Características Operacionales

Compromising video signals can be visualized conveniently in real-time on a normal VGA multisync monitor, provided that their signal-to-noise ratio is good enough. We can simply connect its green 0.7 V/75 Ω input via an impedance-matched attenuator (see Section B.1) to the 3 V/50 Ω AM demodulator output of the R-1250 wide-band receiver shown in Fig 2.4. All the received signals shown in the following figures are not screenshots from such a monitor, but were captured with a digital storage oscilloscope from the receiver output and converted into raster graphics files on a PC. Nevertheless, the real- time observation of a received signal on a monitor is invaluable for manually adjusting the various reception parameters including the antenna position, center frequency, and bandwidth for best results.

The eavesdropper’s monitor needs to be supplied with very close approximations ˜fh and ˜fv

of the horizontal and vertical synchronization frequencies fhand fvthat drive the targeted

display. If, for example, these frequencies differ by even only one part per million (1 ppm, i.e. ˜fh = fh×1.000001), and the number of pixel times per frame refresh xtyt is about 106,

then after a single refresh, the positions of the electron beams on the two monitors will already have moved relative to each other by one pixel. The effect for the eavesdropper is that the image seen on the monitor will roll horizontally with a speed of

vh =

˜ fh− fh

fh · x

tyt· fv· r (3.14)

where r is the width of a pixel. With a refresh rate of fv = 85 Hz and ˜fhbeing just 1 ppm

too high, as in the above example, the image on the eavesdropping monitor would roll to the right with a speed of 85 pixels per second.

In order to achieve an image with acceptable stability, the oscillator used for generating the horizontal sync pulses for the eavesdropping monitor needs to be adjustable in frequency with a resolution of at least seven to eight digits. This way, the horizontal image drift can be adjusted with a resolution better than one pixel per second. The PLL pixel-clock generators found in typical graphics cards provide only an orders of magnitude cruder frequency resolution, which makes them unsuitable as sync signal generators for this application. (Recall that the VESA standard permits a frequency tolerance of 0.5 % = 5000 ppm.)

I attempted several ways to program an available arbitrary-waveform generator to produce both the horizontal and vertical sync signals with the required accuracy. I eventually succeeded by using a second function generator that can produce a 10 MHz square wave signal with a frequency resolution of 1 Hz, which I fed into the 10 MHz reference-clock input of the arbitrary-waveform generator, in order to fine-tune its output frequency (see Section B.2 for details).

Even with a sufficiently high resolution for adjusting ˜fh, the image on the eavesdropping

monitor will not remain in place for longer than a few seconds or minutes. The crystal oscillators in both the video adapter of the targeted system as well as the eavesdropper’s time base are temperature dependent and their relative frequencies can drift in practice up to several ppm within just a few minutes, making it necessary for the eavesdropper

46 3.3. EAVESDROPPING DEMONSTRATION

Figure 3.3: Test text on the target monitor when Figs. 3.4–3.6 were recorded.

to continuously adjust the ˜fh setting. Using a somewhat more stable time base (e.g., a

temperature-controlled crystal oscillator, radio time-signal receiver, or atomic clock) can help the eavesdropper to ensure that this image drift is primarily caused by frequency fluctuations in the targeted system, but will not reduce the problem significantly.

The sensitivity of the reconstructed image position to tiny frequency errors in the sync signals might seem like a nuisance to the eavesdropper, but it is actually an advantage that helps single-out signals from an individual target device. Each PC video card uses its own independent crystal oscillator for generating the pixel clock signal. Even if there are several video displays within reception distance that run in exactly the same video mode, their respective clock frequencies are very likely to differ by at least several parts per million. The eavesdropper can therefore adjust ˜fh such that the signal of only one target

system at a time appears stable on the monitor, while the signals from other systems will drift by at significant speed.

The human eye can quite easily separate on the real-time eavesdropping monitor the targeted system’s stable signal from the moving signals of other monitors. The periodic averaging of multiple frames that needs to be applied to reduce noise when the signal is recorded digitally equally ensures that unwanted signals from other nearby monitors are blurred significantly when there is even a tiny frequency mismatch.

Where the exact video mode – and in particular parameter yt – are known, the refresh

frequency ˜fv = ˜fh/yt can be derived directly from the line frequency, and only one single

frequency needs to be controlled. If the video mode of the targeted system is not one of the common standard modes, separately adjustable ˜fv and ˜fh controls significantly

simplify a manual search for the right frequencies. A helpful observation for such manual adjustments is that for ˜fh ≪ fh the image will be sheared such that vertical lines lean by

an angle

θ = arctan fh− ˜fh fh · xt

!

(3.15) to the right, because the electron beam in the eavesdropping monitor falls behind (to the left) relative to the target monitor beam, as both progress down the screen. Equivalently, for ˜fh ≫ fh vertical lines will lean to the left. The image will appear stable but distorted