Compromising Reflections: How to read Computer Monitors around a Corner
This site provides some (non-scientific) information about our project, intended for the public. If you are interested in a more scientific treatment of the topic, read the paper.
This project investigates a novel eavesdropping technique for spying at a distance on data that is displayed on an arbitrary computer screen, including the currently prevalent LCD monitors. Our technique exploits reflections of the screen's optical emanations in various objects that one commonly finds in close proximity to the screen and uses those reflections to recover the original screen content. Such objects include eyeglasses, tea pots, spoons, plastic bottles, and even the eye of the user.
We have demonstrated that this attack can be successfully mounted to spy on even small fonts using inexpensive, off-the-shelf equipment (less than 1500 dollars) from a distance of up to 10 meters. Relying on more expensive equipment allowed us to conduct this attack from over 30 meters away, demonstrating that similar attacks are feasible from the other side of the street or from a close-by building. We additionally establish theoretical limitations of the attack; these limitations may help to estimate the risk that this attack can be successfully mounted in a given environment.
The left image shows the (inexpensive, off-the-shelf) telescope that
was used in our experiments.
The right image depicts the test image that we used.
Reflections in Tea Pots
We have investigated the reflections in several tea pots, and obtained very good results throughout. Using our inexpensive telescope we were easily able to read the smallest font from distances up to 10m. Larger fonts and graphical elements can be read from even larger distances (for instance, business charts are readable from 40 meters).
The tea-pot that served as the starting point for this project.
These reflections were taken from a distance of 6m. The right side displays a part of the left picture in more detail.
These reflections were taken from a distance of 10m. The right side displays a part of the left picture in more detail.
Reflections in Eyeglasses
In eyeglasses, both sides of the glass provide reasonable reflections, as shown in these pictures. Again, small font sizes are easily readable.
Reflections in a Spoon
Even an ordinary spoon provides strong reflections. Their quality varies depending on the evenness of the surface of the spoon. Typically, both the inner and the outer side of the spoon allows for easily reading small fonts.
Reflections in Plastic-bottles
Somehow surprisingly, even a plastic bottle provides good reflections. Their quality, however, varies and often only displays parts of the monitor image.
Spying on Actual Documents
This image shows the reflections of a Word Dokument in a tea pot, captured from a distance of 6 meters. The document had a realistic font size of 12pt.
Reflections of Printouts
These images show the reflections of a printed document with font size 9pt/10pt, captured from a distance of 6 meters. The document is located on the desk close to the tea pot. This illustrates that not only the monitor image but any data can be successfully be observed using reflections.
Using More Expensive Equipment
These images shows the expensive telescope (approx. 19.000 Euro) we used, and reflections observed using this telescope in a tea pot from a distance of 30 meters.
Reflections in the Human Eye
Capturing reflections from the eye is a much more challenging task due to the more extreme curvature of the eye, resulting in much smaller and less bright images. Additionally, the subconscious movement of the eye causes additional blurring. However, using more evolved equipment, in particular a more sensitive camera and a high-quality telescope, and additional post-processing, the following reflections can be captured.
This image shows reflections in the eye, taken from a distance as far as 10 meters. The left image is the captured one, the image in the middle shows the so-called point-spreadd-function (PSF), which describes how the image was blurred, and the right image is the result after deconvolution.
The left image shows an example, again from a distance of 10 meters, where the eye moved rapidly while the image was captured, resulting in a large point-spread-function (middle). However, deconvolution still makes parts of the image readable.
Our findings have attracted some attention of the media, including the following.
- Schneier on Security (20.05.2008)
- The Register (21.05.2008)
- NetWorkWorld (19.05.2008)
- IDG.no (19.05.2008)
- Frankfurter Allgemeine Sonntagszeitung: Was du siehst, das seh ich auch (20.01.2008). Available online here.
- Technology Review (Januar 2009)
- Heise Newsticker (15.02.2008)
- Focus Online (15.02.2008)
- Süddeutsche Zeitung (07.03.2008)
- Saarbrücker Zeitung (13.02.2008)
- 20 Cent (13.02.2008)
- Welt online (13.02.2008)
- Computer-Bild (13.02.2008)
- Golem.de (13.02.2008)
- PC professional (13.02.2008)
- n-tv.de (14.02.2008).
- Der Standard (14.02.2008)
- The Inquirer (20.05.2008)
- Computerzeitung (20.03.2008)
- Scientific American: How Hackers Can Steal Secrets from Reflections (May 2009)
- Michael Backes, Markus Dürmuth, and Dominique
Compromising Reflections - or - How to Read LCD Monitors Around the
Corner. In Proceedings of the IEEE
Symposium on Security and Privacy (SSP '08), Oakland, CA, May
In case of questions, please contact:
|Prof. Dr. Michael Backes||[backes (at) cs (dot) uni-saarland (dot) de]|