TEMPEST-LoRa: Cross-Technology Covert Communication

TL;DR

This paper introduces TEMPEST-LoRa, a novel electromagnetic covert channel that enables remote, covert data transmission from air-gapped networks to widely available LoRa receivers, demonstrating practical feasibility and significant security risks.

Contribution

It presents a new EM covert channel, TEMPEST-LoRa, leveraging cross-technology communication to covertly transmit data from air-gapped networks to commercial LoRa devices.

Findings

Reliable data decoding at 87.5m distance.

Transmission rate of 21.6 kbps.

Covert operation with monitors turned off.

Abstract

Electromagnetic (EM) covert channels pose significant threats to computer and communications security in air-gapped networks. Previous works exploit EM radiation from various components (e.g., video cables, memory buses, CPUs) to secretly send sensitive information. These approaches typically require the attacker to deploy highly specialized receivers near the victim, which limits their real-world impact. This paper reports a new EM covert channel, TEMPEST-LoRa, that builds on Cross-Technology Covert Communication (CTCC), which could allow attackers to covertly transmit EM-modulated secret data from air-gapped networks to widely deployed operational LoRa receivers from afar. We reveal the potential risk and demonstrate the feasibility of CTCC by tackling practical challenges involved in manipulating video cables to precisely generate the EM leakage that could readily be received by third-party commercial LoRa nodes/gateways. Experiment results show that attackers can reliably decode secret data modulated by the EM leakage from a video cable at a maximum distance of 87.5m or a rate of 21.6 kbps. We note that the secret data transmission can be performed with monitors turned off (therefore covertly).