3-13 a trial of the interception of display image using

213TANAKA Hidema et al.

1 Introduction

In recent studies on encryption and otherinformation security technologies, moreresearchers are focusing on countermeasuresagainst attacks aimed at gaining confidentialinformation by methods other than electroniceavesdropping on communication channels. In“side-channel attacks”, attackers interceptinformation revealed unintentionally throughphysical processes or gain confidential infor-mation by exploiting hardware defects. Side-channel attacks are classified depending onwhether attackers establish access to attack tar-gets, and on whether attackers sabotage attacktargets to cause the targeted devices to operatein ways other than originally intended［1］. Vari-ous physical properties are exploited byattackers for side-channel attacks, includingthe amount of power consumed, emissions oflight, electromagnetic waves, or ultrasonic

waves, etc. Additionally, various methods ofattack are available: methods in which nophysical contact is made with the targeteddevice, destructive methods based on somemechanism within the device, and methodsthat involve some combination of the two. Akey task when assessing these potentialattacks is to measure observable physicalproperties in a realistic environment and toevaluate these properties in detail. In contrastwith computation-theory security models,Micali and Reyzin have formulated and pro-posed a model of security against physicallyobservable attacks that exploit informationleaked from physical processes［2］. Their aimwas to show, within a logical framework, thesort of cryptographic primitives that can beused to enable secure encrypted communica-tion given certain observable physical proper-ties. Achieving this aim requires measuringand confirming observable physical properties

3-13 A Trial of the Interception of DisplayImage using Emanation of Electromag-netic Wave

TANAKA Hidema, TAKIZAWA Osamu, and YAMAMURA Akihiro

This paper describes the experiments and analysis of the interception of personal comput-er’s display image using emanation of electromagnetic wave. We used personal computers asthe targets and experimented on reconstruction of screen information under the following equip-ments and environments; (1) using a near magnetic field probe, (2) using an antenna from awayplace, (3) using an injection probe over power supply cable. From the result of (1), we show thatthe slight difference in the synchronous frequency of video signal among PCs will become thekey which recognizes the target. In the experiment (2), we succeeded from about 4 meters awayplace with frequency which is inside of VCCI regulations. In the experiment (3), we succeededfrom about 30 meters away place, and we found that the position relation between a probe andAC adapter is dependent on results.

KeywordsElectro-magnetic wave, Side-channel attack, TEMPEST, Security, EMC

214 Journal of the National Institute of Information and Communications Technology Vol.52 Nos.1/2 2005

in a real-world environment. Electromagnetic waves are generated by

the operation of equipment comprised of high-frequency circuits such as personal computers(referred to simply as “computers” below);these waves emanate from the equipment.Electromagnetic emissions can be consideredto pose two threats to information security.First, there is the risk that signals may beintercepted during encryption processing, pro-viding attackers a key in cryptanalysis. Sec-ond, in a risk unrelated to cryptanalysis, confi-dential user information may be intercepteddirectly.

This paper reports on the results of experi-ments on potential threats of the second type.If screen images on computers can be inter-cepted, confidential information from othercomputers on the network can also be inter-cepted, rendering network security policiespowerless. Methods of intercepting screenimages from CRT monitors and the like havebeen known for quite some time, and themethods themselves are regarded as highlyconfidential information. This consideration—and the fact that experimental results dependgreatly on the equipment and environment,making quantitative analysis difficult—account for the scarcity of published docu-ments featuring detailed procedures (includingspecific measurement values) and clearresults. Specifically, it is indispensable that thequality and quantity of leaked data, the equip-ment, and methods of the experiment be clari-fied when discussing security that addressesthe model of physically observable attacksproposed by Micali and Reyzin. Thus, in thispaper we discuss the results of experimentsusing actual equipment, reporting on a proce-dure for intercepting electromagnetic wavesthat reveals computer-screen images. Our aimwas to provide an index of technical factorsinvolving the emission of the waves, the quali-ty and quantity of leaked information, the costof staging attacks, and the cost of defensivemeasures.

2 Classification of electromagnet-ic emission interception

Content subject to leaking and contentsubject to interception through electromagnet-ic emission are classified in terms of equip-ment input and output data. These are summa-rized in tables 1 and 2［3］. In addition to screenimages, keyboard strokes and printed text arealso at risk of interception. This means, forexample, that even passwords not displayedon-screen may be intercepted.

Screen images and keystroke signals in thefinal link of the human-machine interface oncomputers and other information and commu-nication devices represent information provid-ed directly to users. Thus, these signals cannotbe encrypted, and if they are emitted as elec-tromagnetic waves, conventional security pro-tection technology cannot prevent intercep-tion. Proposals have thus called for device-based measures that maintain electromagneticemissions from information and communica-tion equipment below a prescribed level, aswell as measures for electromagnetic shieldingof buildings and more secure methods ofequipment installation and setup［3］.

Table 1 Interception of output information

Table 2 Interception of input information


3 Experimental equipment andtargets

With respect to the means of interceptiondescribed in Table 1, we conducted experi-ments to intercept electromagnetic emissionsfrom computers and to recreate screen imagesfrom targeted computers. In the experiments,we used a Rohde & Schwarz FSET22 testreceiver (Fig.1) and SystemWare FrameCon-trol Ver. 4.24 as an image-processing applica-tion. The test receiver specifications are givenin Table 3. FrameControl supports processingof input signals from the test receiver at 256frames/3 sec. Real-time image processing isavailable by averaging up to 256 frames. Asthe near-magnetic field probe, an AnritsuMA2601B (frequency bandwidth: 5 MHz to 1GHz) was used; as an antenna, an AnritsuMP666A log-periodic antenna (frequencybandwidth: 20 to 2000 MHz) was used; and as

the injection probe, an NEC Tokin EIP-100(frequency bandwidth: 80 kHz to 30 MHz)was employed (Figs.2 and 3). The MA2601Boffers conversion coefficient values for mag-netic field strength to measured voltage of 35dB at 5 MHz, 12 dB at 100 MHz, 8 dB at 500MHz, and 10 dB at 1 GHz［4］. Meanwhile, theMP666A offers conversion coefficient valuesfor magnetic field strength to measured volt-age of +3 dB at 100 MHz, -14 dB at 500MHz, and -21 dB at 1 GHz［4］.

We used desktop and notebook computersas interception targets. The experiments wereconducted on desktop computers equippedwith three types of video cards (ATI Radeon9700, NVIDIA GeForce2 MX/MX400 PCI,and NVIDIA GeForce3 Ti500) and a notebookcomputer equipped with a graphics controller

Fig.1 Test receiver used in the experi-ments

Table 3 Specifications of test receiverused in the experiments

Fig.2 Equipment used

Fig.3 Method used


integrated in the motherboard (Intel82845G/GL), for four different video proces-sors in all. The desktop and notebook comput-ers thus equipped are hereinafter referred to as“desktops” and “notebooks”, respectively. ASony VAIO V505 was used as the notebook.For the displays, a Dell 16” LCD display(hereinafter, “LCD”) and a Nanao FlexScan77F 21 21” CRT display (“CRT”) were select-ed. On the desktops, the screen depicted inFig.4 was displayed and targeted for intercep-tion, and on the notebook, that of Fig.5 wasdisplayed and targeted.

4 Experimental results

4.1 Experimental equipment andinterconnections

Table 4 summarizes the experiments

described in this section, as well as the equip-ment and connections between various com-ponents. In the table, the plus symbol [+] indi-cates that the devices shown were used incombination. For example, “Desktop+LCD”indicates that the experiment was conductedon a video processor-equipped desktop com-puter connected to an LCD display.

When desktops were targeted, the resultsof experiments using the antenna and near-magnetic field probe were nearly the same forthe Desktop+LCD configuration as for theDesktop+CRT setup. Thus, the discussion ofresults here is limited to those for the Desk-top+LCD configuration (experiments A andC). Furthermore, the experiments were con-ducted in an ordinary test room, not in an elec-tromagnetically shielded environment such asan anechoic room.

4.2 Experiment using a near-magneticfield probe

Intercepting screen images requires anaccurate grasp of the synchronous frequencyof the video signals of the target equipment.Devices have unique synchronous frequencies,which are unrelated to the frequency bands ofthe relevant electromagnetic emissions. Thus,in this experiment, we verified the potential ofobtaining the synchronous frequency by bring-ing the near-magnetic field probe into contactwith equipment housings used as interceptiontargets, as depicted in Fig.3.

The following section describes the exper-imental procedure and results with the ATIRadeon 9700 card (experiment A).

Fig.4 Screen targeted for interception onthe desktops

Fig.5 Screen targeted for interception onthe notebook

Table 4 Experimental equipment config-urations


[Step 1]Synchronous frequency is standardized by

the Video Electronics Standards Association(VESA) according to screen width and num-ber of colors［5］. In this experiment, the hori-zontal and vertical synchronous frequency ofthe interception targets was set at 64 kHz and60 Hz, respectively. These synchronous fre-quencies were also set as initial values on thetest receiver. [Step 2]

To find the positions on the interceptiontargets at which the electromagnetic emissionsfrom the equipment housings were strongest,we brought the near-magnetic field probe intocontact with the target equipment at variouslocations. As a result, we observed the follow-ing tendencies regarding the locations atwhich electromagnetic emissions were mostapparent.

• Around the connectors on the body• Around the connectors on the display

side• Around the display buttons and LCD

bezelThe positions at which emissions are most

apparent are indicated in Fig.6.

[Step 3]The intercepted screen was observed to

find the reception frequencies most suitablefor interception. At this stage, only the recep-tion frequency was adjusted, not the synchro-nous frequency set in step 1. Computers gen-

erate electromagnetic waves in a variety offrequencies, so several reception frequenciesare potentially suitable for screen interception.In our experiment, reception frequencies of500 MHz to 1 GHz were often found suitablefor screen interception using a near-magneticfield probe. [Step 4]

Most of the reception frequencies of step 3merely produced screens of video noise, asshown in Fig.7. However, particular receptionfrequencies yielded screens showing featuresof the screen images of the interception tar-gets. In the case of the ATI Radeon 9700, thisphenomenon appeared at around 530 MHz. Aswe approached the optimal reception frequen-cy, we obtained a somewhat out-of-syncscreen, as shown in Fig.8. The experimentalequipment does not support reproduction ofcolor information, so a monochrome screen

Fig.6 LCD display positions at whichstrongest apparent electromagneticemissions were observed (circled inwhite)

Fig.7 Screen with video noise, before tun-ing

Fig.8 Intercepted screen (unprocessed),after tuning


was displayed even if the original screen wasin color. [Step 5]

As indicated in Fig.8, the screens obtainedwere not still images, but instead, moved ver-tically and horizontally. The horizontal andvertical synchronous frequencies were thenadjusted to stabilize the image. The experi-mental equipment we used supported adjust-ment in increments of 10-6 kHz for the hori-zontal synchronous frequency and 10-6 Hz forthe vertical synchronous frequency. At thispoint, we adjusted the reception frequency andsearched for suitable contact positions for theprobe. For a clearer picture, we also set up amethod of averaging several frames of theintercepted screen. As a result, we were ableto stabilize the intercepted screen as shown inFig.9. Text in 10-point font or larger was legi-ble on this intercepted screen. In Fig.9, thetask bar on the bottom of a screen in Windowsis visible above the black horizontal bands inthe middle, and the clock at the far right wasalso legible.

[Conclusion of Procedure]The above procedure was repeated using

the notebook computer (experiment B). With the notebook, we observed the fol-

lowing tendencies regarding the positions atwhich electromagnetic emissions were mostapparent.

• By the hinge above and to the left of thekeyboard, when the LCD screen was

open• Around the left bezel of the LCD screen• Behind the hinges and LCD screen• Over the entire keyboardThe positions at which emissions were

most apparent are indicated in Fig.10. Theintercepted screen is shown in Fig.11.

Synchronous frequencies are given inTable 5 for experiments A and B followingboth procedures. As shown in Table 5, therewas slight variation in the measured synchro-nous frequencies, probably due to a lack ofuniformity in the constituent parts and otherfactors. In any particular item of equipment,however, there was little fluctuation over time.The variation has no effect in regular use, butin screen interception based on electromagnet-ic emissions, changing the measured synchro-nous frequency by values in the hundredths ofunits upsets synchronization greatly, makingthe intercepted screen unrecognizable. This

Fig.9 Clearest screen intercepted inexperiment A

Fig.10 Positions on the notebook atwhich strongest electromagneticemissions were observed

Fig.11 Clearest screen intercepted inexperiment B


means that extreme precision is required inmatching synchronous frequency to interceptscreens based on electromagnetic emissions. Italso means that even in an environment withseveral computers running at once, it is possi-ble to target one screen for interception basedon its distinctive variation in synchronous fre-quency.

4.3 Experiment using an antenna After a near-magnetic field probe is used

to gain an accurate grasp of the synchronousfrequency, it is easy to intercept free-spaceradiation with an antenna. Thus, we conducteda subsequent experiment to intercept desktopand notebook screens using free-space radia-tion (experiments C and D).

The experimental environment is shown inFig.12. In experiment C, the ATI Radeon 9700was used as the video card. The test receiverwas adjusted to the obtained synchronous fre-quencies (horizontal: 63.892403 kHz; vertical:59.9362 Hz), and screen interception wasattempted with the antenna at a distance of 4m from interception targets. For a clearerscreen image, the frequency band for intercep-tion and the antenna orientation were adjustedwhile viewing the intercepted screen. Anexample of an intercepted screen is shown inFig.13. In experiment C, reception frequenciessuitable for interception were found at around919.9 MHz. Text in nine-point font or largerwas legible.

Experiment D was conducted similarly,but values were measured for the notebook.An example of a screen intercepted from 4 maway is shown in Fig.14. In experiment D,reception frequencies suitable for interception

were found at around 844.8 MHz. Text innine-point font or larger was legible. Figure15 shows an example of a screen interceptedfrom a distance of 6 m in experiment D. Here,reception frequencies suitable for interceptionwere found at around 989.4 MHz. Althoughtext was hard to read, movement and changeson the screen were recognizable, such as whenapplications were launched or when screensavers were triggered. Thus, attackers wouldbe able to make inferences as to user tasks.

In this experiment, interception was possi-ble whether the desktop display was a CRT oran LCD, and the reception frequencies werethe same. Clearer screens were not necessarilyobtained simply by aiming the antenna at theinterception target. In many cases, receivingelectromagnetic waves reflected from walls orother surfaces yielded a clearer screen. Thus,

Table 5 Synchronous frequency tuningresults

Fig.12 Experimental environment forinterception using an antenna

Fig.13 Clearest screen intercepted inexperiment C


some trial and error is required in finding anantenna orientation suitable for interception.

Additionally, the intercepted screen wasupset by the movement of people coming andgoing in the experimental environment. Thiswas particularly noticeable when people camebetween the antenna and the interception tar-get. For electromagnetic waves of 1 GHz andbelow, regulated by the Voluntary ControlCouncil for Interference by Information Tech-nology Equipment (VCCI)［6］, computersmanufactured by Japanese companies wereexpected to feature fewer electromagneticemissions. However, screens were interceptedby tuning to frequencies of 1 GHz and belowas well. Thus, we must be careful even undercurrent voluntary regulations, as screens canbe intercepted even from trace electromagnet-

ic waves. Furthermore, we confirmed thatscreens can be intercepted in the same mannerat frequencies around 1.2 GHz as well.

4.4 Experiment using an injectionprobe

This section presents our experiment onintercepting emissions via power cable as thecable passes through an injection probe.Unlike free-space radiation, electromagneticwaves are easily conducted over cables, inwhich they are usually found at low frequen-cies. Thus, for the experiment in this sectionwe targeted a low range of frequencies forinterception, 30 MHz and below, in contrast tothe high interception range targeted in the pre-ceding experiments (i.e., 500 MHz andabove).

When testing both LCD and CRT screens(experiments E and F, respectively) as thedesktop output devices, interception was notclear in experiment E, but in experiment F,text in 20-point font or larger was faintly legi-ble.

On the other hand, when targeting thenotebook (experiment G), results varieddepending on the position of the AC adapter.Two conditions can be imagined (conditions Iand II) based on the position of the probe, asshown in Fig.16. Results indicated that inter-ception was possible under condition II, butsometimes impossible under condition I. Thismay be a result of the properties of certain ACadapters that block emission of the screen sig-nal through the process of converting alternat-ing current to direct current within the adapter.These properties may have led to incompati-bility between the adapter and injection probe.

We conducted an experiment taking intoaccount likely use of typical notebooks, dis-

Fig.14 Clearest screen intercepted inexperiment D, at 4 m

Fig.15 Clearest screen intercepted inexperiment D, at 6 m

Fig.16 Positions of the AC adapter andprobe


playing the screen output from the computeron a CRT (experiment H). The experimentalenvironment in experiment H is shown inFig.17. Here, a 30-m extension cord was usedto supply power to the notebook and CRT, andthe injection probe was fitted to the extensioncord near the wall outlet. Results reflectedthose that would have been obtained if theprobe had been used 30 m from the intercep-tion target. The intercepted screen is shown inFig.18. The reception frequency was 23.8MHz, and Fig. 18 shows the result of averag-ing for 128 frames. Text in 12-point font orlarger was legible. It was also possible to dis-cern movement and changes on the screen, aswith screen savers and the like. Figure 19shows an enlarged view of the lower-rightportion of Fig.18. As the figure illustrates, textwith easily recognizable features is legible,such as numbers or katakana characters. Notethat although the extension cord is showncoiled in Fig.17, the intercepted screen wasjust as clear when the cord was unwound andextended.

5 Discussion

Based on the results of the experiments onscreen interception from electromagneticemissions presented in the preceding section,we have drawn the following conclusionsregarding reception technology.

• Positions from which electromagneticwaves emanate vary depending on thehousing material and shape of the target.

• Differences between CRT and LCDmonitors do not affect the difficulty ofinterception.

• From the standpoint of interception diffi-culty, there is no difference between tar-geting desktops or notebooks.

The synchronous frequencies of video sig-Fig.17 Environment of experiment H

Fig.18 Clearest screen intercepted inexperiment H

Fig.19 Screen of Fig.18, enlarged


nals are standardized by VESA specificationaccording to screen size and number of colorsdisplayed. We determined the following withrespect to this synchronous frequency value.

• Slight variation is seen compared withspecification values.

• Variation in synchronous frequency isdistinctive to particular items of equip-ment. This feature can be used to identifycomputers targeted for interception.

Furthermore, we have determined the fol-lowing characteristics regarding electromag-netic waves targeted for interception.

• Even trace electromagnetic waves of 1GHz and below, regulated under VCCIregulations, can be intercepted.

• Interception through power lines is possi-ble.

However, the success or failure of inter-ception through power lines tends to dependon issues such as compatibility between theadapter and probe when targeting notebooksor LCD monitors with an interposing ACadapter or similar device. For typical desktopsand CRTs, interception is easy even at rela-tively far distances or with obstacles. Thus,these targets are easily susceptible to realthreats.

Table 6 summarizes the relationshipbetween relative difficulty and threat in eachexperiment. The ◎ symbol indicates thatscreens could be intercepted to reproduce textlegible to most people without much difficul-ty. The ○ symbol indicates that screens couldbe intercepted to reproduce text that was legi-ble to the experimenters. The × symbol indi-cates that text was not legible. In cases marked○/×, different results were obtained depend-ing on the relative position relationshipbetween the AC adapter and probe, as shownin Fig.16. The – symbol indicates that noexperiment was conducted. Notwithstandingthese results it is difficult to evaluate objec-tively whether the text on intercepted screensis legible and can be interpreted. Context andprior knowledge are factors. The primaryobjective of presenting the specific experi-mental methods in this research was to enable

third parties to reproduce the experiments.Thus, the results in Table 6 are limited to thesubjective evaluations of the experimenters. Inthe future, it will be necessary to investigateobjective evaluation methods, especially forexperiments yielding results in the “○” cate-gory.

As shown in Table 6, when an injectionprobe is used, interception is possible target-ing fixed equipment such as ATM machines orelectronic voting systems, so the threat is mostpressing in these cases. Interception may bepossible, for example, if the attacker hasaccess to the same power transformer used forthe target, even if the latter is in another room.Screen interception using an antenna alsoposes a threat, but the required size of theantenna depends on the reception frequency,so attackers in these cases may require largerdevices. Reception is also susceptible to obsta-cles, which render interception difficult. If anear-magnetic field probe is used, it is easy tointercept clear screens; however, the probemust in this case be in contact with the targetequipment. It is thus hard to imagine as a real-istic threat. Thus, we may conclude that thelevel of real threat posed is inversely propor-tional to the clarity of the screens obtained. Inany case, we have shown that screen intercep-tion is possible with current technology, andwe can conclude that with progress in technol-ogy in electromagnetic-wave reception andadvances in image processing, it will be criti-cal to develop countermeasures against screeninterception from electromagnetic emissions.

6 Conclusions

This paper presents, in greater detail than

Table 6 Relative difficulty and threat ineach experiment


References01 J.J.Quisquater and F.Koeune, “Side Channel Attacks”, CRYPTREC Report 1047, 2002. (available at

http://www.ipa.go.jp/security/enc/CRYPTREC/fy15/doc/1047_Side_Channel_report.pdf)

02 S.Micali and L.Reyzin, “Physically observable cryptography”, Theory of Cryptography Conference 2004

(TCC2004), Lecture Notes in Computer Science, Vol.2951 Springer-Verlag, pp.278-296, 2004.

03 IST(Information Security Technology Study Group) report 2002.

04 Anritsu products catalog 2004.

05 http://www.vesa.org/, 2004.

06 http://www.vcci.or.jp/, 2004.

seen in previous reports, specific experimentalequipment, procedures, and results relating tothe potential for intercepting computer screenimages through electromagnetic emissions.We found that the success of screen intercep-tion varies depending on the experimentalenvironment, including the various devicesinvolved. Thus, this paper is limited to qualita-tive evaluations for a few interception targets.

We nevertheless hope that this paper willserve as a significant resource in its presenta-tion of an experimental outline that is suffi-ciently specific to enable others to reproducethese experiments, and we would be pleased ifthe results of this paper can contribute to thedevelopment of research on policies to dealwith interception of electromagnetic emis-sions.

TANAKA Hidema, Ph.D.

Researcher, Security FundamentalsGroup, Information and Network Sys-tem Department

Cryptology, Information security

YAMAMURA Akihiro, Ph.D.

Group Leader, Security FundamentalsGroup, Information and Networks Sys-tems Department

Information security, Cryptography,Algebraic systems and their algorithms

TAKIZAWA Osamu, Ph.D.

Senior Researcher, Security Advance-ment Group, Information and NetworkSystems Department

Contents Security, TelecommunicationTechnology for Disaster Relief

3-13 a trial of the interception of display image using

Documents