Thursday 15 December 2011

Van Eck And Britton

In 1985 a group of Swedish engineers, led by one William "Wim" Van Eck, presented a paper called "Electromagnetic Radiation from Video Dis-play Units: An Eavesdropping Risk?" at the Securi-corn Conference in Cannes. The paper, which was published in Computers and Security 4, described how one could easily and inexpensively convert a normal television set into a non-trespassing, pas-sive device to intercept and reconstruct the infor-mation from any digital device, most notably com-puters. Scientist Don Britton had already gone public with a virtually identical device in 1979, but it was the Van Eck paper that got people to sit up and take notice.

We were talking before about how you could set up a radio receiver to pick up the mess of sig-nals coming from cables, wiring and circuit boards. This is possible, yes, but you would end up with an unintelligible mishmash of signals. It would be dif-ficult to separate and decode the various signals -though not entirely impossible.

Doing so would enable you to determine what a distant computer was "thinking" as those electrical pulses shot through its system.

"Pulses" is the key term here. We all know the story about how computers are digital beasts, proc-essing streams of ones and zeroes to create the fabulous tapestries of color and sound that we get to appreciate every time we boot up a copy of the latest Sierra game.

In reality, there aren't actually tiny Is and Os coursing through the wiring. What's going on is a high or low electrical current passing through. We think of these high and low currents as being Is and Os because it is convenient for us to imagine them this way. Any electrical device is going to have radiation emissions. But only a digital device, like a computer, will have pulses of high and low. Keep all this in mind while we take a little side trip.

Computer screens operate on the pointillist school of display painting: what you see as con-tinuous shapes and lines on the screen is actually composed of thousands or millions of tiny dots, called picture elements, or pixels for short. Each dot is a little speck of some substance that glows (fluoresces) when energized, and the inside of the screen is covered with the stuff.

Video control circuitry located either within the monitor or plugged into the computer, controls the position of an electron gun, which repeatedly scans the screen top-to-bottom, firing an electron where appropriate to energize a bit of the fluorescent sub-stance. Light up the appropriate pixels and keep them lit, and you
end up with glowing dots that can combine to form the lines, characters, symbols and graphics that make up our daily experience with visual computer output. You may ask yourself, "Well, once a pixel is lit up, how do you darken it to clear that portion of the screen?" The answer is simple. Hitting the phosphorescent matter with an electron only pro-duces a very brief burst of glow before extinguishing. That's why the electron gun must systemati-cally scan the entire screen sixty times a second to constantly refresh the image appearing on it. If we wish to cancel a pixel or series of pixels, we simply discontinue firing an electron at that section of the screen.

Every time the beam fires we get a high voltage pulse of electromagnetic emission. Britton's and Van Eck's idea was to simply use a television re-ceiver to listen for those bursts of high voltage as a monitor emits them, and have the television respond by firing a pixel in the corresponding place on its own screen - thus ending
up with a display screen that exactly matches, pixel by pixel, that of the target computer.

A good thing for a spy to have, huh? The problem is that while a television can receive those bursts of high voltages, they don't know what to do with them. There's nothing inherent to a high pulse that signals where on the receiving television that pixel should go. <Actually, such signals are readily available from the mishmash, because the originating monitor's synchroni-zation components also generate signals as they func-tion.
However, the pulses are too weak to pick up from a distance.>

The Van Eck or Britton devices bestow this function upon any lowly TV receptor, by producing an artificial syn-chronization signal. Two adjustable oscillators are used to create the vertical (picture) and horizontal (line) synchronization. For technical reasons, proper reception requires a constant re-tuning of the oscillators. This
could theoretically be done by hand, but this is the computer age: the signals are mathematically combined and fed into a logic cir-cuit which performs the job automatically.

The difference between Britton's and Van Eck's designs are that Britton based his system on United States NTSC technology, while Van Eck's model is based on European PAL receptors, using European voltages, and includes a built-in digital frequency meter. If you have the tech knowledge you can build one of these for
$10 to $15. Models are also commercially available through spy shops.

Besides the oscillators and the logic processing sync restorer board, you will want to hook up a di-rectional antenna to help focus in on exactly what you're after. Someone using one of these devices should be able to fine-tune their receiver to the point where multiple CRTs within the same room may be distinguished. This is
due to differences in the components making up the monitors. Pieces that come off of different assembly lines or from different countries will have varying radia-tionemitting characteristics. Your suitably engi-neered Van Eck or Britton device can discriminate between the several traits presented. Just pick one line of signals
which you wish your machine to follow, and off you go.