A TEMPEST in a ... wall outlet?

[unixronin]

Bruce Schneier points to a paper on keyboard sniffing by detecting crosstalk between poorly shielded keyboard cables and power lines.  He also observes that the NSA has known about this principle for decades.

What I want to know is, why haven’t we switched to optical interconnect cables yet?  Component-stereo CD changers have had digital-optical outputs for over ten years now, and the home audio industry is hardly known for leading the field in interconnect technology.  Mice, keyboards — heck, ALL HIDs — monitors, external disks, even powered computer speakers:  they could all easily use optical-fiber data connections.  Many devices would still need power, of course, but the low levels of power required by devices that don’t already have their own separate power supply could be carried on a braid layer around the fiber.  Most speeds of what we’re still calling Ethernet can already run over fiber.  There’s no technical reason why we should be using copper cables any more for anything except supplying power — and copper is becoming expensive enough that it was actually cost-effective for thieves to steal 45km of undersea Internet cable from the seabed off Korea in order to sell it as scrap.  Even telephony devices run over copper only because telephones have historically been line-powered devices and the installed base is too huge to easily change.

Make sure computer cases are properly shielded and power supplies back-filtered to prevent feeding RFI back into their own power lines, and we could probably virtually eliminate RFI emissions from computers except for the display — and as a bonus, it would reduce their susceptibility to RFI and crosstalk.  (Even with magnetically-shielded computer speakers, I’ve had crosstalk issues when a monitor cable passes a few inches too close to a powerful speaker.)

Reason says it ought to be possible to RFI-shield flat-panel displays too.  (Perhaps a transparent conductive coating on one of the face layers?)

Comments

[ithildae]

Optical connectors are a pain to keep clean in a normal business/home environment. They tend to be more fragible than metal connectors. Fiber can also be a bit more brittle than metal wire. Even POF can only bend so far, and it fatigues faster than metal. Optical just adds cost, in an industry that has thinner margins than grocery stores.

While the exploit is more than hypothetical, the prevalence of computers in many areas mean that the signal read needs to be quite close to the signal source. (Our house has many computers.)

With total component and peripheral control it may be possible to practically eliminate RF noise, but the cost is prohibitive. Apple could probably do it if they could control all devices that plugged into their systems. Would Apple be competitive at twice the price point?

As with most security, obscurity is a poor method to count on, but it really it the best hope we have. If someone is willing to go to the expense, everything you do will be known. It scares me how much people routinely put into the wild.

[unixronin]

How often do people need to plug and unplug system components, though? And I'd think it'd be a win to have most devices plug in with a single common, thin cable and for it to not really matter how long that cable is.

[ithildae]

A single, common, thin cable would be a tech support nightmare. USB has somewhat fixed the keyboard/mouse connector confusion. Color coding helps lots. Same with soundcard connectors, that are all identical except for color, inputs no different that outputs.

When those cables do need to be changed, it is often in a less than ideal environment. Visibility is poor, and dustbunnies are large.

You addressed the power requirements with metal power lines woven around the cladding of the fiber. (Making it a more expensive cable.) What, exactly, would all that cost really buy? The electromagnetic signal will still be generated close enough to the power that you get spikes. (I absolutely detest battery powered computer components! Keyboards and mice should absolutely NOT be dependent on a battery that needs to be charged/replaced. I don't care about the cable. I won't even discuss wireless devices in this context.)

I suspect that MIDI type interfaces would do most of what you really want done, without the cost and fragility of fiber cable. Running at USB 2.0 speeds, it would be almost impossible to pull the signal off of a power line because of the Low-Pass Filter characteristics of the power distribution system. Everything is optically isolated, so crosstalk is minimized.