Screaming Channels

TEMPEST Comeback: A Realistic Audio Eavesdropping Threat on Mixed-signal SoCs

“…As a result, the new unique features of the EM leakages may open potential attack opportunities and may become a motive for new EM SCCAs considering the following reasons: (a) strong radiation may extend the attackable distance or reduce the number of signal traces for analysis. (b) by exploiting the intermodulation phenomenon with other radiation sources, which was already discovered (e.g., RF carrier [9]) or will be newly discovered, the number of attackable leakages would increase.…”

“…Additionally, the Bluetooth radio components are turned off to make sure that there is no "screaming channel [9]" radiation. And the measurement is performed in an anechoic chamber for avoiding signal interference from commercially licensed frequency band.…”

“…The common strong carrier in the "Screaming Channel [9]" and this paper is the system clock. However, as another strong source, this paper utilizes the newly introduced SWREG noise, whereas reference [9] exploited the RF carrier for wireless digital communication. This small difference makes two studies significantly distinct with respect to the attack practicability.…”

“…On the other hand, in 2018, Camurati et al jumped over the key-recovery distance hurdle of EM SCCA on a mixed-signal SoC (MSoC) [9]; they showed the successful key recovery at a tinyAES software implementation from a long distance (10 meters) for the first time. The key factor of their long-distance achievement was that they collected the in-band (around 2.5 GHz) leakages which were radiated via an antenna; the in-band information leakages could be explained from the inter-modulation with two signals: the RF carrier (2.4 GHz) and the system clock (64 MHz).…”

“…The strong noise characteristics of SWREG make it possible for an attacker to perform a successful audio TEMPEST on the MSoC. Furthermore, the new SWREG noise-based EM audio radiations have following unique frequency distribution features related to the characteristics of the SWREG noises: (a) dense: the periodic frequency intervals of the audio leaks are quite narrow (i.e., the frequency of SWREG), (b) wideband: there exist the strong EM radiations over the widefrequency range (i.e., from several MHz to over 1 GHz), and (c) static: compared to the carrier frequency hopping of Bluetooth in "Screaming Channel [9]," the carrier frequencies of the audio leaks are time-invariant. The features also make the new TEMPEST attack become considerably practical.…”