|
I'd wager that, here in America, most individuals assume they're being surveilled or potentially hacked at any given moment. If it's not the NSA, it's the suspiciously bearded guy at the table next to you at Starbucks, furiously typing away in order to drain your life savings as you pay your trash bill online.
Cell phone surveillance and government monitoring of internet search behavior have become assumptions, but the general public is now becoming increasingly aware of, and concerned about, radio frequency (RF) surveillance and hacking. Let me explain in this latest edition of CR4's Ditch-Your-Devices-And-Hide-In-A-Cave series.
RF surveillance is not a new concept. The US government was concerned enough about leaking unintended emissions to implement their partially classified TEMPEST shielding standards in the early 1980's. In 1985, Wim van Eck (of the eponymous "van Eck phreaking") eavesdropped on a distant computer monitor and recorded system usage data using a basic VHF antenna and a TV set.
RF hacking registers detected activity as spikes on an RF spectrum, so unlike data hacking it's extremely difficult to discern the contents of a transmitted message or operation. In this context, it seems to be a relatively benign security threat, but a host of recent events and research have shown otherwise.
There are two main issues that have thrust RF eavesdropping into minds of the paranoid populace. The first is that a very large portion of electronic devices emit unintended RF, and I don't need to remind you that these devices-laptops, tablets, smartphones, music players-are omnipresent in our society. Every time you press a key or open an app, your device spews an emanation on a relatively predictable frequency.
The second factor consists of only three letters: SDR. Software-defined radio has undergone amazing advances in the recent past, with equipment becoming cheap enough for widespread consumer operation. With a $20 SDR dongle and open source software, a savvy user can potentially monitor emissions over a huge range of the RF spectrum, from amateur and broadcast radio to 900 MHz walkie-talkies. With a little more equipment and knowledge, the same user could receive and transmit over an even wider spectrum.
Like most cool technologies, RF offers the maliciously minded a host of opportunities, such as listening in on and transmitting over hospital and emergency communications, trunked radio, and air traffic control. But as this embarrassingly slow presentation (eventually) points out, bad guys could triangulate you and your devices simply by monitoring emissions from an active screen, even if your networking functions are switched off. A whole host of RF-dependent devices in modern homes, from smart meters to automation systems and car fobs, can be and have been hacked.
But what can I, the humble CR4 blogger, do to keep my RF in check? I'll need a suitable Faraday cage, for starters. Application security researchers have recommended moving about with your devices in booster bags (less suspicious than coating them in aluminum foil, maybe) and even placing them in a closed microwave and running a shielded cable to your body. To the anticipated chorus of "Switch it off!", the same researchers retort that this isn't always good enough, and only removal of a battery or power supply (if possible) eliminates all emissions.
While it might be a chore to worry about data security AND network security AND RF monitoring, RF networking is likely to increase due to the predicted development of the Internet of Things (IoT) concept. Unfortunately, we might not see any effective preventive measures roll out until hacking becomes widespread, as in the development of Wifi's WPA and WPA2 protocols.
Image credits: Luke McKernan | CyberGibbons
|
"Almost" Good Answers: