Pith. sign in

REVIEW 4 major objections 5 minor 78 references

TEMPEST-LoRa: Cross-Technology Covert Communication

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A video cable's electromagnetic leakage can be sculpted into LoRa-compatible packets, letting an attacker exfiltrate data from an air-gapped computer to unmodified commercial LoRa receivers at distances up to 87.5 meters.

desk verdict Real new result with a real gap: the video-cable-to-LoRa channel works, but the 'monitors turned off' claim rests on an unverified—and probably wrong—DDC register write. read the letter →

arxiv 2506.21069 v1 pith:ZGKVEXIU submitted 2025-06-26 cs.CR

Xieyang Sun , Yuanqing Zheng , Wei Xi , Zuhao Chen , Zhizhen Chen , Han Hao , Zhiping Jiang , Sheng Zhong This is my paper · ORCID
classification cs.CR
keywords TEMPESTelectromagneticsidechannelLoRacovertcommunicationair-gappednetworkscross-technologychirpspreadspectrumvideocableemanation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that the electromagnetic radiation a video cable emits while driving a monitor can be sculpted into LoRa-compatible wireless packets, so that secret data from an air-gapped computer can be received and decoded by ordinary, unmodified commercial LoRa nodes and gateways — the long-range chirp-spread-spectrum radios already deployed for Internet-of-Things applications. Earlier electromagnetic covert channels needed a specialized receiver placed close to the victim; TEMPEST-LoRa instead aims at LoRa infrastructure that already exists near the target, reporting reliable decoding at up to 87.5 m with commercial LoRa receivers and up to 132 m with a low-cost software-defined radio. The enabling step is an attack image whose black-and-white pixel patterns set the data-bus voltage of a VGA or HDMI cable to sweep through the frequencies of LoRa chirps, using harmonics of the 148.5 MHz pixel clock to reach the 433–470 MHz and 868–915 MHz bands. The authors further report that setting a DDCcontrol register to 1 blanks the monitor screen while the cable keeps radiating, so the exfiltration can proceed with no visible display.

What carries the argument

The load-bearing object is the attack image as a waveform generator: a one-dimensional pixel stream, reshaped into a two-dimensional frame, that drives the video cable's data-bus voltage like a direct RF sampling transmitter (a radio architecture that synthesizes waveforms straight from a digital sample stream). Algorithm 1 synthesizes single-tone emissions with the ratio $\bmod(f_k, PC)/PC$, and Algorithm 2 extends this to a linear frequency sweep whose pixel count is set by $N_{pixel} = T_{chirp} \cdot PC$, with $T_{chirp} = 2^{SF}/BW$. The model splits the cable's leakage into $S_{sum} = S_{color} + S_{sync}$, where the color component is controllable through pixel data and the sync component is fixed clock leakage; harmonics of the pixel clock (148.5 MHz at 1080p60) give access to the LoRa bands, and the paper avoids frequencies close to the sync-dominated harmonics. Because each frame ends with a blanking interval of about 0.673 ms that can break a chirp, the SDR variant replaces continuous chirps with a stepping chirp whose per-line frequency steps sit inside the active scanline period, so the blanking gaps are aligned and a matching stepping down-chirp completes demodulation.

What would settle it

Take the display devices listed in the paper, run a LoRa-compatible attack video, set register 0xe1 via DDCcontrol, and record the cable voltage and the LoRa receiver output with the screen off; if any monitor stops its pixel clock, or the gateway no longer decodes packets, the claimed visual-covert operation fails for that device.

Watch

Extended reading notes

Core claim

The paper's central discovery is a fine-grained, pixel-level electromagnetic modulation method that treats a video cable as a direct radio-frequency sampling transmitter. By choosing black or white pixels according to a computed downsampling ratio, the attacker forces the cable's data buses to switch voltage at a chosen frequency; because the cable radiates at the pixel clock and its harmonics, the LoRa bands can be reached by downsampling the appropriate harmonic. Repeating this per-pixel frequency control across a chirp duration maps LoRa's spreading-factor and bandwidth settings onto pixel sequences, producing up-chirps and down-chirps that commercial LoRa receivers decode as ordinary packets. The paper reports that the channel works across shielded cables and multiple display devices, penetrates concrete walls, and reaches a maximum COTS LoRa distance of 87.5 m (HDMI at 915 MHz, SF9&125 kHz) with a maximum goodput of 21.6 kbps; a stepping-chirp variant that aligns the display's blanking intervals lets an SDR receiver operate out to 132 m. Visual covertness is claimed by using DDCcontrol register 0xe1 to turn the monitor off while the cable continues emitting.

Load-bearing premise

The channel's covertness rests on the assertion that setting DDCcontrol register 0xe1 to 1 blanks the monitor screen while the video cable keeps sampling and radiating the pixel stream; if a given monitor instead halts the pixel clock or the graphics card stops sending data, the channel produces no signal at all.

Editorial extensions

If this is right

  • TEMPEST-LoRa is presented as the first EM covert channel whose traffic is received by unmodified commercial LoRa nodes and gateways rather than by specialized SDRs.
  • The reported maximum COTS LoRa reception distance is 87.5 m outdoors (HDMI, 915 MHz, SF9&125 kHz), and the SDR-based stepping-chirp variant reaches 112–132 m.
  • Goodput reaches 21.6 kbps at the SF6&500 kHz setting and about 1.15 kbps at the long-range SF9&125 kHz setting, both matching standard LoRa throughput at those configurations.
  • The channel is reported to work with shielded VGA, HDMI 1.4, and HDMI 2.0 cables from multiple manufacturers, across monitors, projectors, and TVs, and after penetration of one or two concrete walls.
  • Because the emitted packets are LoRa-compatible, the paper argues they resemble legitimate LoRa traffic and can bypass spectral-signature detection, while noting that physical-layer fingerprinting remains a possible countermeasure.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the 0xe1 screen-off behavior varies across monitor models, the attack's defining advantage silently disappears on those models; a cross-model survey of register behavior, with the cable voltage monitored, would quantify how widely the covert variant actually works.
  • The pixel-level modulation is not obviously limited to LoRa: the paper notes preliminary WiFi/ZigBee results, and if those hold, a single video cable could emulate several IoT protocols, making spectral defenses correspondingly harder.
  • The 21.6 kbps ceiling means the channel favors short secrets such as keys and credentials; moving megabytes would take minutes and would prolong the window in which the emission is active, so bulk exfiltration is the less plausible use.
  • The cable-emitted chirps should carry physical fingerprints from blanking jitter and harmonic falloff; testing whether a classifier can separate them from genuine LoRa radio traffic would supply the detection path the paper leaves open.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes TEMPEST-LoRa, an electromagnetic covert channel that manipulates the pixel stream on VGA/HDMI cables to emit LoRa-compatible chirp packets, which can be decoded by unmodified commercial LoRa nodes/gateways or by low-cost SDRs. The core technique treats the video cable as a direct RF sampling transmitter, using black/white pixel patterns to down-sample the pixel clock or its harmonics to LoRa bands (433 MHz and 915 MHz) and synthesizing CSS chirps. The authors report indoor, outdoor, and through-wall experiments, with a claimed maximum COTS-LoRa decode distance of 87.5 m, an SDR-based distance of up to 132 m, goodput up to 21.6 kbps, and packet reception rates across SF/BW and payload sizes. They also claim visual covertness by using DDCcontrol to turn off the monitor while keeping the video cable active and emitting EM packets.

Significance. If the core feasibility is accepted, this is a notable advance: it is the first demonstration that EM emissions from video cables can be made protocol-compatible with a commodity wide-area IoT radio, removing the need for specialized SDR receivers at the attacker's site. The paper validates the approach against external COTS receivers, reports direct measurements rather than model-fitted predictions, and releases source code and attack artifacts on Zenodo, which materially strengthens reproducibility. The main risks are the unverified monitor-off mechanism and an overclaimed universal parameter compatibility, both of which affect headline generality statements rather than the basic on-screen feasibility result.

major comments (4)
  1. [§3.2, Visual covertness] The paper's defining covertness claim rests on the DDCcontrol command `ddccontrol -r 0xe1 dev:/dev/i2c-3 -w 1`, asserted to turn off the monitor while keeping the video cable's pixel stream active. This is not established. No measurement is provided of cable voltage, EMR spectrum, or LoRa packet RSSI/decode success in the screen-off state, and Table 3 does not test DDCcontrol behavior across the listed devices. Moreover, according to the VESA MCCS specification, register 0xE1 is the Display Power Mode and value 0x01 corresponds to 'On', not 'Off', so either the command is misreported or it relies on non-standard, monitor-specific semantics. If the monitor stops the pixel clock or the GPU pauses scanout, the LoRa-compatible EMR disappears and the abstract's 'monitors turned off (therefore covertly)' claim fails. This must be fixed by adding screen-off measurements, ideally per device, or by removing or qualifying the monitor-off claim.
  2. [§4.2 and §5.2] The claim that TEMPEST-LoRa generates EM packets compatible with 'all combinations of BWs and SFs' is contradicted by the paper's own data. In Table 4, indoor 433 MHz VGA at 125 kHz drops from 40 m at SF10 to 8.8 m at SF11 and 1.0 m at SF12; Table 5 shows a similar collapse (52.2 m at SF9 to 8.5 m at SF11 to 1.5 m at SF12 for 433 MHz VGA). Figure 17(a) shows PRR falling sharply at SF11+ (and beginning at SF10 for 125 kHz). Thus the system does not reliably support all parameter combinations, and the compatibility claim should be replaced with a quantified statement of which SF/BW combinations are usable at which distances and PRRs.
  3. [§5.2 and §5.5] The reported maximum distances and goodput values appear to be based on single measurement runs, without error bars, repetition counts, or a stated success criterion for distance. In §5.2 the maximum distance is defined as 'the farthest location where correctly decoded EM packets exist', but the paper does not specify how many packets were transmitted at each location or whether one successful packet suffices. Table 7 reports goodput at each distance with no variance or number of trials. To support the headline '87.5 m / 21.6 kbps' claim, the authors should report multiple trials, packet counts, and error bars, and define a statistical success criterion.
  4. [§5.3, Through-wall transmission] Table 6 reports RSSI and DNR values for through-wall scenarios but does not state whether a complete packet was successfully decoded in either case. Since the threat model claims that LoRa-compatible EM packets can 'penetrate a few concrete walls', the authors should report PRR or at least explicitly confirm successful full-packet decode for the one-exterior-wall and two-interior-wall configurations.
minor comments (5)
  1. [§1, Contributions] The contribution bullet states a 'maximum rate of 21.6 bps'; this should be 21.6 kbps, matching the abstract and Table 7.
  2. [§3.1 and Algorithm 1] The notation '1080X1920' is inconsistent with the stated timing parameters (2200 horizontal pixels per line, 1125 vertical lines), which correspond to 1920×1080. Please use standard width×height notation throughout.
  3. [Table 7] The header '10m, 20, 30m' is missing the unit after 20.
  4. [Eq. (6)] The definition of DNR should state whether peak and noise are amplitudes or powers and specify the noise bandwidth over which the noise level is computed.
  5. [§5.2] The definition of 'correctly decoded' should clarify whether the LoRa receiver's CRC or error-correction mechanisms were required to pass, and how many packets were attempted at each location.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: TEMPEST-LoRa's core claim is validated end-to-end against external COTS LoRa receivers, not against quantities derived from the paper's own equations.

full rationale

The paper's central derivation is self-contained with respect to its own equations and is validated by external, unmodified receivers. The attack image generation (Algorithm 1 and Algorithm 2) is a constructive procedure: pixel streams are designed to produce EMR at selected frequencies and chirp parameters, and the resulting signals are then verified by measuring actual EMR spectra (Figure 9), by decoding with commercial SX1262 nodes and SX1302 gateways, and by measuring reception distances and packet rates. No parameter is fitted to make reported distances or rates match a model; these are direct measurements. The DNR metric defined in Eq. 6 is used descriptively for SDR signal quality and is not an input to the construction. The only significant weakness noted by the reader is the visual-covertness assumption about the DDCcontrol register 0xe1 command, but that is a factual/correctness risk about whether the screen is actually powered off while the pixel stream continues, not a circularity: the claim is not derived from the paper's own equations or from a self-citation. The paper cites prior work by co-authors only in background contexts (e.g., references [72], [73]) and does not rely on those citations for the load-bearing feasibility claim. Thus the derivation chain does not reduce to its own inputs, and no circular step can be exhibited.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

No numbers are fitted to data. The construction uses protocol constants such as SF, BW, pixel clock, and LoRa symbol times as inputs. The key premises are the direct-RF-sampling model of the video cable, the validity of a radiated chirp being decoded by COTS LoRa radios, and the untested monitor-off behavior.

assumptions (3)
  • domain assumption The video cable EMR can be modeled as a direct RF sampling transmitter: the pixel stream is the baseband signal, the graphics card DAC converts it, and the cable radiates spectral images at n*PC plus or minus f.
    Used throughout Section 4.1 to justify generating arbitrary EMR frequencies by downsampling; validated indirectly via RSSI and PRR experiments, but the model itself is not independently measured.
  • domain assumption A COTS LoRa receiver will demodulate an EM chirp as a valid LoRa packet if chirp duration, bandwidth, and symbol timing match the LoRa standard, even though the chirp originates from a radiating cable rather than a radio transmitter.
    This is the core CTCC premise; the paper validates it by decoding with SX1262 and SX1302 radios, but the assumption is not derived.
  • ad hoc to paper DDCcontrol register 0xe1 set to 1 turns off the monitor display while the video cable continues to transmit the pixel stream and emit EMR.
    Asserted in Section 3.2 under 'Visual covertness'; no measurement of cable activity or EMR with the screen off is presented in the evaluation sections.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TEMPEST-LoRa: Cross-Technology Covert Communication." pith.science (2026). https://pith.science/paper/ZGKVEXIU

@misc{pith2026250621069,
  author       = {Pith},
  title        = {Pith review of: TEMPEST-LoRa: Cross-Technology Covert Communication},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZGKVEXIU}},
  note         = {Machine review of arXiv:2506.21069}
}
read the original abstract

Electromagnetic (EM) covert channels pose significant threats to computer and communications security in air-gapped networks. Previous works exploit EM radiation from various components (e.g., video cables, memory buses, CPUs) to secretly send sensitive information. These approaches typically require the attacker to deploy highly specialized receivers near the victim, which limits their real-world impact. This paper reports a new EM covert channel, TEMPEST-LoRa, that builds on Cross-Technology Covert Communication (CTCC), which could allow attackers to covertly transmit EM-modulated secret data from air-gapped networks to widely deployed operational LoRa receivers from afar. We reveal the potential risk and demonstrate the feasibility of CTCC by tackling practical challenges involved in manipulating video cables to precisely generate the EM leakage that could readily be received by third-party commercial LoRa nodes/gateways. Experiment results show that attackers can reliably decode secret data modulated by the EM leakage from a video cable at a maximum distance of 87.5m or a rate of 21.6 kbps. We note that the secret data transmission can be performed with monitors turned off (therefore covertly).

Figures

Figures reproduced from arXiv: 2506.21069 by the authors.

Figure 1
Figure 1. TEMPEST-LoRa reveals the risk of a new cross [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. (a) Monitor’s line-by-line scanning manner. (b) The [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 5
Figure 5. Contrast of direct RF sampling transmitter archi [PITH_FULL_IMAGE:figures/full_fig_p005_5.png] view at source ↗
Figures from the paper (12 more)
Figure 6
Figure 6. Figure 6: Comparison of HDMI’s EMR spectrum: normal [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: Emitting EMR at arbitrary frequency 𝑓𝑘 by down￾sampling PC or PC’s ⌈ 𝑓𝑘 𝑃𝐶 ⌉-th harmonic. band of 𝑆𝑐𝑜𝑙𝑜𝑟 at 148.5 MHz is downsampled to 1.5 MHz). Building on this example, [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]
Figure 8
Figure 8. Figure 8: We use HackRF with an EM probe to measure the [PITH_FULL_IMAGE:figures/full_fig_p006_8.png]
Figure 9
Figure 9. Figure 9: Actual EMR intensity of VGA and HDMI with attack frequencies from 10 MHz to 1000 MHz. [PITH_FULL_IMAGE:figures/full_fig_p007_9.png]
Figure 10
Figure 10. Figure 10: COTS LoRa signal waveform and EM chirps. [PITH_FULL_IMAGE:figures/full_fig_p007_10.png]
Figure 12
Figure 12. Figure 12: Minimum number of attack frames required as [PITH_FULL_IMAGE:figures/full_fig_p008_12.png]
Figure 13
Figure 13. Figure 13: Stepping chirp for align signal intervals. Line in [PITH_FULL_IMAGE:figures/full_fig_p009_13.png]
Figure 15
Figure 15. Figure 15: Indoor, outdoor, and through-wall scenes. [PITH_FULL_IMAGE:figures/full_fig_p010_15.png]
Figure 16
Figure 16. Figure 16: Maximum attack distances on SDR. as SF9&125 kHz, or use the SDR-based version of TEMPEST-LoRa) to decode secret data at a longer distance. 5.3 Through-wall Transmission Next, we evaluate the through-wall transmission in the scenarios shown in [PITH_FULL_IMAGE:figures…
Figure 9
Figure 9. Figure 9: We speculate that the main reason for this difference is [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 17
Figure 17. Figure 17: (a) PRR under various SF&BW. (b) PRR under [PITH_FULL_IMAGE:figures/full_fig_p012_17.png]
Figure 19
Figure 19. Figure 19: RSSI values in various directions. to -90 dBm). In the vertical placement, the position of minimum RSSI (-95 dBm) is behind the monitor (180°) because the monitor itself blocks part of the leakage. When placed horizontally, the RSSI on the sides of the monitor (90° an…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

78 extracted references · 77 canonical work pages

  1. [1]

    Daniel Arendt. 2016. Medical-Grade Network Security-Air-Gap Isolation and PossibleWeak Points. Journal of Applied Computer Science 24, 3 (2016), 7–19

    work page 2016

  2. [2]

    Video Electronics Standards Association. 2013. Video Electronics Standards Association, Display Monitor Timing 1.3. https://glenwing.github.io/docs/VESA- DMT-1.13.pdf

    work page 2013

  3. [3]

    Elaine Barker and William Barker. 2018. Recommendation for key management, part 2: best practices for key management organization. Technical Report. National Institute of Standards and Technology

    work page 2018

  4. [4]

    Nicolas Boichat. 2006. DDCcontrol documentation. [Online] https://ddccontrol.sourceforge.net/doc/ddccontrol-0.4.pdf (2006)

    work page 2006

  5. [5]

    Giovanni Camurati and Aurélien Francillon. 2022. Noise-SDR: Arbitrary Modu- lation of Electromagnetic Noise from Unprivileged Software and Its Impact on Emission Security. In 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 1193–1210

    work page 2022

  6. [6]

    Hsun-Wei Cho and Kang G Shin. 2021. BlueFi: bluetooth over WiFi. InProceedings of the 2021 ACM SIGCOMM 2021 Conference . 475–487

    work page 2021

  7. [7]

    Chay Chua. 2005. CyberCIEGE scenario illustrating software integrity issues and management of air-gapped networks in a military environment. Ph. D. Dissertation. Monterey, California. Naval Postgraduate School

    work page 2005

  8. [8]

    Google Cloud. 2024. How Google protects the physical-to-logical space in a data center [online]. https://cloud.google.com/docs/security/physical-to-logical-space

    work page 2024

Show all 78 references
  1. [9]

    Fangming Deng, Pengqi Zuo, Kaiyun Wen, and Xiang Wu. 2020. Novel soil environment monitoring system based on RFID sensor and LoRa. Computers and Electronics in Agriculture 169 (2020), 105169

    2020

  2. [10]

    High-Definition Multimedia Interface Specification Version 1.3 a: Supplement 1 Consumer Electronics Control (CEC)

    LLC et al. 2006. , “High-Definition Multimedia Interface Specification Version 1.3 a: Supplement 1 Consumer Electronics Control (CEC)”. 1Preliminary results obtained but not reported in this paper due to page limit

    2006

  3. [11]

    Justin Feng, Timothy Jacques, Omid Abari, and Nader Sehatbakhsh. 2023. Ev- erything has its Bad Side and Good Side: Turning Processors to Low Overhead Radios Using Side-Channels. In Proceedings of the 22nd International Conference on Information Processing in Sensor Networks . 288–301

    2023

  4. [12]

    FireEye. 2020. Highly evasive attacker leverages SolarWinds supply chain to compromise multiple global victims with SUNBURST backdoor. FireEye Threat Research (2020)

    2020

  5. [13]

    Joint Task Force. 2017. Security and privacy controls for information systems and organizations. Technical Report. National Institute of Standards and Technology

    2017

  6. [14]

    Great Scott Gadgets. 2018. Hackrf one Official Website [online] . https:// greatscottgadgets.com/hackrf

    2018

  7. [15]

    Piotr Gawłowicz, Anatolij Zubow, and Falko Dressler. 2022. Wi-Lo: Emulation of LoRa using Commodity 802.11 b WiFi Devices. In ICC 2022-IEEE International Conference on Communications. IEEE, 4414–4419

    2022

  8. [16]

    Guifen Gu and Guili Peng. 2010. The survey of GSM wireless communication system. In 2010 international conference on computer and information application . IEEE, 121–124

    2010

  9. [17]

    Mordechai Guri. 2022. Air-fi: Leaking data from air-gapped computers using wi-fi frequencies. IEEE Transactions on Dependable and Secure Computing (2022)

    2022

  10. [18]

    Mordechai Guri and Yuval Elovici. 2018. Bridgeware: The air-gap malware. Commun. ACM 61, 4 (2018), 74–82

    2018

  11. [19]

    2015.{GSMem}: Data Exfiltration from{Air-Gapped} Computers over{GSM} Frequencies

    Mordechai Guri, Assaf Kachlon, Ofer Hasson, Gabi Kedma, Yisroel Mirsky, and Yuval Elovici. 2015.{GSMem}: Data Exfiltration from{Air-Gapped} Computers over{GSM} Frequencies. In 24th USENIX Security Symposium (USENIX Security 15). 849–864

    2015

  12. [20]

    Mordechai Guri, Gabi Kedma, Assaf Kachlon, and Yuval Elovici. 2014. AirHopper: Bridging the air-gap between isolated networks and mobile phones using radio frequencies. In 2014 9th International Conference on Malicious and Unwanted Software: The Americas (MALW ARE). IEEE, 58–67

    2014

  13. [21]

    Mordechai Guri and Matan Monitz. 2018. Lcd tempest air-gap attack reloaded. In 2018 IEEE International Conference on the Science of Electrical Engineering in Israel (ICSEE). IEEE, 1–5

    2018

  14. [22]

    Mordechai Guri, Matan Monitz, and Yuval Elovici. 2016. USBee: Air-gap covert- channel via electromagnetic emission from USB. In 2016 14th Annual Conference on Privacy, Security and Trust (PST) . IEEE, 264–268

    2016

  15. [23]

    Yuichi Hayashi, Naofumi Homma, Mamoru Miura, Takafumi Aoki, and Hideaki Sone. 2014. A threat for tablet pcs in public space: Remote visualization of screen images using em emanation. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security . 954–965

    2014

  16. [24]

    Leland H. Hemming. 2000. Architectural Electromagnetic Shielding Handbook: A Design and Specification Guide . John Wiley & Sons

    2000

  17. [25]

    Wenchao Jiang, Zhimeng Yin, Ruofeng Liu, Zhijun Li, Song Min Kim, and Tian He. 2017. Bluebee: a 10,000 x faster cross-technology communication via phy emulation. In Proceedings of the 15th ACM Conference on Embedded Network Sensor Systems. 1–13

    2017

  18. [26]

    Mohammed Jouhari, Nasir Saeed, Mohamed-Slim Alouini, and El Mehdi Amhoud

  19. [27]

    Eric D Knapp. 2024. Industrial Network Security: Securing critical infrastructure networks for smart grid, SCADA, and other Industrial Control Systems . Elsevier

    2024

  20. [28]

    Lone Kolobe, Boyce Sigweni, and Caspar K Lebekwe. 2020. Systematic literature survey: Applications of LoRa communications. (2020)

    2020

  21. [29]

    Arif Koyun and Ehssan Al Janabi. 2017. Social engineering attacks. Journal of Multidisciplinary Engineering Science and Technology (JMEST) 4, 6 (2017), 7533– 7538

    2017

  22. [30]

    Markus G Kuhn and Ross J Anderson. 1998. Soft tempest: Hidden data transmis- sion using electromagnetic emanations. In International Workshop on Information Hiding. Springer, 124–142

    1998

  23. [31]

    Yeu-Pong Lai and Ruan-Han Dai. 2009. The implementation guidance for prac- ticing network isolation by referring to ISO-17799 standard. Computer Standards & Interfaces 31, 4 (2009), 748–756

    2009

  24. [32]

    Butler W Lampson. 1973. A note on the confinement problem. Commun. ACM 16, 10 (1973), 613–615

    1973

  25. [33]

    Ralph Langner. 2011. Stuxnet: Dissecting a cyberwarfare weapon. IEEE Security & Privacy 9, 3 (2011), 49–51

    2011

  26. [34]

    Federico Larroca, Pablo Bertrand, Felipe Carrau, and Victoria Severi. 2022. gr- tempest: an open-source GNU Radio implementation of TEMPEST. In 2022 Asian Hardware Oriented Security and Trust Symposium (AsianHOST) . IEEE, 1–6

    2022

  27. [35]

    Corentin Lavaud, Robin Gerzaguet, Matthieu Gautier, Olivier Berder, Erwan Nogues, and Stephane Molton. 2021. Whispering devices: A survey on how side- channels lead to compromised information. Journal of Hardware and Systems Security 5 (2021), 143–168

    2021

  28. [36]

    Euibum Lee, Dong-Hoon Choi, Taesik Nam, and Jong-Gwan Yook. 2022. A quantitative analysis of compromising emanation from TMDS interface and possibility of sensitive information leakage. IEEE Access 10 (2022), 73997–74011

    2022

  29. [37]

    Ho Seong Lee, Jong-Gwan Yook, and Kyuhong Sim. 2015. Measurement and analysis of the electromagnetic emanations from video display interface. In 2015 TEMPEST-LoRa: Cross-Technology Covert Communication CCS ’25, October 13–17, 2025, Taipei, Taiwan IEEE Electrical Design of Adva...

    2015

  30. [38]

    Ronald L Lendvay. 2016. Shadows of Stuxnet: Recommendations for US policy on critical infrastructure cyber defense derived from the Stuxnet attack . Ph. D. Dissertation. Monterey, California: Naval Postgraduate School

    2016

  31. [39]

    Luca Leonardi, Filippo Battaglia, and Lucia Lo Bello. 2019. RT-LoRa: A medium access strategy to support real-time flows over LoRa-based networks for industrial IoT applications. IEEE Internet of Things Journal 6, 6 (2019), 10812–10823

    2019

  32. [40]

    Chenning Li and Zhichao Cao. 2022. Lora networking techniques for large-scale and long-term iot: A down-to-top survey. ACM Computing Surveys (CSUR) 55, 3 (2022), 1–36

    2022

  33. [41]

    Zhijun Li and Yongrui Chen. 2020. BLE2LoRa: Cross-technology communication from bluetooth to LoRa via chirp emulation. In2020 17th Annual IEEE International Conference on Sensing, Communication, and Networking (SECON) . IEEE, 1–9

    2020

  34. [42]

    Zhijun Li and Tian He. 2017. Webee: Physical-layer cross-technology communi- cation via emulation. In Proceedings of the 23rd Annual International Conference on Mobile Computing and Networking . 2–14

    2017

  35. [43]

    Lilygo. 2024. Official Website [online]. https://www.lilygo.cc

    2024

  36. [44]

    Hui Lin, Liming Wu, Junxiu Liu, and Tengteng Wen. 2010. Overshoot and undershoot control for signal generator. In 2010 International Conference on Measuring Technology and Mechatronics Automation, Vol. 2. IEEE, 864–867

    2010

  37. [45]

    Zhuoran Liu, Niels Samwel, Léo Weissbart, Zhengyu Zhao, Dirk Lauret, Lejla Batina, and Martha Larson. 2020. Screen Gleaning: A Screen Reading TEMPEST Attack on Mobile Devices Exploiting an Electromagnetic Side Channel. arXiv preprint arXiv:2011.09877 (2020)

    2020 arXiv

  38. [46]

    Yan Long, Qinhong Jiang, Chen Yan, Tobias Alam, Xiaoyu Ji, Wenyuan Xu, and Kevin Fu. 2019. EM Eye: Characterizing Electromagnetic Side-channel Eavesdropping on Embedded Cameras. (2019)

    2019

  39. [47]

    Martin Marinov. 2014. Remote video eavesdropping using a software-defined radio platform. MS thesis, University of Cambridge (2014)

    2014

  40. [48]

    Emmanuel Migabo, Karim Djouani, and Anish Kurien. 2018. A modelling ap- proach for the narrowband IoT (NB-IoT) physical (PHY) layer performance. In IECON 2018-44th Annual Conference of the IEEE Industrial Electronics Society. IEEE, 5207–5214

    2018

  41. [49]

    European Cyber Security Organisation. 2021. System security and certification considerations [online]. https://ecs-org.eu/ecso-uploads/2022/10/61ebc4a13b567. pdf

    2021

  42. [50]

    European Cyber Security Organisation. 2022. ECSO Technical Paper on Internet of Things (IoT) [online]. https://ecs-org.eu/ecso-uploads/2023/01/ECSO_WG6_IoT- Technical_paper_final.pdf

    2022

  43. [51]

    Clayton R Paul, Robert C Scully, and Mark A Steffka. 2022. Introduction to electromagnetic compatibility. John Wiley & Sons

    2022

  44. [52]

    Sean Peisert, Bruce Schneier, Hamed Okhravi, Fabio Massacci, Terry Benzel, Carl Landwehr, Mohammad Mannan, Jelena Mirkovic, Atul Prakash, and James Bret Michael. 2021. Perspectives on the SolarWinds incident. IEEE Security & Privacy 19, 2 (2021), 7–13

    2021

  45. [53]

    FIPS Pub. 1994. Security requirements for cryptographic modules. FIPS PUB 140 (1994), 140–2

    1994

  46. [54]

    C Muthu Ramya, Madasamy Shanmugaraj, and R Prabakaran. 2011. Study on ZigBee technology. In 2011 3rd international conference on electronics computer technology, Vol. 6. IEEE, 297–301

    2011

  47. [55]

    Chris M Roberts. 2006. Radio frequency identification (RFID). Computers & security 25, 1 (2006), 18–26

    2006

  48. [56]

    Ignacio Sanmillan. 2020. Ramsay: A cyber-espionage toolkit tailored for air- gapped networks. Retrieved October 12 (2020), 2020

    2020

  49. [57]

    Asanka Sayakkara, Nhien-An Le-Khac, and Mark Scanlon. 2018. Accuracy en- hancement of electromagnetic side-channel attacks on computer monitors. In Proceedings of the 13th International Conference on A vailability, Reliability and Security. 1–9

    2018

  50. [58]

    Karen Scarfone, Murugiah Souppaya, Amanda Cody, and Angela Orebaugh. 2008. Technical guide to information security testing and assessment. NIST Special Publication 800, 115 (2008), 2–25

    2008

  51. [59]

    Cheng Shen, Tian Liu, Jun Huang, and Rui Tan. 2021. When LoRa meets EMR: Electromagnetic covert channels can be super resilient. In 2021 IEEE Symposium on Security and Privacy (SP) . IEEE, 1304–1317

    2021

  52. [60]

    Junyang Shi, Di Mu, and Mo Sha. 2019. Lorabee: Cross-technology communi- cation from lora to zigbee via payload encoding. In 2019 IEEE 27th International Conference on Network Protocols (ICNP) . IEEE, 1–11

    2019

  53. [61]

    Dimitrios Siafarikas and John L Volakis. 2020. Toward direct RF sampling: Im- plications for digital communications. IEEE Microwave Magazine 21, 9 (2020), 43–52

    2020

  54. [62]

    Keith Stouffer, Joe Falco, Karen Scarfone, et al. 2011. Guide to industrial control systems (ICS) security. NIST special publication 800, 82 (2011), 16–16

    2011

  55. [63]

    Erik Thiele. 2001. Tempest for Eliza. [Online] http://www.erikyyy.de/tempest (2001)

    2001

  56. [64]

    Semtech LoRa Connect ™ 137MHz to 1020MHz Long Range Low Power Transceiver. 2024. SX1262 Official Website [online] . https: //www.semtech.com/products/wireless-rf/lora-connect/sx1262

    2024

  57. [65]

    Shuai Tong, Yangliang He, Yunhao Liu, and Jiliang Wang. 2022. De-spreading over the air: long-range ctc for diverse receivers with lora. In Proceedings of the 28th Annual International Conference on Mobile Computing and Networking . 42–54

    2022

  58. [66]

    Wim Van Eck. 1985. Electromagnetic radiation from video display units: An eavesdropping risk? Computers & Security 4, 4 (1985), 269–286

    1985

  59. [67]

    Paul Voigt and Axel Von dem Bussche. 2017. The eu general data protection reg- ulation (gdpr). A Practical Guide, 1st Ed., Cham: Springer International Publishing 10, 3152676 (2017), 10–5555

    2017

  60. [68]

    Zuoguang Wang, Limin Sun, and Hongsong Zhu. 2020. Defining social engineer- ing in cybersecurity. IEEE Access 8 (2020), 85094–85115

    2020

  61. [69]

    WaveShare. 2024. Official Website [online]. https://www.waveshare.com/

    2024

  62. [70]

    Wikipedia. 2024. Tempest (codename) — Wikipedia, The Free Encyclopedia. https://en.wikipedia.org/wiki/Tempest_(codename)

    2024

  63. [71]

    Dan Xia, Xiaolong Zheng, Fu Yu, Liang Liu, and Huadong Ma. 2022. WiRa: Enabling cross-technology communication from WiFi to LoRa with IEEE 802.11 ax. In Proceedings of IEEE INFOCOM

    2022

  64. [72]

    Xianjin Xia, Qianwu Chen, Ningning Hou, Yuanqing Zheng, and Mo Li. 2023. XCopy: Boosting Weak Links for Reliable LoRa Communication. In Proceedings of the 29th Annual International Conference on Mobile Computing and Networking . 1–15

    2023

  65. [73]

    Qiang Yang and Yuanqing Zheng. 2023. AquaHelper: Underwater sos transmis- sion and detection in swimming pools. In Proceedings of the 21st ACM Conference on Embedded Networked Sensor Systems . 294–307

    2023

  66. [74]

    Yan Yubo, Yang Panlong, Li Xiangyang, Tao Yue, Zhang Lan, and You Lizhao

  67. [75]

    Zihao Zhan, Zhenkai Zhang, and Xenofon Koutsoukos. 2020. Bitjabber: The world’s fastest electromagnetic covert channel. In 2020 IEEE International Sympo- sium on Hardware Oriented Security and Trust (HOST) . IEEE, 35–45

    2020

  68. [76]

    Anna ZYGIEREWICZ. 2020. Directive on security of network and information systems (NIS Directive). (2020)

    2020

  69. [2013]

    In Proceedings of the 19th annual international conference on Mobile computing & networking

    Zimo: Building cross-technology mimo to harmonize zigbee smog with wifi flash without intervention. In Proceedings of the 19th annual international conference on Mobile computing & networking . 465–476

  70. [2023]

    IEEE Communications Surveys & Tutorials (2023)

    A survey on scalable LoRaWAN for massive IoT: Recent advances, potentials, and challenges. IEEE Communications Surveys & Tutorials (2023)

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.