CPU Activity Analysis using RTL-SDR

Abstract

Every device emits signals into the electromagnetic spectrum while operating. This data can contain useful or harmful data about the device or about the information that it is processing. These emissions can be observed with appropriate tools. In this thesis the examination radiated from a processor of a computer are monitored to gain useful information about the state of the processor. The focus is not to spy, rather than plan a device that could be used in detecting malicious code running in the computer by analysing emissions received from the machine. This whole process is done using RTL-SDR receiver. Main purpose of this study is to provide proof of concept if this kind of device can be used in this kind of rather extensive data gathering task. This study consists of two parts. In firs part that is literary review the basic principle of electromagnetic radiation is discussed in the scope of the following empirical study. For the literary review wavelength, frequency, hertz and sampling are considered for the spectrum data acquisition point of view. The principles on how electric field is formed and what constitutes to the electric density and distribution of that field is considered, so that reader can form an understanding on how this electromagnetic field is formed. In second part of this review computer components are considered in the scope of how they produce emanations described in the first part. Mostly a processor, memory and registers are considered, they hold most of the information content and they involve in the data processing directly, so emanations send by these components should hold most of the information content that is available from the computer. The second part of this thesis is empirical study on how RTL-SDR manages to gather useful information from the target computer and can this data be utilized in some way. First goal is to prove that emissions caused by the computer are observable. If this can be proven, then this data is collected and analysed further to gain useful information from it. The theoretical background clarified the nature of electric and magnetic field and how these can be observed. Density of these field was also discussed as well as useful properties of the magnetic field: the skin effect and the proximity effect which should bring the magnetic field at the surface of the conductor where it should be easiest to detect. During the empirical part of this study, electric fields related to the processor was detected and it was measured and analysed both in MATLAB and Pandas. These results gave some information about the computer, but the constraints of the measuring device prevented the data gathering from higher frequencies. These obstacles can be overcome with higher quality gauges, so that whole necessary spectrum can be analysed.