Transmitting RF Music Directly From the System Bus on your PC

Recently we've come into knowledge of a program on GitHub called "System Bus Radio" which lets you transmit RF directly from your computer, laptop or phone without any transmitting hardware at all. It works on the principle of manipulating the unintentional RF radiation produced by a computers system bus by sending instructions that can produce different AM tones. An SDR like the RTL-SDR V3 or RTL-SDR with upconverter, or any portable AM radio that can tune down to 1580 kHz can be used to receive the tones. To run the software don't even need to download or compile anything, as there is now a web based app that you can instantly run which will play a simple song.

However, the RF emissions don't seem to occur on every PC, or are perhaps at another frequency. We tested a Windows desktop and Dell laptop and found that no were signals produced. A list of field reports indicates that it is mostly MacBook Pro and Air computers that produce the signal, with some transmitting signals strong enough to be received from a few centimeters to up to 2m away. This could obviously be a security risk if a sophisticated attacker was able to sniff these tones and recover data.

This program runs instructions on the computer that cause electromagnetic radiation. The emissions are of a broad frequency range. To be accepted by the radio, those frequencies must:

  • Be emitted by the computer processor and other subsystems
  • Escape the computer shielding
  • Pass through the air or other obstructions
  • Be accepted by the antenna
  • Be selected by the receiver

By trial and error, the above frequency was found to be ideal for that equipment. If somebody would like to send me a SDR that is capable of receiving 100 kHz and up then I could test other frequencies.

There is also an interesting related piece of software based on System Bus Radio called 'musicplayer', which takes a .wav file and allows you to transmit the modulated music directly via the system bus.

If you're interested in unintentionally emitted signals from PCs, have a look at this previous post showing how to recover images from the unintentional signals emitted by computer monitors. This is also similar to RPiTX which is a similar concept for Raspberry Pi's.

System Bus Radio web app
System Bus Radio web app

5 comments

  1. John Stevens

    I’m showing my age, but I remember an IBM 1401 program playing a song through an AM radio sitting on top the CPU.

  2. Dave H

    It’s probably just flogging something that’s requestiing I/O activity – playing an inaudible sound, sending network packets, something even a script can do.

  3. GiamMa-based researchers SDR R&D IoT

    Hello all,

    in relation to the article I would like to share with you all the results of my tests:

    1. Test – TempestRAM receive signal from clock bus RAM with HackRF and comparative from three computer:

    https://www.youtube.com/watch?v=M8MystC5RRU

    Receive radio signal from bus of Double Data Rate Synchronous Dynamic Random Access Memory DDR2 desktop an DDR3 desktop and notebook with single and dual channel. HackRF One, RF Analyzer and Andoid phone use to receive, display signal and record video.

    Details of ram technology

    First PC:
    frequency of bus: 400.3 Mhz
    Channel: Single Ram: DDR2 2Gb
    Number of bank: 1 (1x2Gb)
    Timings: Not Overclock, default
    Computer: Desktop

    Second PC:
    frequency of bus: 824..2 Mhz
    Channel: Dual Ram: DDR3 16Gb
    Number of bank: 4 (4x4Gb)
    Timings: XMP Overclock
    Computer: Desktop

    Third PC:
    frequency of bus: 665.1 – 669.0 Mhz
    Channel: Dual Ram: DDR3 8Gb
    Number of bank: 2 (2x4Gb)
    Timings: XMP Overclock
    Computer: Notebook

    2. Test – Tempest for Eliza: Generate radio modulation signal by showing patterns on your monitor:

    https://www.youtube.com/watch?v=CHV8wrorl70

    Details:

    AM Radio Signal Transmitter by showing patterns on your monitor and receive with HackRF One and demodulated with HDSDR.

    if you look at my other videos you can find how you can also transmit digital messages, encoded and decrypt them.

    Code for linux:

    http://www.erikyyy.de/tempest/
    https://github.com/priikone/tempest-AM/

    Code for windows:

    https://cryptome.org/2015/09/tempest-test-for-windows.htm

    pubblication:

    https://hackaday.com/2005/12/25/tempest-for-eliza/

    OnLine there are some broken links to some software to generate radio signals with CPU and PCI:

    https://cryptome.org/tempest-cpu.htm

    http://lambda-diode.com/resources/tempest/sccte.html

    Broken Link:

    http://altern.org/berke/tempest-cpu.tar.gz
    http://altern.org/berke/tempest-crt.tar.gz
    http://altern.org/berke/tempest-pci.tar.gz

    http://lambda-diode.com/tempest/tempest-cpu.tar.gz
    http://lambda-diode.com/tempest/tempest-crt.tar.gz
    http://lambda-diode.com/tempest/tempest-pci.tar.gz

    3. Hackrf One detect signal from Ethernet cable LAN:

    Hackrf One detect signal from Ethernet cable LAN

  4. GiamMa-based researchers SDR R&D IoT

    Hi All,

    in relation to the article I would like to share with you all during my test i have receive with RT SDR or HackRF:

    Test – TempestRAM receive signal from clock bus RAM with HackRF and comparative from three computer:

    https://www.youtube.com/watch?v=M8MystC5RRU

    Details:

    Receive radio signal from bus of Double Data Rate Synchronous Dynamic Random Access Memory DDR2 desktop an DDR3 desktop and notebook with single and dual channel. HackRF One, RF Analyzer and Andoid phone use to receive, display signal and record video.

    Details of ram technology

    First PC:

    frequency of bus: 400.3 Mhz
    Channel: Single
    Ram: DDR2 2Gb
    Number of bank: 1 (1x2Gb)
    Timings: Not Overclock, default
    Computer: Desktop

    Second PC:

    frequency of bus: 824..2 Mhz
    Channel: Dual
    Ram: DDR3 16Gb
    Number of bank: 4 (4x4Gb)
    Timings: XMP Overclock
    Computer: Desktop

    Third PC:

    frequency of bus: 665.1 – 669.0 Mhz
    Channel: Dual
    Ram: DDR3 8Gb
    Number of bank: 2 (2x4Gb)
    Timings: XMP Overclock
    Computer: Notebook

    Test – Tempest for Eliza: Generate radio modulation signal by showing patterns on your monitor:

    https://www.youtube.com/watch?v=CHV8wrorl70

    details:

    AM Radio Signal Transmitter by showing patterns on your monitor and receive with HackRF One and demodulated with HDSDR.

    if you look at my other videos you can find how you can also transmit digital messages, encoded and decrypt them.

    Code for linux:

    http://www.erikyyy.de/tempest/

    https://github.com/priikone/tempest-AM/

    Code for windows:

    https://cryptome.org/2015/09/tempest-test-for-windows.htm

    pubblication:

    https://hackaday.com/2005/12/25/tempest-for-eliza/

    comment:

    OnLine there are some broken links to some software to generate radio signals with CPU and PCI:

    https://cryptome.org/tempest-cpu.htm

    http://lambda-diode.com/resources/tempest/sccte.html

    Broken Link:

    http://altern.org/berke/tempest-cpu.tar.gz
    http://altern.org/berke/tempest-crt.tar.gz
    http://altern.org/berke/tempest-pci.tar.gz

    http://lambda-diode.com/tempest/tempest-cpu.tar.gz
    http://lambda-diode.com/tempest/tempest-crt.tar.gz
    http://lambda-diode.com/tempest/tempest-pci.tar.gz

  5. BiOzZ

    … What’s a web app doing on the system management bus?
    But it makes sense … The system management bus is the longest single ended bus on most computers

Post a comment

You may use the following HTML:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>