.
But what is relatively new in our attack is the price of the eavesdropping system. By this time only very expensive systems show a reasonable (=readable) result. Everybody knew there is a problem in security, but it was thought to be unrealistic to exploit since the cost whould be too much.</description>
		<content:encoded><![CDATA[<p>@Rob:<br />
Nobody said it would be a new technology. Actually this kind of attacks has a long history beginning in the 1970s.<br />
But what is relatively new in our attack is the price of the eavesdropping system. By this time only very expensive systems show a reasonable (=readable) result. Everybody knew there is a problem in security, but it was thought to be unrealistic to exploit since the cost whould be too much.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Robert Lemos &#187; Blog Archive &#187; So that&#8217;s what you&#8217;re looking at&#8230;</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-1389</link>
		<dc:creator>Robert Lemos &#187; Blog Archive &#187; So that&#8217;s what you&#8217;re looking at&#8230;</dc:creator>
		<pubDate>Mon, 28 Aug 2006 18:51:25 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-1389</guid>
		<description>[...] As he mentions on his blog, security researcher Markus Kuhn demonstrated the technology, creating a replica of the image shown on a monitor by reading the signals from a computer more than 75 feet away. Marcus gave a paper on this topic at the IEEE Security and Privacy Conference in Berkeley nearly 4 years ago, and it&#8217;s nice to see a working demo of the device, if virtually. [...]</description>
		<content:encoded><![CDATA[<p>[...] As he mentions on his blog, security researcher Markus Kuhn demonstrated the technology, creating a replica of the image shown on a monitor by reading the signals from a computer more than 75 feet away. Marcus gave a paper on this topic at the IEEE Security and Privacy Conference in Berkeley nearly 4 years ago, and it&#8217;s nice to see a working demo of the device, if virtually. [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rob</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-1314</link>
		<dc:creator>Rob</dc:creator>
		<pubDate>Sat, 26 Aug 2006 15:15:46 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-1314</guid>
		<description>This is not news or new technology. Iit has been around for many many years and has been used by governments agencies all around the world.</description>
		<content:encoded><![CDATA[<p>This is not news or new technology. Iit has been around for many many years and has been used by governments agencies all around the world.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Markus Kuhn</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-381</link>
		<dc:creator>Markus Kuhn</dc:creator>
		<pubDate>Thu, 20 Apr 2006 09:40:06 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-381</guid>
		<description>The COVISP is certainly a specialized example of what is now called a "software radio" or "software defined radio" design.

I had a look at various SDR-frontends designed for HAMs, but all the ones I found so far have IF bandwidths designed for PC audio cards, which is three orders of magnitude narrower than what you need for a video signal. Suitable commercially available SDR tuners with at least 20 MHz BW tend to come so far from military suppliers. The HAM-SDR community is already growing beyond the use of soundcards (e.g., &lt;a rel="nofollow" href="http://comsec.com/wiki?UniversalSoftwareRadioPeripheral"&gt;GNU Radio&lt;/a&gt; uses a 6 MHz IF BW cable-TV tuner), and it is surely only a matter of time until they also start to play with 20–50 MHz bandwidths.

If you are interested, there is a more detailed analysis of the spectral composition of a video signal in Section 3.2 of my &lt;a rel="nofollow" href="http://www.cl.cam.ac.uk/TechReports/UCAM-CL-TR-577.html"&gt;thesis&lt;/a&gt;.

You are right that &lt;em&gt;in theory&lt;/em&gt; you can extract a video signal from an antenna signal using merely periodic averaging. A periodic (85 Hz) video signal will have a comb spectrum where all spectral energy is located exclusively at multiples of 85 Hz (assuming an infinitely long periodic signal), and the entire video-baseband spectrum is repeated throughout the spectrum at intervals that correspond to the pixel clock frequency. The periodic averaging is nothing but a comb filter that attenuates all frequencies in the spectrum that are not a multiple of 85 Hz, thereby eliminating all other noise sources.

I tried several times to connect an AD converter directly to an antenna amplifier for periodic averaging, but I found that in practice you get very bad results this way. You always need some form of analog preselection before you can digitize an antenna signal. There is simply way too much energy across the entire ADC input band for averaging to become effective. The frequency selectivity of a wideband receiver does in practice offer a dramatic improvement of the achievable signal quality.</description>
		<content:encoded><![CDATA[<p>The COVISP is certainly a specialized example of what is now called a &#8220;software radio&#8221; or &#8220;software defined radio&#8221; design.</p>
<p>I had a look at various SDR-frontends designed for HAMs, but all the ones I found so far have IF bandwidths designed for PC audio cards, which is three orders of magnitude narrower than what you need for a video signal. Suitable commercially available SDR tuners with at least 20 MHz BW tend to come so far from military suppliers. The HAM-SDR community is already growing beyond the use of soundcards (e.g., <a rel="nofollow" href="http://comsec.com/wiki?UniversalSoftwareRadioPeripheral">GNU Radio</a> uses a 6 MHz IF BW cable-TV tuner), and it is surely only a matter of time until they also start to play with 20–50 MHz bandwidths.</p>
<p>If you are interested, there is a more detailed analysis of the spectral composition of a video signal in Section 3.2 of my <a rel="nofollow" href="http://www.cl.cam.ac.uk/TechReports/UCAM-CL-TR-577.html">thesis</a>.</p>
<p>You are right that <em>in theory</em> you can extract a video signal from an antenna signal using merely periodic averaging. A periodic (85 Hz) video signal will have a comb spectrum where all spectral energy is located exclusively at multiples of 85 Hz (assuming an infinitely long periodic signal), and the entire video-baseband spectrum is repeated throughout the spectrum at intervals that correspond to the pixel clock frequency. The periodic averaging is nothing but a comb filter that attenuates all frequencies in the spectrum that are not a multiple of 85 Hz, thereby eliminating all other noise sources.</p>
<p>I tried several times to connect an AD converter directly to an antenna amplifier for periodic averaging, but I found that in practice you get very bad results this way. You always need some form of analog preselection before you can digitize an antenna signal. There is simply way too much energy across the entire ADC input band for averaging to become effective. The frequency selectivity of a wideband receiver does in practice offer a dramatic improvement of the achievable signal quality.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Clive Robinson</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-365</link>
		<dc:creator>Clive Robinson</dc:creator>
		<pubDate>Wed, 19 Apr 2006 14:27:56 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-365</guid>
		<description>Markus,

One thing you could do is go for a Software Defined Radio design. There are a couple of interesting articals up on the web, and Eric Youngblood actually sells a quite decent SDR kit, that he described in the articals available from,

http://www.flex-radio.com/articles.htm

Whilst away for a few days with the family and nothing much better to do whilst out walking I had an idle thought or two ;) one of which was,

IF you assume the video signal is actually sampled at the video dot clock rate, then by the process of sampaling the signal energy is spread at multiples of the dot clock all across the radio spectrum (one of which is what you tune into effectivly). However insted of using a conventional receiver why not use a SDR without front end preselection, and drive the sampaling system at the same rate as the dot clock (ie a high speed A-D clocked at the dot clock rate). The result would be to reverse the effect of the dot clock. 

Now on the very loose assumption that it would behave like a channel bank receiver with a common IF, then it would effectivly corelate all the multiples of the video signal giving you (a limited) gain of the wanted video signal whilst other (interfering)  signals would benifit less. 

You might well find that instead of needing a wideband receiver all you need is a high speed A-D without analog signal filtering (ie your current board), pre-faced by a high quality amplifier.

As I said just an idle though whilst my 4 year old son was creating mayhem amongst the wildlife in the countryside where we were walking.</description>
		<content:encoded><![CDATA[<p>Markus,</p>
<p>One thing you could do is go for a Software Defined Radio design. There are a couple of interesting articals up on the web, and Eric Youngblood actually sells a quite decent SDR kit, that he described in the articals available from,</p>
<p><a href="http://www.flex-radio.com/articles.htm" rel="nofollow">http://www.flex-radio.com/articles.htm</a></p>
<p>Whilst away for a few days with the family and nothing much better to do whilst out walking I had an idle thought or two <img src='http://www.lightbluetouchpaper.org/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' /> one of which was,</p>
<p>IF you assume the video signal is actually sampled at the video dot clock rate, then by the process of sampaling the signal energy is spread at multiples of the dot clock all across the radio spectrum (one of which is what you tune into effectivly). However insted of using a conventional receiver why not use a SDR without front end preselection, and drive the sampaling system at the same rate as the dot clock (ie a high speed A-D clocked at the dot clock rate). The result would be to reverse the effect of the dot clock. </p>
<p>Now on the very loose assumption that it would behave like a channel bank receiver with a common IF, then it would effectivly corelate all the multiples of the video signal giving you (a limited) gain of the wanted video signal whilst other (interfering)  signals would benifit less. </p>
<p>You might well find that instead of needing a wideband receiver all you need is a high speed A-D without analog signal filtering (ie your current board), pre-faced by a high quality amplifier.</p>
<p>As I said just an idle though whilst my 4 year old son was creating mayhem amongst the wildlife in the countryside where we were walking.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Markus Kuhn</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-274</link>
		<dc:creator>Markus Kuhn</dc:creator>
		<pubDate>Thu, 13 Apr 2006 13:54:07 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-274</guid>
		<description>Yes, a better version of my demonstration of &lt;a rel="nofollow" href="http://www.cl.cam.ac.uk/~mgk25/emsec/optical-faq.html"&gt;optical attacks&lt;/a&gt; is on my list of things to do with this FPGA board. The optical eavesdropping experiments that I did five years ago were offline laboratory setups. I used a digital oscilloscope to acquire an averaged image, which I then transfered onto a PC in order to process it in MATLAB (deconvolution, raster conversion, etc.). That takes a few minutes and is therefore not suitable to give a quick demo. The board will finally allow me to give realistic real-time outdoor demonstrations.

At the moment, the only board of this type that I have is still with the project sponsor, but a second one is already ordered. Simply connecting the existing setup to a photomultiplier should already give a visible signal, but in order to really read text, I will have to add a digital deconvolution filter. There is plenty of space left on the FPGA, so I don't expect any big problems. However, such deconvolution filters work best if they are applied to a very low-noise signal, therefore I'll also need periodic-averaging in the COVISP.

A minor problem may be that this board was really designed for IF signal processing. The A/D converters are connected via transformers that will filter out frequencies below 1 MHz. The lack of DC coupling should not affect text readability, but it may affect the overall image quality.

Time permitting, I might also build my own wide-band receiver at some point, possibly as a little daughter card to go onto the FPGA development board. I could also reimplement the project on a smaller and cheaper FPGA. Both things combined might lead to a very powerful eavesdropping demonstration for less than £1000 worth of ingredients. There is a bit more on this written up in a recent paper “&lt;a rel="nofollow" href="http://www.cl.cam.ac.uk/~mgk25/iss2006-tempest.pdf"&gt;Eavesdropping attacks on computer displays&lt;/a&gt;”.

Thanks for the component suggestion, I'll certainly have a look at the data sheet.</description>
		<content:encoded><![CDATA[<p>Yes, a better version of my demonstration of <a rel="nofollow" href="http://www.cl.cam.ac.uk/~mgk25/emsec/optical-faq.html">optical attacks</a> is on my list of things to do with this FPGA board. The optical eavesdropping experiments that I did five years ago were offline laboratory setups. I used a digital oscilloscope to acquire an averaged image, which I then transfered onto a PC in order to process it in MATLAB (deconvolution, raster conversion, etc.). That takes a few minutes and is therefore not suitable to give a quick demo. The board will finally allow me to give realistic real-time outdoor demonstrations.</p>
<p>At the moment, the only board of this type that I have is still with the project sponsor, but a second one is already ordered. Simply connecting the existing setup to a photomultiplier should already give a visible signal, but in order to really read text, I will have to add a digital deconvolution filter. There is plenty of space left on the FPGA, so I don&#8217;t expect any big problems. However, such deconvolution filters work best if they are applied to a very low-noise signal, therefore I&#8217;ll also need periodic-averaging in the COVISP.</p>
<p>A minor problem may be that this board was really designed for IF signal processing. The A/D converters are connected via transformers that will filter out frequencies below 1 MHz. The lack of DC coupling should not affect text readability, but it may affect the overall image quality.</p>
<p>Time permitting, I might also build my own wide-band receiver at some point, possibly as a little daughter card to go onto the FPGA development board. I could also reimplement the project on a smaller and cheaper FPGA. Both things combined might lead to a very powerful eavesdropping demonstration for less than £1000 worth of ingredients. There is a bit more on this written up in a recent paper “<a rel="nofollow" href="http://www.cl.cam.ac.uk/~mgk25/iss2006-tempest.pdf">Eavesdropping attacks on computer displays</a>”.</p>
<p>Thanks for the component suggestion, I&#8217;ll certainly have a look at the data sheet.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
