Home
Creators
Search Recent Random
Posts
Search DMs Popular Hash Lookup Tags Random
Importer
Import FAQ
Register Favorites Keys Review DMs Logout
Community
Telegram ThePornDude
Home Creators Posts Import Register Favorites Logout

Video (at last): IBM TEMPEST AT (Patreon)

Published:
2026-06-27 18:04:41
Imported:
2026-08

Content

I can't actually believe this is done.

https://www.youtube.com/watch?v=rrFYpDdRWKQ

I'll keep this short because you'll be spending enough time already watching the video:

1) It felt completely impossible that this would ever be finished. I really, really need my next video to be shorter.

2) I would love to get this released to the public by Monday, Tuesday at the latest, so if you can find time this weekend to watch and review and let me know if it looks fine, that'd be great. Double points if you actually know the subject matter and can confirm I got it mostly right.

3) I fully expect this won't be the last revision, so if you're going to leave comments, be prepared to post them again on another upload.

Thanks for your patience, everyone. I hope you enjoy the video!

Files

EMR AT RC2

Support me on Patreon: https://www.patreon.com/cathoderaydude Tip me: https://ko-fi.com/cathoderaydude

Comments

Robin Holm

Re: GSM interference in audio, a secondary reason the issue is lessened is that older audio amplifiers basically all used bipolar amplifiers (which have a diode-junction as part of the amplifier input, rectifying the RF signal). Most modern products use CMOS amplifiers that don't have this diode, and many audio opamps are specifically designed to filter RF these days.

Travis Noble

You posted it in time to include "Happy Pride"! Happy Pride Gravis and Daria 🏳️‍🌈 (really enjoying the video so far, stopping at that point in the vid to make this comment haha)

Chasxith

Can only agree! Happy Pride Gravis and Daria :)

Strawberry Daquiri

Ah, PII on used computers, the greatest danger of the value village pc

qdoggie

Re: Power analysis: Literally the approach used for the recent xbox one exploit. Read the power rails to figure out where the code is being executed and how, and work your way back from there. Crazy stuff. Great to see you posting again! Always happy to see new vids.

sdomi

have to head off to sleep soon, only managed to watch the first 20 or so minutes today; only word of feedback so far is that the section with reading from that internal newsletter could be shorter. really excited to watch the rest tomorrow!!

MisfitMaid

Fantastic video! good to see you back at it :) Re: the unshielded floppy drive, I wonder if it's only used for insecure applications where the leakage doesn't matter? A state level actor isn't really going to benefit much from knowing you're installing fukken WordPerfect or whatever. For secure data, it could've been read on a separate drive interfacing over the serial or ethernet interfaces? As mentioned, the cabling's easy to secure, and I imagine it's a lot easier to shield a floppy drive when you don't have to work within the drive bay dimensions. Alternatively, fill devices have been around since the 60s for loading encryption keys onto military radios, perhaps they used something similar for classified info? idk, just speculating

nytpu

Fairly off-topic about the big round connectors on the modern Tempest PC (MIL-DTL-5015) that you mention for one second, I know from a friend that works on civilian spacecraft, that certified versions of those connectors cost *at least* $100 a piece for even like two pin ones, and higher pin counts (as in, like, 15 pins) are *at least* $500 per connector XD. Just an amusing fact that you can't really find out about since most of the certified ones are "call to request a quote" Also, noticed that when talking about "the serial port" at 1:48:06, you accidentally say DB-9 the first time and not DE-9, although you get it right later. I do like imagining the theoretical DB-9 that's the massive DB shield size of parallel ports with only 9 pins lol

Brad Martin

This video is almost as chonky as that machine 😆

Thermo [D G]

@1:33:00 Oh hey! I learned about something similar fairly recently, the Iomega Jaz disks. Very similar concept, except when a hard drive platter could store like, a gigabyte rather than a megabyte. Very strange format, and it seemed like a rather fragile method of storing data; although for a government employee they probably have enough training not to drop the damned things.

Thermo [D G]

Oh, something I noticed at the very end with the credits roll High Roller `Princess Grace, the inventor of sex`'s username overlaps with `Cathode Ray Jacob`. Not sure if this is something to be worried about here, but maybe something to check for next time.

Aaronjamt

This is the sort of thing amateur radio enthusiasts fight with, especially with modern switch-mode power supplies and cheap electronics. Imagine trying to pick up a transmission from the other side of the world when your neighbor turns on their Christmas lights and suddenly all you can hear is god awful buzzing. Love the video and especially the intro! I tried to recreate the TempestSDR demo once before with a $20 RTL-SDR off Amazon and, while I was never able to get it working, I'm sure it'd be possible. With the right knowledge and effort you could certainly make it work for under $100, probably even under $50. I've got a VGA LCD monitor somewhere, so thanks for the nerdsnipe, lol. Regarding the whole "small holes don't let EMI out", the simplest explanation I've heard is: waves that oscillate, do so at some frequency, and because they move at the speed of light (a constant), the distance the wave travels during each oscillation can be measured. If the hole is small enough, the wave won't be able to fit through it, and therefore the signal will be blocked. Dunno if you want to bother trying to edit in an explanation around that, but figured I'd leave that here in case it's helpful. This comes up often for ham radio, a good rule of thumb is that the speed of light is approximately 300,000,000 m/s, so 300M divided by frequency in Hz gives wavelength in meters (for example, the ham band at 144MHz is known as the 2m band). I also do love the mention of side-channel power analysis, also referred to as DPA ("Differential Power Analysis"). I'm a security researcher and have actually used this technique to analyze and reverse engineer software. You can also play the game in reverse, injecting your own EMI into electronics to cause them to misbehave, which if you're careful can actually yield useful results. A somewhat common example of this is dumping firmware from microcontrollers using EMFI ("Electro-Magnetic Fault Injection") to bypass firmware code readout protections. There's tons of videos on YouTube of people talking about doing exactly this.

Travis Snoozy

Nits. The NSA is not part of the army; you reference the army several times, but NSA rolls up (like the army) under the DoD. Technically, yes, you could have a watt or two of AM running through you for any given station if it's a relatively low-frequency station running at 50kW and you're within, like, five miles of it. I'd argue it's _unlikely_, but I'd need to do a lot more math and track the AM stations (their locations, their frequencies, their transmit powers) to prove that. ~1:55:00 - my supposition here is that they wanted to avoid a situation where a non-TEMPEST keyboard could be plugged into the system, and so made the plug incompatible. If I spilled my coffee in shock at reading how The Enemy could do The Thing at The Place, I might be tempted to go one office over and steal a non-hardened keyboard to fix the hardened keyboard I just broke. Additionally/relatedly 2:05:20 -- dsub or dsub. ~2:20:00 - spread spectrum. Entertainment successful.

sdomi

finished watching now. honestly, i think this is one of my personal favourites of yours, and not even because i like the topic THAT much, it just flows so hecking well. you did one hell of a good job with the script and delivery :)

Robert Yates

Some things I noticed: 45:54 In the demonstration moving the antenna to show how quickly the signal falls off, you might want to put an overlay about the Inverse-Square Law or you're probably going to get a lot of comments about it. Then again comments equals engagement so maybe not. 1:47.06 I've not done much networking, but I thought the vast majority ethernet cables were unshielded? 2:28:13 'Cathode Ray Jacob' and 'Princess Grace, the inventor of sex' seem to have had a name collision in the credits roll. Also a bit later on 'Exposure Therapy Photo Lab' and 'StillLynnTheCloset', though that one is not quite as bad.

IrisRealtime

Very interesting video. I recently got into researching how and why devices are tested for radio interference since me and other folks were closely targeting the supply chain of the Steam Machine and Steam Frame. Prepper side of me now also wants a steel cage built in my house for novelty's sake.

Will G.

An IBM Tempest in AT pot? Is that anything?

Pavel Braginskiy

If you go up to the Spark museum in Bellingham, they have a *fantastic* demo, called the Megazapper, of the power of small holes to stop electromagnetism. They blast you with a million-volt lightning bolt, and the only thing keeping you safe is a thin metal cage. I got a cool photo of it, sorry for the crap quality - photographing lightning is hard: https://i.imgur.com/3AchEz9.png

Marcin Wichary

This is a fantastic video. Really nicely done. Sending it to a few friends! I think you’re going to hate this piece of feedback, but: at the end there is a mention that even the Tempest AT will leak some stuff with the case on, and then you show it gets a lot better with tightening just one screw. But how about tightening all the screws? Would that get the leak down to zero? I feel like the video was so close to final (literal and emotional) closure, but I wasn’t sure why we didn’t get that?

Strawberry Daquiri

Oh! If your office is near the waterfront, the interference in your hdmi demo may be from marine VHF radios, the coast guard base has some fairly high power kit since they run marine traffic for Puget Sound

Simon Hill

Congratulations on another marathon (and entirely watchable) video. I think you got everything right, the clearly enormous effort it took to produce was absolutely worth it, not least because the story of this tech simply isn’t well covered elsewhere. I used to work for the National Lottery here in the UK, and they had a SCIF which was used (20+years ago) for discussions of the security measures and gaming mechanics when the lottery was being set up for the first time. They also had an absolutely hilarious James Bond briefcase equipped with a suite of RF detectors and professional handheld bug sweepers in case someone brought something IN to the SCIF. They also used tempest-hardened machines and faraday cages for some aspects of their infrastructure for their improved ability to reject external interference, preventing someone sneaking in a device to (for example) make the random number generator less…random. This ability to reduce the vulnerability of equipment to receiving intentional EMI (as opposed to the reduction in transmission) is the only aspect of Tempest that I don‘t think you really touched on in your video. Finally, I think you are using a large monitor behind the camera (on the wall?) as a preview/comfort monitor and/or autocue. This results in you looking ever-so-slightly off camera all the time; so it’s like you’re avoiding making eye contact. I try to ignore it as I can understand why it’s happening, but I’m surprised you’re not on a through-the-lens teleprompter. I’m sure there are reasons. Anyway, congrats on finally getting this one “in the can” - looking forward to the next!

Chas Becht

Minor correction: Around 50:10 you discuss side channel attacks and say this: "That means, even if your power wiring isn't picking up any EMI, if someone's able to tap into it, they might still be able to extract your crypto keys." That's maybe sorta truish, but in practical terms not really. For side channel power analysis, the signal to noise ratio is terrible. To get a useful signal, you generally measure the DC power rail going into a specific IC, and the smaller it is the better. You want just the chip doing the actual computation (or sometimes RAM/flash power draw can provide a larger signal), but you don't want to fish it out of the noise of say the network card or disk access or any other power draw of the whole system. It is common to modify a board by removing any filtering or decoupling capacitors on the power rails, because they are there explicitly to smooth over the variability in power draw. If you leave all the smoothing capacitors in place, and then measure on the other side of a noisy switch mode power supply, the signal you are looking for is basically gone. The idea of measuring the signal from the actual AC mains wiring somewhere distant from the target machine is just nightmarish. Full nation-state intelligence agency R&D budget? Maybe you could pull something off with heroic effort. But that's just not how this stuff generally works.

Chas Becht

@2:23:49 When talking about DIY gamer PC builds you say: "I have no idea how these things pass FCC certification" The answer is that they don't. You have to get a product FCC certified if you are offering it for sale. (Possibly in certain numbers and small-scale cottage industry PC builders don't have to. I'm not sure exactly when the certification requirements kick in.). The FCC certification is for a particular device configuration, usually including antennas. It depends on exactly what type of FCC licensing you are using. So, for example FRS radios aren't allowed to have user-replaceable antennas, but GMRS radios are. Also, it's not uncommon for consumer electronics to contain radio modules (bluetooth, wifi, etc) that are FCC certified, so that the entire device doesn't have to go through the same certification process. I've seen USB wifi modules with the USB power and data pins soldered down to the main device PCB instead of to a USB A connector. Basically, the manufacturer can tell the FCC that all of the deliberate emissions are on the module which has already passed FCC certification. Then the rest of the device just has to pass part 15 unintentional radiator testing and that's it. It's not unlike the history you mentioned with the Atari 8 bit machines and the heavy die cast chassis to shield the RF modulator. Lots of other manufacturers opted to use a separate external RF modulator, so that it can bear the burder on FCC testing without the rest of the machine.

Chas Becht

@1:57:42 "My first guess was that the only signals leaving here are the H and V sync lines. Those don't really contain any information. They just tell the monitor when to begin each vertical and horizontal scan and you can't derive anything useful by spying on those, so this would still be safe." The sync lines are just as useful/vital to a TEMPEST attacker as they are to any other receiver of the video signal. While, they don't contain image data, they are important for interpreting image data, so still incredibly valuable to have. In an attack context, they also have the added value of acting as a sort of beacon. They are a strong predictable signal of known frequency and character that stands out from the background noise. As soon as you detect the sync signals, you know you are successfully receiving RF of a display format that you are expecting. That means all your equipment is working, and your antennas are roughly aligned. You can then use that to fine tune your antenna pointing, adjust RF filters and tuning or what have you, in an effort to optimize the signal. That first phase of detection and signal acquisition is pretty huge. You can put it all the effort you want after that point trying to improve the signal. But having that first sanity check that the target is emitting, and that you can pick it up and the whole signal chain is working, that's a tremendous milestone.

cathoderaydude

I went for this view of things for two reasons: One, because we *don't* know what's possible, so maybe this really is; and two, because I think the NSA (et al) *are* worried about it, even if they have no proof that it's doable. Since the whole video is meant to be an extreme hypothetical, I felt this reach was acceptable - but I may include an onscreen note in RC3 to express how out-there this is.

cathoderaydude

Oh, I didn't notice any tangible difference doing the rest and it slowed down the pace, so I decided to just move on from there. Oops. Maybe I should have mentioned that.

cathoderaydude

Thanks for the feedback. I don't know *anything* about signal falloff so I didn't bother; I'm just showing what it does, and anyone who knows what that means is free to draw their own conclusions, heh. Regarding ethernet, I was actually referring to the RJ45 connector itself, which does come in a shielded form (for use with STP cable) but is built to such loose tolerances that I doubt it would pass muster. I may put up an explanatory note about that. Thanks for pointing out the credits issue, idk what happened with the autoscroll, heh.

cathoderaydude

Thanks for the feedback! Re the army part, I'm just kinda speaking in the broadest terms here, so some wires might get a little crossed, but while *this* machine was bought by the DOD, I don't believe that ALL the TPCs were intended for them specifically, and "army" is a reasonable metanym for our various military forces and tangential bodies, I felt. Good point about the keyboard plug though - I'm not sure it scales, insofar as they *didn't* change the plug for the far-riskier monitor, but maybe they felt keyboards were more vulnerable to spilled drinks etc. Food (or drink) for thought!

cathoderaydude

Regarding the RTL-SDR - I also started out with one and couldn't get a usable picture, and eventually I learned that they just don't provide enough sampling rate. They theoretically hit the *frequency* (somewhere around 550mhz i think...?) but don't provide enough samples to decode into something legible.

cathoderaydude

Got Patreon'd again. Why on *earth* is enter "post?" Anyway: I'm curious, in reference to another comment I got, whether you agree with my assertion that DPA is possible *from well outside the room?* I was coming from a "the NSA are probably afraid of impossible attacks just in case they exist" angle so I didn't think this hard about it, but their assertion was that DPA is pretty much always performed by splicing into the circuitry at a low level, not by analyzing the bulk power consumption at the AC input. Can you confirm/deny the state of the art there?

cathoderaydude

I always wonder what could possibly eat up *that much* cost to get the price up there. Couldn't even begin to speculate. I'm not sure what you mean with the DE9 thing - if I'm looking at the right spot, I called it DE9, then said it's *also* known as DB9.

Aaronjamt

I wouldn't think it's possible, but I'm not a government agent so I don't know what super-top-secret tech they have access to. For my work, power analysis requires getting hands-on with the target hardware. I'll disassemble a device fully, down to the PCB, desolder capacitors on the power rails (placed there for the purpose of smoothing out noise on the power rails, to prevent weird behavior caused by power spikes or outside interference) and then power the board with my own equipment. Even with super fancy oscilloscopes, you're working on a scale of nanoseconds at most, and noise is a massive problem. I don't think this would be possible remotely, but I'm working with hardware that doesn't want to give me its secrets, so it's a bit of a different problem. I believe you mentioned something like this in the video, but I'm reminded of the "fansmitter" attack, where a piece of malware was able to exfiltrate data from an airgapped machine by modulating the fan speed, and the slight changes in pitch from that were picked up by CCTV cameras and decoded remotely. If you were a threat actor with government-level knowledge and budget, I'm sure you could create a noticeable signal on the power lines, probably just by hammering the CPU and/or GPU in some pattern. The power grid is quite noisy as-is, but the background noise can be (and is) measured. People have apparently proven it's possible to track down exact time/location a video was recorded from the subtle ripple picked up by the microphone, so I wouldn't doubt you could subtract the known background noise and get a clean-enough signal from that.

Aaronjamt

Ah it won't let me respond to a specific comment. I feel your pain, lol. RE RTL-SDR, it can pick up signals up into the GHz (up to around 2GHz IIRC), but yeah the bandwidth is quite limited. There are projects that can use multiple RTL-SDRs at the same time, each tuned to a slightly different frequency, and combine the data from both to be able to handle a larger effective bandwidth. Since they're so cheap, I suspect you could get a handful of them, somehow combine their data feeds, and still have budget left over for a tuned directional antenna. I don't know any of the math behind how you'd actually go about doing such a thing, but I'm sure it's possible.

Pietro Gagliardi

Is the PC still available to purchase? I know you were offering in one of the previous posts... And yes, at least in terms of basic sound engineering, since the wave you're producing with the data bus isn't a pure sine wave, it's going to have harmonic frequencies higher than the root frequency (assuming that AM harmonics are the same thing, anyway...) I am now imagining a fantasy scenario in which the contents of a computer could be intercepted by basically a modern version of The Thing (Leon Theremin's passive bugging device from the 1940s)

Chas Becht

RE: fansmitter, etc exfiltration techniques: This is an important point, and one I should have thought of given the music demo in the video. There's a huge difference between using side channel power analysis on a non-cooperative system operating normally, and having a compromised system running malicious software that is trying to sneak a payload out past the air gaps. It's much more plausible to me that you could detect a signal on the AC mains at some distance away if the system in question is running software that is deliberately trying to create a measurable disturbance. Still not trivial, IMHO, but much more plausible. Enough to be a genuine concern.

nytpu

Zero clue about what could even partially justify that cost either. And yeah, I misunderstood what you were saying and thought you initially called it DB9, sorry

Bill Shields

Great video. That first 15 seconds was draw droppingly great.