Reviving TEMPEST Attacks With An Injected Signal
InjectEave research recovers device signals by RF injection, including real-time VoIP voice injection at up to 30 meters.
Researchers describe InjectEave, which irradiates modern electronics at frequencies matching unintentional internal antennas so nonlinear components mix that carrier with internal signals and radiate recoverable sidebands. Without injection they saw no significant emissions; with it they recovered audio from wired and wireless headphones and a wireless landline and sensed a smart lamp and fan, including through walls and out to 30 meters using a power amplifier. A portable setup used a USRP B210 and a spectrum analyzer. On a VoIP phone they captured a speaker, cloned the voice, and injected synthesized speech into the call in real time.
- InjectEave mixes an injected RF carrier with internal signals through nonlinear parts.
- Audio and device state were recovered through walls, to 30 meters with amplification.
- Injection frequency was tuned to isolate one device among several.
- A VoIP demo cloned speech and injected synthesized audio into a live call.
From the original article
2 min read at hackaday.com
TEMPEST attacks are often the most effective way to break air-gapped security: rather than directly accessing a computer, the attacker records the system’s unintended radio emissions and uses them to reconstruct its internal operations.
By hackaday.com via hoistbypetard · hackaday.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.