THE TEMPEST METHOD OF COMPUTER DATA INTERCEPTION!
-----------------by Al Muick for P-80 Systems, OCT 86----------
Let me begin by a brief history of myself. I spent the better part of six years in Uncle Sam's Country Club (better known as the US Army) working in the Intelligence and Security Command (better known as the ASA--Army Security Agency). During that time, my primary duties were Cryptology, Cryptologic Intercept, Counterintelligence, and Field First Sergeant (whatta drag!).
What I'm about to tell you comes under the heading of Cryptologic Intercept. Incidently, for those of you in the know, I was stationed at Field Station Augsburg in West Germany (if you're not in the know, read the book, THE PUZZLE PALACE).
The interception of radiated data from computers and computer terminals is known in the world of the ASA as "TEMPEST." TEMPEST intercept may be accomplished in several ways. One, is via a mobile van with the commo equipment on board, two is via strategicly stationed intercept sites (Field Station Augsburg) and the third, rarely used, is relay from one site to another.
To run a TEMPEST operation, you will need a good communications receiver, both high frequency and very high frequency with adjustable bandwidths and a VFO. If you plan to just intercept and leave the exploitation of the collected intelligence for later, you will need a HIGH-QUALITY tape deck; not one of those cheap-assed portables, but a high quality deck. If you plan to do the exploitation now or later, you will still need to convert the IF of your communications receiver to a recordable frequency. To do this, simply patch the output of your 1 MHz or below IF to the input plug on your tape deck. If your IF is something above 1 MHz you're S.O.L unless you have an IF downconverter around or have the ability to construct one. You will, in effect, be recording an RF frequency on your tape deck, vice an audio frequency.
Your tape deck MUST run at either 7 1/2 or 15 i.p.s in order for it to record this signal. You will later play that signal back into your IF for exploitation.
As soon as you have your intercept station (it is best to use a van) set up with receiver, antenna, and recorder, you are ready to engage your intercept target. Most computers are RF shielded these days, so your receiver had better be damn sensitive and have a very selective bandwidth. If you are planning to intercept such a computer, you will need to be outside its building location (if possible). Since we know, most microprocessors operate at frequencies between 2-12 MHz, we will look for the radiated data here in that frequency range. It is here that a spectrum analyzer, connected to your IF output will aid in discerning the signals and binary emissions of your target computer. If you know how to use a spectrum analyzer, it will prove invaluable, but since they are so complicated, I will not attempt to explain their proper use here.
You will simply scan the bands between 2-12 MHz until you find the radiated signal (if you must, go for the 2nd, 3rd, 4th, etc. harmonics if local interference on the primary frequency is too high) and then tune to the spot where it comes in best. Next adjust your bandwidth until you can just hear the signal as pure as day, with very little to no outside interference.
Once you have your target tuned in, you may want to drive around the block or further away, to avoid detection. Remember, not to go too far or you will lose the signal. Mainframe computers (when unprotected) sometimes radiate a signal for 3 to four miles! A typical PC computer will radiate a signal for at least 1/2 mile if unprotected!
You should, by now, have picked your intercept site, have parked the van, and have made sure that you still have your signal coming in at good strength. The next step is easy! Simply connect the output of your low frequency IF to the input of your deck and let 'er rip! I find that 10" reels suit this purpose just fine, and you should be able to get at least one or two UIDs or PWs in the amount of time you will have at 7 1/2 or 15 i.p.s. After the tape is done (you may want to record both sides) pack up your gear and head for home!
Once home, you will need another piece of equipment, possibly two. In various surplus magazines, you will see a machine called a "visi-corder" advertised. This is a machine that burns a copy of binary code onto light-sensitive paper. They cost some money, but are basically invaluable. You are now ready for signal exploitation.
You now need to play your recorded tape into the IF input of your communications receiver. The output of your IF will be connected to the IF input on the visi-corder. This will give your the truest binary representation on the paper. If you so desire, you may connect the audio out of your communications receiver to the audio input of the visi-corder. The audio is rectified into DC and then you get a crisp, clear presentation on the paper. But remember this....DC LIES!!! While the representation may be clear, the binary spacing will be off slightly, increasing in error as you continue, until you finally wind up with continuous error.
Assuming you have made the proper connections, get some beer for your relaxation (or them funny l'il pills, or whatever makes you relax....here comes the hair-pulling part). Begin playback of the deck into your receiver and initiate the visi-corder's print mode. I recommend a medium-fast speed, because if you use slow speed to conserve paper (you cheap fucker!), the bauds will be so close together as to render the paper useless and wou wind up wasting the paper anyway!
At this point, print out about 2 minutes worth of paper. Once the paper is printed, expose it to light so it develops and have several 3x5" cards handy. As soon as it develops, scan the paper and the binary stream on it for a section that has three or four of the smallest (closest together) bits. This is ASCII. Once you have found the section, place one 3x5" card at the base of the section and mark off tick marks where each bit stops and ends (on the smallest bits only!!). You are now ready to do what we in the ASA call "bustin' bauds."
As you know, one ASCII byte consists of 8 bits. simply start at a reasonable point at the beginning of your interception and begin to mark off tick marks along the binary stream. Even if you come across 1s and 0s that are very wide, mark as many thin ticks from your 3x5" card on them. This is necessary to break the ASCII code.
The complete 8 bit ASCII code is at the end of this tutorial for your convenience.
Once you have marked off the paper, count off the first eight bits, e.g. 10011101 and refer to the ASCII chart to find a character that fits it. If you can't find one immediately, don't despair! Try using the complement of the 8-bit code in front of you (i.e. the reverse of what you've decoded. Instead of 10011101, try 01100010.). If you still have not found anything, slide your card over one bit and try to get another byte of ASCII. This time you may come up with 00111010 (complement 11000101). Check it with the table. Remeber, you may have to do this eight times (that is, shift a bit over eight times) before you make any sense out of it. It is long and tedious, but it will pay off in the end.
Note: this is illegal and is punishable under federal law. I assume no responsibility for your actions, and neither does the operator of P-80. This is presented for your information only. If you have any questions, please leave me mail!......happy hacking!....Al Muick.
ASA LIVES FOREVER!!
The 8 bit ASCII code:
(for 7 bit ASCII, simply delete the last bit...it's not always there...something to keep in mind....al)
BINARY MEANING
00000000 Null 10000000 Start of message 01000000 End of address 11000000 End of message 00100000 End of transmission 10100000 WRU (Who are you?) 01100000 RU (Are you...?) 11100000 Bell (audible signal) 00010000 Format effector 10010000 Horizontal tabulation or skip (for card puncher) 01010000 Line feed 11010000 Vertical tabulation 00110000 Form feed 10110000 Carriage return 01110000 Shift out 11110000 Shift in 00001000 Device control reserved for data link escape 10001000 Device control 01001000 Device Control 11001000 Device Control 00101000 Device control (stop) 10101000 Error 01101000 Synchronous idle 11101000 Logical end of media 10001000 Information separator 10011000 Information separator 01011000 Information separator 11011000 Information separator 11001000 Information separator 11011000 Information separator 11101000 Information separator 11111000 Information separator 00000100 Word separator (space, normally non-printing) 10000100 ! 01000100 " 11000100 # 00100100 $ 10100100 % 01100100 & 01110100 ' 00010100 ( 10010100 ) 01010100 * 11010100 + 00110100 , 10110100 - 01110100 . 11110100 / 00001100 0 10001100 1 01001100 2 11001100 3 00101100 4 10101100 5 01101100 6 11101100 7 00011100 8 10011100 9 01011100 : 11011100 ; 00111100 < 10111100 = 01111100 > 11111100 ? 00000010 @ 10000010 A 01000010 B 11000010 C 00100010 D 10100010 E 01100010 F 11100010 G 00010010 H 10010010 I 01010010 J 11010010 K 00110010 L 10110010 M 01110010 N 11110010 O 00001010 P 10001010 Q 01001010 R 11001010 S 00101010 T 10101010 U 01101010 V 11101010 W 00011010 X 10011010 Y 01011010 Z 11011010 Left bracket 00111010 Reverse slash bar 10111010 Right bracket 01111010 Up arrow 11111010 Left arrow 00000110 Unassigned 10000110 Unassigned 01000110 Unassigned 11000110 Unassigned 00100110 Unassigned 10100110 Unassigned 01100110 Unassigned 11100110 Unassigned 00010110 Unassigned 10010110 Unassigned 01010110 Unassigned 11010110 Unassigned 00110110 Unassigned 10110110 Unassigned 01110110 Unassigned 11110110 Unassigned 00001110 Unassigned 10001110 Unassigned 01001110 Unassigned 11001110 Unassigned 00101110 Unassigned 10101110 Unassigned 01101110 Unassigned 11101110 Unassigned 00011110 Unassigned 10011110 Unassigned 01011110 Unassigned 11011110 Unassigned 00111110 Acknowledge 10111110 Unassigned control 01111110 Escape 11111110 Delete/Idle