Van Eck phreaking, also known as Van Eck radiation, is a form of

network eavesdropping Network address translation, Network eavesdropping, also known as eavesdropping attack, sniffing attack, or IGMP snooping, snooping attack, is a method that retrieves user information through the internet. This attack happens on electronic devices ...

in which special equipment is used for a

side-channel attack In computer security, a side-channel attack is a type of security exploit that leverages information inadvertently leaked by a system—such as timing, power consumption, or electromagnetic or acoustic emissions—to gain unauthorized access to ...

on the electromagnetic emissions of electronic devices. While electromagnetic emissions are present in keyboards, printers, and other electronic devices, the most notable use of Van Eck phreaking is in reproducing the contents of a

cathode-ray tube A cathode-ray tube (CRT) is a vacuum tube containing one or more electron guns, which emit electron beams that are manipulated to display images on a phosphorescent screen. The images may represent electrical waveforms on an oscilloscope, a ...

(CRT) display at a distance. Information that drives a CRT

video display A display device is an output device for presentation of information in visual or tactile form (the latter used for example in tactile electronic displays for blind people). When the input information that is supplied has an electrical signal ...

takes the form of electrical signals in the RF range. The electric signal which drives the electron beam is amplified to up to around one hundred volts from TTL circuitry. The signal leaks out from displays and may be captured by an antenna, and once synchronization pulses are recreated and mixed in, an ordinary analog television receiver can display the result. These emissions are correlated to the video image being displayed, so, in theory, they can be used to recover the displayed image. While the phenomenon had been known by the United States Government and

Bell Labs Nokia Bell Labs, commonly referred to as ''Bell Labs'', is an American industrial research and development company owned by Finnish technology company Nokia. With headquarters located in Murray Hill, New Jersey, Murray Hill, New Jersey, the compa ...

as early as the Second World War, the process received its name after Wim van Eck published the first unclassified technical analysis of the security risks of emanations from

computer monitor A computer monitor is an output device that displays information in pictorial or textual form. A discrete monitor comprises a electronic visual display, visual display, support electronics, power supply, Housing (engineering), housing, electri ...

s in 1985. While

phreaking Phreaking is a slang term coined to describe the activity of a culture of people who study, experiment with, or explore telecommunication systems, such as equipment and systems connected to public telephone networks. The term ''phreak'' is a se ...

is the process of exploiting

telephone network A telephone network is a telecommunications network that connects telephones, which allows telephone calls between two or more parties, as well as newer features such as fax and internet. The idea was revolutionized in the 1920s, as more and more ...

s, the term is used here because of its connection to eavesdropping.

History

Government researchers were already aware of the danger, as

had noted this vulnerability to secure

teleprinter A teleprinter (teletypewriter, teletype or TTY) is an electromechanical device that can be used to send and receive typed messages through various communications channels, in both point-to-point (telecommunications), point-to-point and point- ...

communications during

World War II World War II or the Second World War (1 September 1939 – 2 September 1945) was a World war, global conflict between two coalitions: the Allies of World War II, Allies and the Axis powers. World War II by country, Nearly all of the wo ...

and was able to produce 75% of the plaintext being processed in a secure facility from a distance of 80 feet (24 metres). Additionally, the NSA published ''Tempest Fundamentals, NSA-82-89, NACSIM 5000, National Security Agency'' (Classified) on February 1, 1982. Also, the van Eck technique was successfully demonstrated to non-TEMPEST personnel in

Korea Korea is a peninsular region in East Asia consisting of the Korean Peninsula, Jeju Island, and smaller islands. Since the end of World War II in 1945, it has been politically Division of Korea, divided at or near the 38th parallel north, 3 ...

during the

Korean War The Korean War (25 June 1950 – 27 July 1953) was an armed conflict on the Korean Peninsula fought between North Korea (Democratic People's Republic of Korea; DPRK) and South Korea (Republic of Korea; ROK) and their allies. North Korea was s ...

in the 1950s. In 1985, Wim van Eck published the first unclassified technical analysis of the security risks of emanations from

s. This paper caused some consternation in the security community, which had previously believed that such monitoring was a highly sophisticated attack available only to

governments A government is the system or group of people governing an organized community, generally a state. In the case of its broad associative definition, government normally consists of legislature, executive, and judiciary. Government is a m ...

; van Eck successfully eavesdropped on a real system, at a range of hundreds of

metre The metre (or meter in US spelling; symbol: m) is the base unit of length in the International System of Units (SI). Since 2019, the metre has been defined as the length of the path travelled by light in vacuum during a time interval of of ...

s, using just $15 worth of equipment plus a

television Television (TV) is a telecommunication medium for transmitting moving images and sound. Additionally, the term can refer to a physical television set rather than the medium of transmission. Television is a mass medium for advertising, ...

set. In the paper, Van Eck reports that in February 1985, a successful test of this concept was carried out with the cooperation of the

BBC The British Broadcasting Corporation (BBC) is a British public service broadcaster headquartered at Broadcasting House in London, England. Originally established in 1922 as the British Broadcasting Company, it evolved into its current sta ...

. Using a van filled with electronic equipment and equipped with a VHF

antenna array An antenna array (or array antenna) is a set of multiple connected antenna (radio), antennas which work together as a single antenna, to transmit or receive radio waves. The individual antennas (called ''elements'') are usually connected to a s ...

, they were able to eavesdrop from a "large distance". There is no evidence that the BBC's

TV detector van TV detector vans are vans which contain equipment that can detect the presence of television sets in use. These vans have been used by the General Post Office and later by contractors working for the BBC to enforce the television licensing syst ...

s used this technology, although the BBC will not reveal whether or not they are a hoax. Van Eck phreaking and protecting a CRT display from it was demonstrated on an episode of Tech TV's ''

The Screen Savers ''The Screen Savers'' is an American TV show that aired on TechTV from 1998 to 2005. The show launched concurrently with the channel ZDTV (later known as TechTV) on May 11, 1998. ''The Screen Savers'' originally centered on computers, new techn ...

'' on December 18, 2003.

Basic principle

Information that drives the

takes the form of

high-frequency High frequency (HF) is the International Telecommunication Union, ITU designation for the radio band, band of radio waves with frequency between 3 and 30 megahertz (MHz). It is also known as the decameter band or decameter wave as its wavelengt ...

electrical signals. The

oscillation Oscillation is the repetitive or periodic variation, typically in time, of some measure about a central value (often a point of equilibrium) or between two or more different states. Familiar examples of oscillation include a swinging pendulum ...

of these

electric currents An electric current is a flow of charged particles, such as electrons or ions, moving through an electrical conductor or space. It is defined as the net rate of flow of electric charge through a surface. The moving particles are called charge ...

create

electromagnetic radiation In physics, electromagnetic radiation (EMR) is a self-propagating wave of the electromagnetic field that carries momentum and radiant energy through space. It encompasses a broad spectrum, classified by frequency or its inverse, wavelength ...

in the RF range. These radio emissions are correlated to the

video Video is an Electronics, electronic medium for the recording, copying, playback, broadcasting, and display of moving picture, moving image, visual Media (communication), media. Video was first developed for mechanical television systems, whi ...

image being displayed, so, in theory, they can be used to recover the displayed image. In a CRT, the image is generated by an

electron beam Since the mid-20th century, electron-beam technology has provided the basis for a variety of novel and specialized applications in semiconductor manufacturing, microelectromechanical systems, nanoelectromechanical systems, and microscopy. Mechani ...

that sweeps back and forth across the

screen Screen or Screens may refer to: Arts * Screen printing or ''silkscreening'', a printing method * Big screen, a nickname for motion pictures * Split screen (filmmaking), showing two or more images side by side * Stochastic screening and Halftone ...

. The electron beam excites the

phosphor A phosphor is a substance that exhibits the phenomenon of luminescence; it emits light when exposed to some type of radiant energy. The term is used both for fluorescent or phosphorescent substances which glow on exposure to ultraviolet or ...

coating on the glass and causes it to glow. The strength of the beam determines the brightness of individual

pixel In digital imaging, a pixel (abbreviated px), pel, or picture element is the smallest addressable element in a Raster graphics, raster image, or the smallest addressable element in a dot matrix display device. In most digital display devices, p ...

s (see

Cathode-ray tube A cathode-ray tube (CRT) is a vacuum tube containing one or more electron guns, which emit electron beams that are manipulated to display images on a phosphorescent screen. The images may represent electrical waveforms on an oscilloscope, a ...

for a detailed description). The electric signal that drives the electron beam is amplified to up to around one hundred volts from TTL circuitry. This high-frequency, high-voltage signal creates electromagnetic radiation that has, according to Van Eck, "a remarkable resemblance to a broadcast TV signal". The signal leaks out from displays and may be captured by an antenna, and once synchronization pulses are recreated and mixed in, an ordinary analog television receiver can display the result. The synchronization pulses can be recreated either through manual adjustment or by processing the signals emitted by

electromagnetic coil An electromagnetic coil is an electrical Electrical conductivity, conductor such as a wire in the shape of a wiktionary:coil, coil (spiral or helix). Electromagnetic coils are used in electrical engineering, in applications where electric curre ...

s as they deflect the CRT's electron beam back and forth.

Use as communication

In January 2015, the Airhopper project from

Georgia Institute of Technology The Georgia Institute of Technology (commonly referred to as Georgia Tech, GT, and simply Tech or the Institute) is a public university, public research university and Institute of technology (United States), institute of technology in Atlanta, ...

, United States demonstrated (at

Ben Gurion University Ben-Gurion University of the Negev (BGU) (, ''Universitat Ben-Guriyon baNegev'') is a public research university in Beersheba, Israel. Named after Israeli national founder David Ben-Gurion, the university was founded in 1969 and currently has f ...

, Israel) the use of Van Eck Phreaking to enable a keylogger to communicate, through video signal manipulation, keys pressed on the keyboard of a standard PC, to a program running on an

Android Android most commonly refers to: *Android (robot), a humanoid robot or synthetic organism designed to imitate a human * Android (operating system), a mobile operating system primarily developed by Google * Android TV, a operating system developed ...

cellphone with an earbud radio antenna.

Equipment

A tailored access battery is a special laptop battery with Van Eck Phreaking electronics and power-side band encryption cracking electronics built into its casing, in combination with a remote transceiver. This allows for quick installation and removal of a spying device by simply swapping the battery.

Potential risks

Van Eck phreaking might be used to compromise the secrecy of the votes in an election using

electronic voting Electronic voting is voting that uses electronic means to either aid or handle casting and counting ballots including voting time. Depending on the particular implementation, e-voting may use standalone '' electronic voting machines'' (also ...

. This caused the Dutch government to ban the use of NewVote

computer A computer is a machine that can be Computer programming, programmed to automatically Execution (computing), carry out sequences of arithmetic or logical operations (''computation''). Modern digital electronic computers can perform generic set ...

voting machine A voting machine is a machine used to record votes in an election without paper. The first voting machines were mechanical but it is increasingly more common to use ''electronic voting machines''. Traditionally, a voting machine has been defi ...

s manufactured by SDU in the 2006 national elections, under the belief that ballot information might not be kept secret. In a 2009 test of electronic voting systems in Brazil, Van Eck phreaking was used to successfully compromise ballot secrecy as a proof of concept.

Further research

In April 2004, academic research revealed that flat panel and laptop displays are also vulnerable to electromagnetic eavesdropping. The required equipment for espionage was constructed in a university lab for less than US$2000. Markus Kuhn has discovered several low-cost techniques for reducing the chances that emanations from computer displays can be monitored remotely. With CRT displays and

analog Analog or analogue may refer to: Computing and electronics * Analog signal, in which information is encoded in a continuous variable ** Analog device, an apparatus that operates on analog signals *** Analog electronics, circuits which use analog ...

video cables, filtering out

components from

fonts In movable type, metal typesetting, a font is a particular #Characteristics, size, weight and style of a ''typeface'', defined as the set of fonts that share an overall design. For instance, the typeface Bauer Bodoni (shown in the figure) inclu ...

before rendering them on a computer screen will attenuate the energy at which text characters are broadcast. With modern

flat panel display A flat-panel display (FPD) is an electronic display used to display visual content such as text or images. It is present in consumer, medical, transportation, and industrial equipment. Flat-panel displays are thin, lightweight, provide better ...

s, the high-speed digital

serial interface A serial port is a serial communication interface through which information transfers in or out sequentially one bit at a time. This is in contrast to a parallel port, which communicates multiple bits simultaneously in parallel. Throughout mo ...

( DVI) cables from the

graphics controller A graphics card (also called a video card, display card, graphics accelerator, graphics adapter, VGA card/VGA, video adapter, display adapter, or colloquially GPU) is a computer expansion card that generates a feed of graphics output to a displa ...

are a main source of compromising emanations. Adding random

noise Noise is sound, chiefly unwanted, unintentional, or harmful sound considered unpleasant, loud, or disruptive to mental or hearing faculties. From a physics standpoint, there is no distinction between noise and desired sound, as both are vibrat ...

to the

least significant bit In computing, bit numbering is the convention used to identify the bit positions in a binary number. Bit significance and indexing In computing, the least significant bit (LSb) is the bit position in a binary integer representing the lowes ...

s of pixel values may render the emanations from flat-panel displays unintelligible to eavesdroppers but is not a secure method. Since DVI uses a certain bit code scheme that tries to transport a balanced signal of 0 bits and 1 bits, there may not be much difference between two pixel colors that differ very much in their color or intensity. The emanations can differ drastically even if only the last bit of a pixel's color is changed. The signal received by the eavesdropper also depends on the frequency where the emanations are detected. The signal can be received on many frequencies at once and each frequency's signal differs in

contrast Contrast may refer to: Science * Contrast (vision), the contradiction in form, colour and light between parts of an image * Contrast (statistics), a combination of averages whose coefficients add up to zero, or the difference between two means * ...

and

brightness Brightness is an attribute of visual perception in which a source appears to be radiating/reflecting light. In other words, brightness is the perception dictated by the luminance of a visual target. The perception is not linear to luminance, and ...

related to a certain color on the screen. Usually, the technique of smothering the RED signal with noise is not effective unless the power of the noise is sufficient to drive the eavesdropper's receiver into

saturation Saturation, saturated, unsaturation or unsaturated may refer to: Chemistry *Saturated and unsaturated compounds, a classification of compounds related to their ability to resist addition reactions ** Degree of unsaturation **Saturated fat or satu ...

thus overwhelming the receiver input.

References

{{refs, refs= {{cite web , title=A History of U.S. Communications Security (Volumes I and II)"; David G. Boak Lectures , work=National Security Agency , year= 1973 , url= https://www.governmentattic.org/2docs/Hist_US_COMSEC_Boak_NSA_1973.pdf , page= 90 {{cite magazine , url=https://www.wired.com/story/what-is-side-channel-attack/ , title=Hacker Lexicon: What Is a Side Channel Attack? , date=21 June 2020 , magazine=

Wired Wired may refer to: Arts, entertainment, and media Music * ''Wired'' (Jeff Beck album), 1976 * ''Wired'' (Hugh Cornwell album), 1993 * ''Wired'' (Mallory Knox album), 2017 * "Wired", a song by Prism from their album '' Beat Street'' * "Wired ...

, last=Greenberg , first=Andy {{cite journal , author=Van Eck, Wim , title=Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk? , journal=Computers & Security , volume=4 , issue=4 , year=1985 , pages=269–286 , url=http://www.tscm.com/vaneck85.pdf , doi=10.1016/0167-4048(85)90046-X , citeseerx=10.1.1.35.1695 {{cite news, last=Carter , first=Claire , url=https://www.telegraph.co.uk/culture/tvandradio/bbc/10340804/Myth-of-the-TV-detector-van.html , title=Myth of the TV detector van? , newspaper=The Daily Telegraph , date=27 September 2013 , access-date=27 September 2015 Van Eck Phreaking
/ref> The Screen Savers: Dark Tip – Van Eck Phreaking
/ref>
/ref> Original Whitepaper
/ref> Airhopper demonstration video, Ben Gurion University
/ref> White paper, FDES institute, 1996, page 12. Dutch government scraps plans to use voting computers in 35 cities including Amsterdam (Herald tribune, 30. October 2006)
/ref> Use of SDU voting computers banned during Dutch general elections
{{webarchive, url=https://web.archive.org/web/20080923142636/http://www.heise.de/english/newsticker/news/80302 , date=2008-09-23 (Heise, October 31. 2006) {{Cite web , url=http://yro.slashdot.org/story/09/11/22/027229/Brazilian-Breaks-Secrecy-of-Brazils-E-Voting-Machines-With-Van-Eck-Phreaking , title=Brazilian Breaks Secrecy of Brazil's E-Voting Machines With Van Eck Phreaking , date=November 21, 2009 , work=Slashdot {{cite journal , author = Kuhn, M.G. , year = 2004 , title = Electromagnetic Eavesdropping Risks of Flat-Panel Displays , journal = 4th Workshop on Privacy Enhancing Technologies , pages = 23–25 , url = http://www.cl.cam.ac.uk/~mgk25/pet2004-fpd.pdf {{cite journal , last= Kuhn , first= Markus G. , author-link= Markus Kuhn (computer scientist) , date=December 2003, title= Compromising emanations: eavesdropping risks of computer displays , journal=Technical Report , issue= 577, issn= 1476-2986 , id= UCAM-CL-TR-577 , url= http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-577.pdf , access-date= 2010-10-29

External links

Van Eck phreaking Demonstration

Tempest for Eliza
is a program that uses a computer monitor to send out AM radio signals, making it possible to hear computer-generated music in a radio.
Video eavesdropping demo at CeBIT 2006
by a Cambridge University security researcher
eckbox
– unsuccessful or abandoned attempt in spring 2004 to build an open-source Van Eck phreaking implementation
Sniffing wireless keyboard link

system-bus-radio
– an implementation of Van Eck phreaking using certain processor instructions on a general purpose computer Surveillance Phreaking 1985 in science Telecommunications-related introductions in 1985