Live data from Hacker News

System Bus Radio: Transmits AM radio on computers without transmitting hardware

github.com

31–40 of 125 posts

Re: System Bus Radio: Transmits AM radio on computers without transmitting hardware

#31
post #11

Earlier quoted context omitted.

Back then most programming for those machines was done at that level!

When I first laid eyes on the "High Speed Job Stream" in UofT's Sanford Fleming building (that particular building has since burnt down and been replaced), students were running jobs in PL/1, WATFIV, LISP, SPITBOL, COBOL, and many others. In the labs, there were IBM Selectric terminals dedicated to APL. And there was a BASIC dialect over at what was then "Ryerson Polytechnic." There was a room with terminals and acou…

I said most programming for those particular machines. I agree that mainframes had largely moved on, and probably the larger minis too. My first exposure to programming was time-shared Basic in 1972.

Re: System Bus Radio: Transmits AM radio on computers without transmitting hardware

#32

Earlier quoted context omitted.

I don’t think the FETs generate enough EM on their own? It’s probably the inductors on the motherboard charging and discharging as a result of the FETs that cause the EM whine/hum? Another likely source is the power supply, which has coils by the dozens and will react to varying loads of computational work. The cheap ones are already all over the radio spectrum even when you don’t want them to be.

The transistors also have a drain and a source :)

The transistors in a modern machine use a minuscule amount of power and don't have enough area to make an antenna. You need to find a way to affect an output pin of the chip. Address lines for example will do a decent job, and the lower bits of the address are easy to control with a program.

Re: System Bus Radio: Transmits AM radio on computers without transmitting hardware

#34
People had fanciful minds. They had expected the civilization to end in bio-warfare, or atomic bombs, or a blazing meteorite impact.

No such luck. The end of the civilization came, rather anticlimactically, when the humans discovered that side effects and timing attacks made any form of cyber-security a joke. Their computers screeched to a halt bogged down by nightmarish security patches.

By then, it was already too late to go back and live off the land.

Re: System Bus Radio: Transmits AM radio on computers without transmitting hardware

#35
Back a couple of decades, my alphabetic pager was going off but the messages were gibberish. It turned out the CPU in the PC I'd been asked to look at was a Pentium running at 150 MHz. I'd set my pager directly on top of the case, and the nominal frequency for it was 150.5 MHz, frequency modulated.

The lines in the motherboard can be used as antennae and the CPU pins can produce a clock pulse and modulate it. There used to be a parallel port audio device for PCs which was mainly just different resistors. The driver for it just timed pulses to the different pins.

This software just shows a bit of a novel implementation to modulate the motherboard bus itself in an ordered way to produce a signal with useful data in it. I imagine FM may be easier to pull off cleanly than AM, actually.

This shows that an air gap has to be pretty large, and should probably be backed up by a Faraday cage if your data is that sensitive.

I don't suspect this will be used to get grandma's credit card number from her home desktop considering the logistics of the actual attack. Source code to something really important, military data, diplomatic dispatches, or something else of really high value would be the only sensible targets in a closed area. However, a university lab, Internet cafe, coffee shop, or public library might be easy enough. Most of the machines there will be on the network, and that's an easier way to exfiltrate. The main advantage of this in the common attacker's toolkit is it won't be seen by a host-based firewall. DNS, DHCP, or lots of other ways could be used to exfiltrate through most firewalls though.

This sort of thing is a great novelty for most of the computer-using world. It's kind of scary for people who are actually in need of an air gap, but I don't think it's unforeseen.

Re: System Bus Radio: Transmits AM radio on computers without transmitting hardware

#36
post #2

Can you someone do a ELI5 on this project? Tried to read but couldn't move further.

Here's one.

This sentence from the linked paper is informative - "When data is exchanged between the CPU and the RAM, radio waves are emitted from the bus's long parallel circuits."

For some background:

Digital circuits like computer motherboards have components called oscillators that switch voltage on and off a number of times every second. This is what "clock speeds" refers to - 2.8 GHz CPU clock speed means voltage to CPU is being switched on and off 2.8x10^9 times per second.

All components like the processors, IO buses, RAM modules, etc. synchronize their actions to the rise and falls in these voltage levels. It's a way of synchronizing their actions.

One consequence of switching voltage on and off is that electrical fields build up and collapse (voltage is a measure of the electrical field), and cause magnetic fields to build up and collapse. We lay people call "oscillating electromagnetic fields" as "radio waves". This is the origin of radio waves from motherboards.

The missing link for transmission is that like any radio transmission, it requires an "antenna" - that is a conductor of some length. There are conductors on a circuit board in the form of copper traces through which current passes. These start acting like antennas.

In this case, the copper traces connecting CPU to RAM on that particular computer are emitting EM radiation at a frequency of 1580 kHz.

So far, all there is is some EM radiation with certain frequency and an antenna to transmit it. This is just the "carrier wave". But for transmitting useful information, some kind of modulation is necessary to encode data over that carrier wave. This project uses an SSE2 CPU instruction called MOVNTDQ or _mm_stream_si128 to write to memory, with the data to be transmitted encoded as sequences of 1s and 0s with certain frequency (rate) and for a certain time period. This act of at writing at a certain rate for some time period results in switching on and off of voltages on the traces between CPU and RAM which in turn creates modulated EM radiation.

TBH, I didn't understand the details of how this project modulates the binary data over a square wave and how it gets treated as amplitude modulation by a regular radio receiver, and I request another ELI5 from somebody else to explain it to me :)

Re: System Bus Radio: Transmits AM radio on computers without transmitting hardware

#38
post #21

I debugged a boot issue on the Apple Newton this way. The latest flash image was a brick on production hardware (no available LEDs, GPIOs, etc.) but not on development hardware. But I could flash a new OS image. So I wrote some small loops that did different stuff on the bus (so that they sounded different) and salted the boot path with them, then listened in on my portable AM radio. Found the problem inside of an ho…

What was the problem?

Re: System Bus Radio: Transmits AM radio on computers without transmitting hardware

#39
post #38
post #21

I debugged a boot issue on the Apple Newton this way. The latest flash image was a brick on production hardware (no available LEDs, GPIOs, etc.) but not on development hardware. But I could flash a new OS image. So I wrote some small loops that did different stuff on the bus (so that they sounded different) and salted the boot path with them, then listened in on my portable AM radio. Found the problem inside of an ho…

What was the problem?

IIRC it was some improperly guarded code that was intended to run only on the non-production development systems (some debugging support). The kernel would touch a non-existent h/w register and trap, which was fatal. Removing the code was the fix.

Re: System Bus Radio: Transmits AM radio on computers without transmitting hardware

#40
post #35

Back a couple of decades, my alphabetic pager was going off but the messages were gibberish. It turned out the CPU in the PC I'd been asked to look at was a Pentium running at 150 MHz. I'd set my pager directly on top of the case, and the nominal frequency for it was 150.5 MHz, frequency modulated. The lines in the motherboard can be used as antennae and the CPU pins can produce a clock pulse and modulate it. There u…

Years ago I was in the same building during the installation of a "NATO standard" (whatever that means) environment suitable for developing sensitive software, and the air gap was indeed pretty large, the entire 2 rooms were air gapped from the building (at 4th floor), enclosed in a Faraday cage and with special precautions (out of my clearance level) for electricity going in. It was very quiet inside (even cell phone did not have any signal, of course).
Post reply on HN