martinmarinov / TempestSDR

Remote video eavesdropping using a software-defined radio platform
GNU General Public License v3.0
1.35k stars 248 forks source link

What kind of antenna do you use in the video-Eavesdropping Video Monitors With TempestSDR RTL-SDR #40

Open lucy-weizi opened 4 years ago

mgkuhn commented 4 years ago

The most suitable antenna depends on the frequency, frequency flexibility, and directional gain that you want to achieve. If you want to probe the locations on the target device that leak most, you may want to use a hand-held magnetic loop H-field probe (which you can easily make yourself out of 50-ohm coax cable). For far-field measurements where you don't know the exact tuning frequency in advance, log-periodic antennas are useful in the range 0.3-3 GHz, and bi-conical antennas in the range 30-300 MHz. Lower frequencies are usually hardly useful for typical video eavesdropping, due to the bandwidths required. If you know the exact frequency that you want to use (after having characterised a particular target), you can improve directional gain with Yagi-Uda or quad-dipole antennas, or even an array of these. For frequencies >3 GHz, parabolic dish antennas (with either a horn or log-periodic antenna feed) become practical.

I would start with an H-field probe and a simple PCB log-periodic. You may also want to get a good antenna textbook to get an overview of what designs are available, especially if you plan to make your own. For example, I found Rothammel's antenna book quite useful.

https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-577.html

lucy-weizi commented 4 years ago

The most suitable antenna depends on the frequency, frequency flexibility, and directional gain that you want to achieve. If you want to probe the locations on the target device that leak most, you may want to use a hand-held magnetic loop H-field probe (which you can easily make yourself out of 50-ohm coax cable). For far-field measurements where you don't know the exact tuning frequency in advance, log-periodic antennas are useful in the range 0.3-3 GHz, and bi-conical antennas in the range 30-300 MHz. Lower frequencies are usually hardly useful for typical video eavesdropping, due to the bandwidths required. If you know the exact frequency that you want to use (after having characterised a particular target), you can improve directional gain with Yagi-Uda or quad-dipole antennas, or even an array of these. For frequencies >3 GHz, parabolic dish antennas (with either a horn or log-periodic antenna feed) become practical.

I would start with an H-field probe and a simple PCB log-periodic. You may also want to get a good antenna textbook to get an overview of what designs are available, especially if you plan to make your own. For example, I found Rothammel's antenna book quite useful.

https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-577.html

Thanks mgkuhn, Do you know the type of antenna used in the video "https://www.youtube.com/watch?v=QjqpKtGNbQo", Since I use my HackRf antenna to monitor the screen failed, so I want to try the same antenna for check. hoping for your reply!

mgkuhn commented 4 years ago

At 6:11 I can see a monopole of unknown length without ground plane (speaker refers to it as "dual band" which says not much, could be e.g. for 2m/70cm amateur bands), directly plugged into an AIRSPY mini. He tuned to 412 MHz, probably an integer multiple of the pixel-clock frequency of his targeted video mode, and a 70-cm-band rod antenna (intended for 430-440 MHz) would still not be hopeless at 412 MHz. But note that his antenna seems less than 20 cm from his HDMI cable/adapter, so this is a very unchallenging near-field setup, where almost any piece of wire will pick up something.

If you want to put together a basic HDMI video-emissions rasterization demo, I would suggest to try not only different antennas but also different eavesdropping targets, in particular different HDMI outputs and different HDMI cables. DVI/HDMI were designed to emit nothing at all (they transmit a positive and a negative copy of the data simultaneously over twisted wire pairs, which are meant to cancel out each others emissions, i.e. "symmetric" or "balanced" transmission lines). In practice, you still get often plenty of emissions due to manufacturing imperfections: the drivers feeding the + and − wires do not output exactly the same waveforms (e.g., positive and negative edges have different slopes), and the wires do not have exactly identical impedance. But because these are unintentional manufacturing variations, they are randomly distributed. The emissions from different graphics outputs and different cables (even the same model) can vary significantly. Therefore always try several.