TEMPEST makes public display specs a shortcut

Public display specifications can turn one stage of electromagnetic eavesdropping from a wide search into a narrow engineering task, but only when a usable signal is already available. The researchers tested F-DLA on 2²¹ captured samples and estimated a screen’s refresh rate in about 0.30 seconds, versus 0.67 seconds for the conventional method. In an election-equipment test lab, an assessor could check a display’s leaked timing faster if the method remains accurate beyond this preliminary capture.

A screen can seem silent while it is working. But as currents switch inside a display and signals move through its circuits and cables, the equipment also gives off unintended electromagnetic radiation. If that leakage is strong and clean enough, an attacker can capture it by radio and use it to rebuild what was shown. The difficult first step is finding the screen’s timing in a long recording. Today, that can mean searching across many possible timings, even when the target is a standard device whose specifications are public.

Why the screen’s timing matters

Video is not sent as one unbroken picture. A display repeatedly refreshes its image, while also moving through the rows and pixels that make up each frame. Those repeated patterns can leave clues in the leaked radio signal.

The rate at which a screen repeats a frame is its refresh rate, measured in hertz. A rate of 60 hertz means the screen refreshes about 60 times each second. Finding that rate helps an analyst line up the captured signal with the screen’s timing. Without that alignment, reconstructing an image is like trying to piece together a torn photograph without knowing where its edges belong.

A software-defined radio can capture selected parts of the radio spectrum and process them with software. But a usable signal is still required. Interference, the target hardware, signal strength, and the analyst’s ability to align the signal all affect whether a screen image can be recovered.

A public specification narrows the search

The paper proposes Fast DLA, or F-DLA, for estimating the frame rate in a video TEMPEST attack. TEMPEST is the study of unintended electromagnetic emissions from electronic equipment and what those emissions might reveal.

The key idea is simple: do not search for every possible timing when the display’s likely settings are already known. The authors point to public Brazilian voting-machine specifications. They list a resolution of 1280×768 for UE2013 and UE2015, and at least 1280×720 for UE2020. For the relevant resolutions, the researchers limit the possible refresh rates to four choices: 60, 75, 85, and 120 hertz.

That changes the job from a broad search into a small set of checks. The paper says the conventional FFT-based discrete linear autocorrelation method has O(N log N) complexity. F-DLA has O(N) complexity when the display parameters are known in advance and the possible refresh rates and timing error stay within bounds. In everyday terms, more captured data should take roughly proportionally more work, rather than adding an extra search burden.

The test used a VGA monitor showing an electronic-voting-machine interface at 1280×720 and 60 hertz. An Ettus USRP B200 software-defined radio and a digital-TV antenna captured the signal from about 20 centimetres away. Both methods processed 2²¹ samples. They identified a refresh rate of about 60 hertz, but F-DLA took about 0.30 seconds, compared with about 0.67 seconds for conventional DLA. The paper includes an autocorrelation plot in Figure 1 and a reconstructed TEMPEST image in Figure 2.

What this could change

In an election-equipment test lab, an assessor could point a receiver at a display and more quickly check whether its emissions match the timing listed in the public screen specification. A security tester would spend less time searching for that one part of the signal. An attacker who already has a usable capture of a known, standardized display would also gain a faster timing-estimation step.

That does not make a screen image easy to steal. The receiver still has to capture a usable emission. The analyst still has to find a leaking frequency and reconstruct the image. Public specifications do not create a signal where none can be measured; they reduce uncertainty when one is available.

The result is preliminary. The experiment used one capture, and the authors leave testing in degraded channels for future work. Severe channel degradation can break the assumption that the timing error stays bounded, compromising estimation for both F-DLA and the conventional method. If the shortcut remains accurate in noisier and more varied environments, public hardware details will be a reason to assess electromagnetic emissions directly, not to treat those details as harmless on their own.

Sources

arXiv, “Fast Frame Rate Estimation in Electromagnetic Side-Channel Attacks on Public Systems”