MX Has a Story to Tell: Hacking MX Records for Fun, Profit and Data

MX Has a Story to Tell: Hacking MX Records for Fun, Profit and Data

Speakers: Dylan, Offensive Security Researcher

Conference: BSides Seattle

YouTube: https://www.youtube.com/watch?v=wWdP7AFX9ss

Overview

Dylan, an offensive security practitioner based in Seattle, presents original research on exploiting electromagnetic emanations from LCD monitors to exfiltrate data from air-gapped networks. Building on the NSA's classified TEMPEST program and decades of academic research on CRT monitors, Dylan demonstrates that modern LCD displays -- long believed to be safe from this class of attack -- are vulnerable through their HDMI and DVI cable connectors, which leak sufficient electromagnetic radiation to transmit encoded data.

The talk delivers a working proof of concept that encodes ASCII characters into Morse-like patterns using pixel manipulation on a compromised LCD monitor, captures the resulting EM emissions with a software-defined radio (SDR) and a cheap Amazon antenna, and decodes the transmission using custom Python scripts. Dylan successfully demonstrated transmission through three walls, multiple mirrors, and 20 feet of building material.

This research matters because air-gapped networks remain the gold standard for protecting the most sensitive systems -- nuclear facilities, classified government networks, financial trading systems. Demonstrating a practical, low-cost exfiltration channel through LCD monitors challenges assumptions about the security of physical isolation.

Background

▶ Watch: Dylan introduces TEMPEST research on LCD monitor EM leakage (0:15)

The history of EM emanation attacks dates back to 1985 when Dutch researcher Wim van Eck published the first unclassified paper, "Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk." This paper proved that intercepting CRT monitor emissions was not the highly complex endeavor that governments had assumed, prompting the NSA to formalize the TEMPEST program for controlling compromising emanations.

CRT monitors were particularly vulnerable because they used an electron gun that sequentially illuminated individual phosphor dots, creating strong, analyzable EM signatures. LCD monitors were long considered resistant because they update pixels in entire rows simultaneously at lower energy levels, lacking the deflection coils that made CRTs such potent radiators. German researcher Markus Kuhn produced extensive research confirming that LCD panels themselves have minimal useful emanations.

However, as Dylan's research demonstrates, the display panel is not the only attack surface. The data cables feeding the monitor -- particularly unshielded DVI and HDMI connectors -- leak electromagnetic radiation that can be captured and decoded. The most famous attack on an air-gapped network remains Stuxnet, which targeted Iranian nuclear centrifuges via infected USB drives disseminated at nearby conferences. Dylan's research offers a complementary exfiltration technique that requires no physical media to leave the secured environment.

Key Findings

▶ Watch: History of TEMPEST: 1985 Van Eck paper and NSA response (3:50)

The primary finding is that LCD monitors leak exploitable electromagnetic radiation through their DVI cable connectors, sufficient to transmit encoded data at detectable levels through three walls and 20 feet of building material. This contradicts the widespread assumption that LCD monitors are inherently safe from TEMPEST-class attacks.

The encoding scheme maps ASCII characters to sequences of three amplitude peaks (short or long) in the negative amplitude range of the captured signal, creating a Morse-like encoding. The transmission is slow -- the example payload "tasty food seven" (no spaces, no capitalization) produced over one million frames of data. This makes the technique viable only for targeted exfiltration of high-value, low-volume data like passwords or encryption keys.

Dylan identified that the optimal capture frequency is tied to the monitor's refresh rate harmonics. Without knowing the target monitor's refresh rate, an attacker could spend hours scanning frequencies without finding the strongest transmission. Pre-engagement reconnaissance of the target monitor model is essential.

The entire attack setup costs under $100: any monitor, any software-defined radio (like an RTL-SDR), and the cheapest available antenna. Dylan compared the difficulty level to the programmable barcode toolkit presented at a past DEF CON -- achievable in about a week of setup, but not a push-button tool.

Technical Deep Dive

▶ Watch: Proof of concept gear: any monitor, SDR, cheap Amazon antenna (10:20)

The attack chain has four phases: infection, transmission, capture, and decoding.

Infection requires getting malware onto the air-gapped target. Dylan notes that social engineering is preferred because it is harder to trace back, one-time physical access works, and the Stuxnet approach of distributing infected USBs at nearby conferences "worked for the US, it will probably work for you." The malware must be targeted -- broadcasting from every compromised machine would be extremely noisy and detectable.

Transmission works by programmatically controlling pixel patterns on the Windows display to maximize EM leakage from the DVI connector. The code modulates pixels to create controlled amplitude variations in the emanated field. This is described as "really, really trivial" from a Windows programming perspective. The transmitter uses AM (amplitude modulation) radio, where the intensity of the waves encodes the data rather than frequency changes.

Capture requires a listening station within range. Dylan used CubicSDR, a software-defined radio application, to capture the transmissions. The key challenge is finding the right harmonic frequency among the many produced by the monitor's refresh rate. Each harmonic appears as a tall vertical line when scanning, and the attacker needs to narrow in on one with the best signal-to-noise ratio. The captured data is saved as a waveform file.

Decoding is the most technically challenging phase. The captured waveform contains over a million frames for even a short message. The negative amplitude peaks below a threshold (around -9,000 in Dylan's examples) are the signal; everything above is discarded. Three consecutive peaks (short or long) map to one ASCII character using a custom encoding table. Dylan wrote Python code using matplotlib for visualization and custom filtering logic to isolate the peaks. He notes that lowering the capture bandwidth produces cleaner waveforms but compresses the signal closer to the noise floor, making automated filtering harder.

Dylan suggests that AI-based image analysis could improve decoding, since the waveform patterns are visually easy to distinguish even when programmatic analysis struggles with filtering thresholds.

Demo / Proof of Concept

▶ Watch: Decoding captured waveforms: over 1 million frames for a short message (11:50)

Dylan demonstrated the attack live, showing the raw waveform file in CubicSDR and panning through frequencies to locate harmonics. The captured waveform visually displays the encoded beeps as vertical lines against the background noise. He showed the massive scale of the data -- scrolling through the waveform file to illustrate that even a short message produces an enormous amount of raw capture data.

The live audio demonstration encountered some technical difficulties with speaker output, but Dylan walked through the sound characteristics: distinct beeps at the target frequency that become fuzzier as the bandwidth widens. He also showed his Python decoding script and the character-to-beep mapping table, acknowledging it could be optimized by mapping the most frequent English characters to the shortest beep sequences.

Defensive Implications

▶ Watch: Q&A: shielded cables, redundancy methods, and CRT vs LCD differences (20:00)

For defenders protecting air-gapped environments, this research reinforces that physical isolation alone is insufficient. Specific countermeasures include:

Shielded cables alone are not enough -- the entire machine and its peripherals must be shielded. Dylan references Red/Black separation standards and fully hardened machines as the proper mitigation for high-security environments.

Organizations should evaluate whether their air-gapped systems use unshielded DVI or HDMI cables and consider the physical proximity of publicly accessible areas to sensitive equipment. An attacker sitting in a parking lot with an SDR and antenna for two hours could potentially capture transmissions if they have pre-identified the target monitor's refresh rate.

Policy controls disabling HID connections on air-gapped systems add a layer of defense against the initial infection vector, but social engineering remains the primary threat for getting malware onto isolated systems.

Key Takeaways

• LCD monitors leak exploitable electromagnetic radiation through DVI/HDMI cable connectors, not the display panel itself
• A working exfiltration channel from air-gapped networks can be built for under $100 using commodity SDR hardware
• Transmission range extends through three walls and 20 feet of building, but bandwidth is extremely low -- only targeted, high-value data like passwords should be exfiltrated
• Knowing the target monitor's refresh rate is critical for quickly locating the optimal capture frequency via harmonics
• Defensive countermeasures require full machine shielding, not just cable shielding, plus Red/Black separation standards
• The technique could potentially be enhanced with AI-based image analysis for decoding waveform patterns

About the Speaker(s)

Dylan is an offensive security researcher based in Seattle, originally from Los Angeles. His background includes teaching, running CTFs, analyzing and writing ransomware, and working primarily in web application and database security. He describes himself as working "all things offensive" and openly admits limited blue team knowledge. Outside of security, he produces electronic music -- notably, his first album used melodies generated from electromagnetic wave patterns captured during this research.