Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Interesting - but 800-900MHz (the mentioned harmonic frequencies) are blasted with LTE and 5G in Europe.
But maybe with a sharp filter (there's a gap between up- and downlink) it can be used with a RTLSDR. But the RTLSDR hates close strong signals as its 8-Bit ADC doesn't have much dynamic range.
by BlackRabbit1 - Really interesting concept! I would not have thought of EMR variation as a usable side channel for this.
IIUC, the EMR increases following scene changes (like a light being turned on or off) are a result of the fact that video codecs try hard to compress similar images. So, I speculate that an "extremely bad codec" that simply dumps raw pixels to storage would not produce such variation, and therefore remain undetectable?
- The final boss of detection doesn't need the camera to be powered at all.by bob1029
- Dan Gelbart's lecture on sensors[0] explains another fascinating method in detail using RF as well as the optical scanning method mentioned in the original video. The full lecture is worth a watch, but the timestamp is where the RF method explanation starts.by Zanfa
- It’s really clever.
The idea is that cameras read/write to a disk. That cause electromagnetic radiation that is detectable.
Then this drone does [something/move/stimulus] to trigger more read/write/EM radiation.
But part of me can’t believe this is the cutting edge in 2026? Feels like 60s engineers would’ve thought about this
by redanddead - The speaker in the video was extremely difficult for me to understand but the idea seems quite clever.
What I'm most surprised about is just how well it actually works... I did not think such EM fluctuations would be usably detectable from several meters away... but I suppose this may be moreso due to improper/lack of shielding in the first place, which I would think should be easily fixable in most products to mitigate this type of detection.
- TSCM services commonly employ non linear junction detectors, if you have a legit need and money to spend and worry that your offices have been bugged (or are at risk of being bugged), you absolutely can hire them. This isn't really a new thing. More advanced highly portable RF equipment, portable spectrum analyzers and things built with relatively low-cost SDR that talk to Linux SBCs make the equipment to do this a lot less costly than it used to be.
If the intention is to RF "illuminate" an array of DRAM, portable GaN based amps in different bands capable of directing RF at an area (let's say, with a set of horn antennas on a plastic rolling cart being taken around an office) are also a lot smaller and less power hungry than they used to be.
Edit: Looking at the Zhang PDF, the box next to the laptop in figure 15 is a USRP 210 SDR, and a basic log periodic antenna on a PCB.
https://www.google.com/search?client=firefox-b-d&q=USRP+B210...
https://www.ettus.com/all-products/ub210-kit/
So really this boils down to "we're using a COTS SDR repurposed as a spectrum analyzer and we've written custom software to sniff what it looks like when DRAM is actively being used in a small embedded device". Some serious TSCM firms have been doing this for 35 years, just the equipment is a hell of a lot smaller and cheaper now.
by walrus01 - This made me think of The Thing, a fascinating listening device made by the Soviets that was completely passive until powered remotely. Very difficult to detect when unpowered.
https://en.wikipedia.org/wiki/The_Thing_(listening_device)
And then I thought, something similar might be possible for video. Turns out, yep.
https://ieeexplore.ieee.org/document/8719264
The Eye of Sauron paper does acknowledge the limitations that would likely prevent it from working against such a device. Impressive nonetheless. True privacy/security is just very hard!
by sholladay