<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	>
<channel>
	<title>Comments on: Video eavesdropping demo at CeBIT 2006</title>
	<atom:link href="http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/</link>
	<description>Security Research, Computer Laboratory, University of Cambridge</description>
	<pubDate>Sat, 04 Jul 2009 21:03:43 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.7.1</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Clive Robinson</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/comment-page-1/#comment-30056</link>
		<dc:creator>Clive Robinson</dc:creator>
		<pubDate>Sat, 01 Nov 2008 17:11:57 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-30056</guid>
		<description>@ Markus,

If you do get around to building a new preselector / reciever for the card a couple of suggestions for you.

Due to cost etc most manufactures of ICT equipment do not put enough filtering components in their equipment.

The result of this is it breaks the EMC/EMI specs (masks) they must meet...

To solve this problem a lot have resorted to using very very simple Spread Spectrum Techneiques to spread the frequency spurs from their equipment over a larger bandwidth and therby lower the energy per Hertz to get under the EMC/EMI mask...

Well, if you included an extra double balanced mixer into the system you could re constitute the high energy frequency spurs whilst also (potentialy) reducing other interfering signals...

This might well give you an effective coding gain of 20dB which would be worth while as it could increase the range of the detecting equipment ten fold...

Also the use of two front ends and four antennas would be a very worthwhile addition (conect two antennas in X/Y axis via a modern equivalent of the old Radio Direction Finding "goinometer") the result can be like having a highly directional beam antena without as much physical size. Also as you can steer it electronicaly it could be easily driven from the processing card.

Both of which might easily turn it from an interesting project to a very serious tool which could attract you funding ;)</description>
		<content:encoded><![CDATA[<p>@ Markus,</p>
<p>If you do get around to building a new preselector / reciever for the card a couple of suggestions for you.</p>
<p>Due to cost etc most manufactures of ICT equipment do not put enough filtering components in their equipment.</p>
<p>The result of this is it breaks the EMC/EMI specs (masks) they must meet&#8230;</p>
<p>To solve this problem a lot have resorted to using very very simple Spread Spectrum Techneiques to spread the frequency spurs from their equipment over a larger bandwidth and therby lower the energy per Hertz to get under the EMC/EMI mask&#8230;</p>
<p>Well, if you included an extra double balanced mixer into the system you could re constitute the high energy frequency spurs whilst also (potentialy) reducing other interfering signals&#8230;</p>
<p>This might well give you an effective coding gain of 20dB which would be worth while as it could increase the range of the detecting equipment ten fold&#8230;</p>
<p>Also the use of two front ends and four antennas would be a very worthwhile addition (conect two antennas in X/Y axis via a modern equivalent of the old Radio Direction Finding &#8220;goinometer&#8221;) the result can be like having a highly directional beam antena without as much physical size. Also as you can steer it electronicaly it could be easily driven from the processing card.</p>
<p>Both of which might easily turn it from an interesting project to a very serious tool which could attract you funding <img src='http://www.lightbluetouchpaper.org/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' /> </p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Clive Robinson</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/comment-page-1/#comment-29993</link>
		<dc:creator>Clive Robinson</dc:creator>
		<pubDate>Sun, 26 Oct 2008 04:09:33 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-29993</guid>
		<description>@ Markus,

It would appear that to bods have applied your "work in progress" to detecting signals from a keyboard.

http://lasecwww.epfl.ch/keyboard/

It appears to have created a bit of a flap. And Bruce Schneier has bloged about it,

http://www.schneier.com/blog/archives/2008/10/remotely_eavesd.html

I mut admit I do find it quit amusing all in all.

However that reminds me, you said above it was a work in progress how is it going I must admit I have been looking forward to having a read up about it.</description>
		<content:encoded><![CDATA[<p>@ Markus,</p>
<p>It would appear that to bods have applied your &#8220;work in progress&#8221; to detecting signals from a keyboard.</p>
<p><a href="http://lasecwww.epfl.ch/keyboard/" rel="nofollow">http://lasecwww.epfl.ch/keyboard/</a></p>
<p>It appears to have created a bit of a flap. And Bruce Schneier has bloged about it,</p>
<p><a href="http://www.schneier.com/blog/archives/2008/10/remotely_eavesd.html" rel="nofollow">http://www.schneier.com/blog/archives/2008/10/remotely_eavesd.html</a></p>
<p>I mut admit I do find it quit amusing all in all.</p>
<p>However that reminds me, you said above it was a work in progress how is it going I must admit I have been looking forward to having a read up about it.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: alex</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/comment-page-1/#comment-28146</link>
		<dc:creator>alex</dc:creator>
		<pubDate>Sun, 24 Feb 2008 15:00:22 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-28146</guid>
		<description>What do you think about this nice russian protection device:
http://www.npoanna.ru/Content.aspx?name=models.sonata-r2
you can translate using google
Are there any alternatives made in USA and public availalb esay on ebay ?</description>
		<content:encoded><![CDATA[<p>What do you think about this nice russian protection device:<br />
<a href="http://www.npoanna.ru/Content.aspx?name=models.sonata-r2" rel="nofollow">http://www.npoanna.ru/Content.aspx?name=models.sonata-r2</a><br />
you can translate using google<br />
Are there any alternatives made in USA and public availalb esay on ebay ?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: F. Kreutzer</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/comment-page-1/#comment-23681</link>
		<dc:creator>F. Kreutzer</dc:creator>
		<pubDate>Tue, 21 Aug 2007 13:04:17 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-23681</guid>
		<description>Da ich ihrem namen entnehme das sievermutlich eutscher abstammung sind habe ich mal auf deutsch gepostet

Müsste mon soetwas ähnliches nicht auch mit tastaturen funktionieren da diese durch ihre architektur auch wie eine antenne wirken oder ist das signal schlicht und ergreifend zu schwach ?

P.S. was ksotet die oben gzeigte apparatur ?</description>
		<content:encoded><![CDATA[<p>Da ich ihrem namen entnehme das sievermutlich eutscher abstammung sind habe ich mal auf deutsch gepostet</p>
<p>Müsste mon soetwas ähnliches nicht auch mit tastaturen funktionieren da diese durch ihre architektur auch wie eine antenne wirken oder ist das signal schlicht und ergreifend zu schwach ?</p>
<p>P.S. was ksotet die oben gzeigte apparatur ?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Michal</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/comment-page-1/#comment-21632</link>
		<dc:creator>Michal</dc:creator>
		<pubDate>Sun, 22 Apr 2007 21:58:32 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-21632</guid>
		<description>This is really scary. Hopefully they'll do something in order to prevent such "attacks".</description>
		<content:encoded><![CDATA[<p>This is really scary. Hopefully they&#8217;ll do something in order to prevent such &#8220;attacks&#8221;.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Akkerfeld</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/comment-page-1/#comment-2057</link>
		<dc:creator>Akkerfeld</dc:creator>
		<pubDate>Sat, 23 Sep 2006 19:31:29 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-2057</guid>
		<description>Very impressive job Markus.
Just out of curiosity how much would this "cheap" equipment cost?
I checked on the net and the R1250 receiver isn't really available to the public.
Thanks.</description>
		<content:encoded><![CDATA[<p>Very impressive job Markus.<br />
Just out of curiosity how much would this &#8220;cheap&#8221; equipment cost?<br />
I checked on the net and the R1250 receiver isn&#8217;t really available to the public.<br />
Thanks.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Lars Friedrichs</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/comment-page-1/#comment-1728</link>
		<dc:creator>Lars Friedrichs</dc:creator>
		<pubDate>Sun, 10 Sep 2006 12:09:43 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-1728</guid>
		<description>@Rob: 
Nobody said it would be a new technology. Actually this kind of attacks has a long history beginning in the 1970s.
But what is relatively new in our attack is the price of the eavesdropping system. By this time only very expensive systems show a reasonable (=readable) result. Everybody knew there is a problem in security, but it was thought to be unrealistic to exploit since the cost whould be too much.</description>
		<content:encoded><![CDATA[<p>@Rob:<br />
Nobody said it would be a new technology. Actually this kind of attacks has a long history beginning in the 1970s.<br />
But what is relatively new in our attack is the price of the eavesdropping system. By this time only very expensive systems show a reasonable (=readable) result. Everybody knew there is a problem in security, but it was thought to be unrealistic to exploit since the cost whould be too much.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Robert Lemos &#187; Blog Archive &#187; So that&#8217;s what you&#8217;re looking at&#8230;</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/comment-page-1/#comment-1389</link>
		<dc:creator>Robert Lemos &#187; Blog Archive &#187; So that&#8217;s what you&#8217;re looking at&#8230;</dc:creator>
		<pubDate>Mon, 28 Aug 2006 18:51:25 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-1389</guid>
		<description>[...] As he mentions on his blog, security researcher Markus Kuhn demonstrated the technology, creating a replica of the image shown on a monitor by reading the signals from a computer more than 75 feet away. Marcus gave a paper on this topic at the IEEE Security and Privacy Conference in Berkeley nearly 4 years ago, and it&#8217;s nice to see a working demo of the device, if virtually. [...]</description>
		<content:encoded><![CDATA[<p>[...] As he mentions on his blog, security researcher Markus Kuhn demonstrated the technology, creating a replica of the image shown on a monitor by reading the signals from a computer more than 75 feet away. Marcus gave a paper on this topic at the IEEE Security and Privacy Conference in Berkeley nearly 4 years ago, and it&#8217;s nice to see a working demo of the device, if virtually. [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rob</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/comment-page-1/#comment-1314</link>
		<dc:creator>Rob</dc:creator>
		<pubDate>Sat, 26 Aug 2006 15:15:46 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-1314</guid>
		<description>This is not news or new technology. Iit has been around for many many years and has been used by governments agencies all around the world.</description>
		<content:encoded><![CDATA[<p>This is not news or new technology. Iit has been around for many many years and has been used by governments agencies all around the world.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Markus Kuhn</title>
		<link>http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/comment-page-1/#comment-381</link>
		<dc:creator>Markus Kuhn</dc:creator>
		<pubDate>Thu, 20 Apr 2006 09:40:06 +0000</pubDate>
		<guid isPermaLink="false">http://www.lightbluetouchpaper.org/2006/03/09/video-eavesdropping-demo-at-cebit-2006/#comment-381</guid>
		<description>The COVISP is certainly a specialized example of what is now called a "software radio" or "software defined radio" design.

I had a look at various SDR-frontends designed for HAMs, but all the ones I found so far have IF bandwidths designed for PC audio cards, which is three orders of magnitude narrower than what you need for a video signal. Suitable commercially available SDR tuners with at least 20 MHz BW tend to come so far from military suppliers. The HAM-SDR community is already growing beyond the use of soundcards (e.g., &lt;a rel="nofollow" href="http://comsec.com/wiki?UniversalSoftwareRadioPeripheral"&gt;GNU Radio&lt;/a&gt; uses a 6 MHz IF BW cable-TV tuner), and it is surely only a matter of time until they also start to play with 20–50 MHz bandwidths.

If you are interested, there is a more detailed analysis of the spectral composition of a video signal in Section 3.2 of my &lt;a rel="nofollow" href="http://www.cl.cam.ac.uk/TechReports/UCAM-CL-TR-577.html"&gt;thesis&lt;/a&gt;.

You are right that &lt;em&gt;in theory&lt;/em&gt; you can extract a video signal from an antenna signal using merely periodic averaging. A periodic (85 Hz) video signal will have a comb spectrum where all spectral energy is located exclusively at multiples of 85 Hz (assuming an infinitely long periodic signal), and the entire video-baseband spectrum is repeated throughout the spectrum at intervals that correspond to the pixel clock frequency. The periodic averaging is nothing but a comb filter that attenuates all frequencies in the spectrum that are not a multiple of 85 Hz, thereby eliminating all other noise sources.

I tried several times to connect an AD converter directly to an antenna amplifier for periodic averaging, but I found that in practice you get very bad results this way. You always need some form of analog preselection before you can digitize an antenna signal. There is simply way too much energy across the entire ADC input band for averaging to become effective. The frequency selectivity of a wideband receiver does in practice offer a dramatic improvement of the achievable signal quality.</description>
		<content:encoded><![CDATA[<p>The COVISP is certainly a specialized example of what is now called a &#8220;software radio&#8221; or &#8220;software defined radio&#8221; design.</p>
<p>I had a look at various SDR-frontends designed for HAMs, but all the ones I found so far have IF bandwidths designed for PC audio cards, which is three orders of magnitude narrower than what you need for a video signal. Suitable commercially available SDR tuners with at least 20 MHz BW tend to come so far from military suppliers. The HAM-SDR community is already growing beyond the use of soundcards (e.g., <a rel="nofollow" href="http://comsec.com/wiki?UniversalSoftwareRadioPeripheral">GNU Radio</a> uses a 6 MHz IF BW cable-TV tuner), and it is surely only a matter of time until they also start to play with 20–50 MHz bandwidths.</p>
<p>If you are interested, there is a more detailed analysis of the spectral composition of a video signal in Section 3.2 of my <a rel="nofollow" href="http://www.cl.cam.ac.uk/TechReports/UCAM-CL-TR-577.html">thesis</a>.</p>
<p>You are right that <em>in theory</em> you can extract a video signal from an antenna signal using merely periodic averaging. A periodic (85 Hz) video signal will have a comb spectrum where all spectral energy is located exclusively at multiples of 85 Hz (assuming an infinitely long periodic signal), and the entire video-baseband spectrum is repeated throughout the spectrum at intervals that correspond to the pixel clock frequency. The periodic averaging is nothing but a comb filter that attenuates all frequencies in the spectrum that are not a multiple of 85 Hz, thereby eliminating all other noise sources.</p>
<p>I tried several times to connect an AD converter directly to an antenna amplifier for periodic averaging, but I found that in practice you get very bad results this way. You always need some form of analog preselection before you can digitize an antenna signal. There is simply way too much energy across the entire ADC input band for averaging to become effective. The frequency selectivity of a wideband receiver does in practice offer a dramatic improvement of the achievable signal quality.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
