Echo TEMPEST: EM Information Leakage Induced by IEMI for Electronic Devices

• Published in: IEEE transactions on electromagnetic compatibility Vol. 65; no. 3; pp. 655 - 666
• Main Authors: Kaji, Shugo, Fujimoto, Daisuke, Kinugawa, Masahiro, Hayashi, Yuichi
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.06.2023; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Antenna measurements; Eavesdrop; electromagnetic emanations; electromagnetic information leakage; Frequency measurement; hardware security; Impedance; Impedance measurement; information security; Input impedance; Integrated circuits; intentional electromagnetic interference; Inverters; Keyboards; Leakage; Sensors; TEMPEST
• DOI: 10.1109/TEMC.2023.3252636
• ISSN: 0018-9375

Electromagnetic (EM) information leakage encourages attacks, wherein the attackers passively capture and analyze EM waves that are unintentionally generated by devices. Generally, devices with weak EM emission intensities are not targeted. However, even these devices would be subject to attacks if it becomes possible to actively sense the electrical changes that occur within them when information is processed. This article demonstrates the feasibility of the information leakage threat induced by the active sensing of input impedance changes in the input/output (I/O) circuit of an integrated circuit (IC). Specifically, the changes in the input impedance when information was transmitted from the IC, were measured by irradiating the EM waves from outside the target device. This article labels the threat as Echo TEMPEST. The experiment validated Echo TEMPEST with an evaluation board that simulated the I/O circuit of the IC, UART modules, and USB keyboards. It was also demonstrated that attackers could control the distance (obtained information from the target device), depending on the intensity of the irradiated EM waves. Furthermore, we discussed countermeasure methods focusing on the conditions for executing Echo TEMPEST.