# side channels Published articles for side channels. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Using HDMI EMI for fast wireless data transfer DevFeed: [Using HDMI EMI for fast wireless data transfer]() Original publisher: [Read original article]() Author: Oona Räisänen (noreply@blogger.com) Published: 2023-02-27T21:02:00Z Content type: tutorial Language: en Sources: [Oona Räisänen]() Topics: [hdmi](), [monitor](), [vulnerability](), [Raspberry Pi](), [data]() Tags: [communications](), [hdmi](), [monitor](), [raspberry-pi](), [security](), [side-channels](), [tempest](), [vulnerability](), [webcam]() ### AI overview The article investigates wide-band radio interference from a monitor and shows how HDMI electromagnetic emissions can reveal a distorted image of a Raspberry Pi desktop. It connects the observation to the known monitor-eavesdropping technique called van Eck phreaking and explores whether the emissions can transfer additional information. ### Source excerpt This story, too, begins with noise. I was browsing the radio waves with a software radio, looking for mysteries to accompany my ginger tea. I had started to notice a wide-band spiky signal on a number of frequencies that only seemed to appear indoors. Some sort of interference from electronic devices, probably. Spoiler alert, it eventually led me to broadcast a webcam picture over the radio waves... but how? It sounds like video The mystery deepened when I listened to how this interference sounded like as an AM signal. It reminded me of a time I mistakenly plugged our home stereo system to the Nintendo console's video output and heard a very similar buzz. Am I possibly listening to video? Why would there be analog video transmitting on any frequency, let alone inside my home? If we plot the signal's amplitude against time we can see that there is a strong pulse exactly 60 times per second. This could be the vertical synchronisation signal of 60 Hz video. A shorter pulse (pictured above) can be seen repeating more frequently; it could be the horizontal one. Between these pulses there is what appears to be noise. Maybe, if we use the strong pulses for synchronisation and plot the amplitude of that noise as a two-dimensional picture, we could see something? And sure enough, when main screen turn on, we get signal: (I've hidden the bright synchronisation signal from this picture.) It seems to be my Raspberry Pi's desktop with weirdly distorted greyscale colours! Somehow, some part of the monitor setup is radiating it quite loudly into the aether. The frequency I'm listening to is a multiple of the monitor's pixel clock frequency. As it turns out, this vulnerability of some monitors has been known for a long time. In 1985, van Eck demonstrated how CRT monitors can be spied on from a distance[1]; and in 2004, Markus Kuhn showed that the same still works on flat-screen monitors[2]. The image is heavily distorted, but some shapes and even bigger text can be recognisable. So ## CTCSS fingerprinting: a method for transmitter identification DevFeed: [CTCSS fingerprinting: a method for transmitter identification]() Original publisher: [Read original article]() Author: Oona Räisänen (noreply@blogger.com) Published: 2016-10-07T13:17:00Z Content type: article Language: en Sources: [Oona Räisänen]() Topics: [Programming](), [Streams](), [Library](), [USB]() Tags: [algorithms](), [analysis](), [audio](), [communications](), [dsp](), [library](), [quality](), [radio](), [security](), [side-channels](), [signal](), [usb](), [voice](), [walkie-talkie]() ### AI overview The article investigates whether the 88.5 Hz CTCSS tone in hand-held FM transceivers can fingerprint transmitters by revealing small differences in crystal frequencies and modulation depths. It describes analyzing walkie-talkie recordings with liquid-dsp and a phase-locked loop. ### Source excerpt Identifying unknown radio transmitters by their signals is called radio fingerprinting. It is usually based on rise-time signatures, i.e. characteristic differences in how the transmitter frequency fluctuates at carrier power-up. Here, instead, I investigate the fingerprintability of another feature in hand-held FM transceivers, known as CTCSS or Continuous Tone-Coded Squelch System. Motivation & data I came across a long, losslessly compressed recording of some walkie-talkie chatter and wanted to know more about it, things like the number of participants and who's talking with who. I started writing a transcript - a fun pastime - but some voices sounded so similar I wondered if there was a way to tell them apart automatically. The file comprises several thousand short transmissions as FM demodulated audio lowpass filtered at 4500 Hz. Signal quality is variable; most transmissions are crisp and clear but some are buried under noise. Passages with no signal are squelched to zero. I considered several potentially fingerprintable features, many of them unrealistic: Carrier power-up; but many transmissions were missing the very beginning because of squelch Voice identification; but it would probably require pretty sophisticated algorithms (too difficult!) and longer samples Mean audio power; but it's not consistent enough, as it depends on text, tone of voice, etc. Maximum audio power; but it's too sensitive to peaks in FM noise I then noticed all transmissions had a very low tone at 88.5 Hz. It turned out to be CTCSS, an inaudible signal that enables handsets to silence unwanted transmissions on the same channel. This gave me an idea inspired by mains frequency analysis: Could this tone be measured to reveal minute differences in crystal frequencies and modulation depths? Also, knowing that these were recorded using a cheap DVB-T USB stick - would it have a stable enough oscillator to produce consistent measurements? Measurements I used the liquid-dsp library for signa