Source-linked AI summary
Do Electromagnetic Side-Channel Attacks Threaten Electronic Polling Stations? Scenarios and Recommendations
Lucas Brito, Leonardo Teodoro, Pedro Tomaz, Alyson Isaluski, Leandro Hyeda, Antonio Oliveira-Jr, Saulo Queiroz
TL;DR
The paper asks whether electromagnetic side-channel attacks threaten ballot secrecy in Brazilian electronic voting machines, a concern framed by a recent attempt to violate secrecy. It proposes polling-station attack scenarios and tests them with software-defined radios; image reconstruction was possible under close-proximity scenarios, while awareness and oversight are recommended as mitigations.
Problem
The paper examines whether electromagnetic side-channel attacks can threaten ballot secrecy in Brazilian electronic voting machines, a concern raised alongside a recent secrecy-breach attempt.
Source: §1 · p. 1Method
The authors propose two polling-station attack scenarios and experimentally evaluate them using software-defined radios and a VGA monitor reproducing the UEB interface.
Source: §4 · p. 5Results
Information displayed on the target monitor could be inferred in all scenarios considered, but not at greater distances and/or with additional obstacles.
Source: §4 · p. 5Takeaways & Limitations
Abstract
from arXiv · showhide
This paper investigates the threat to ballot secrecy in the Brazilian electronic voting machine (UEB) posed by electromagnetic side-channel attacks, also known as TEMPEST attacks. In these attacks, screen content can be reconstructed remotely by intercepting electromagnetic emanations associated with the target device's video signal. This work is motivated by a recent ruling by a Brazilian electoral court concerning an attempt to violate ballot secrecy using electronic equipment. Based on publicly available information about the electoral system, attack scenarios against polling stations are proposed. Experiments using software-defined radio show that the effectiveness of TEMPEST attacks strongly depends on the lack of oversight resulting from public unawareness of the threat. Finally, awareness guidelines are proposed for voters, poll workers, and party representatives to mitigate attack risks within a polling station.
1. Introduction
The paper examines whether electromagnetic emanations from Brazilian voting machines can threaten ballot secrecy, against a backdrop of a recent secrecy-breach attempt and limited reproducible work on voting-system attacks.
1. Introduction
- A Brazilian electoral court removed a councilor for recruiting voters to wear glasses with miniature cameras to violate ballot secrecy.The paper uses this case as context for investigating a different threat: electromagnetic side channels.Source: §1 · p. 1
- A TEMPEST attack captures electromagnetic emanations from video-signal transmission and can reconstruct the image, compromising confidentiality but not integrity or availability.Traditional encryption does not directly mitigate this threat because the image must be displayed intelligibly to humans.Source: §1 · pp. 1–2
- After van Eck phreaking was demonstrated in the 1980s, improved technology enabled research on TEMPEST attacks across devices, scenarios, and techniques.Examples include multidisplay systems, smartphones, and deep-learning approaches.Source: §1 · p. 2
- Prior reports on TEMPEST and electronic voting lacked sufficient technical detail for reproducibility or did not examine operational scenarios in Brazilian polling stations.A study of the Brazilian machine’s graphical-interface signal signatures did not address polling-station vulnerabilities.Source: §1 · p. 2
2. Video Signal
This section models the video signal used to explain how pixel information appears in the frequency domain and can remain exploitable in TEMPEST attacks.
2. Video Signal
- In pulse amplitude modulation, each discrete pixel modulates a time-shifted rectangular pulse, producing the continuous-time video signal.The pulse duration Tp is the interval associated with each pixel.Source: §2 · p. 2
- The pixel interval Tp depends on pixels per line, lines per frame, and frame refresh rate; the pixel rate is fp = 1/Tp.Pixel and line counts include blank pixels used for synchronization, which do not represent visible content.Source: §2 · p. 2
- The signal spectrum has components spaced by the pixel rate, and practical pulse and channel distortions leave observable energy near frequencies where an SDR may perform an attack.Although the ideal rectangular-pulse spectrum has zeros at integer multiples of the pixel rate, bandwidth limits, noninstantaneous rise times, and channel distortions alter the pulse shape.Source: §2 · p. 3
3. Attack Scenarios and Experiments
The paper proposes polling-station attack scenarios based on access from adjacent spaces or by people inside the station, then experimentally assesses image reconstruction and recommends stronger oversight.
3. Attack Scenarios and Experiments
- Scenario 1 places an SDR-computer setup in an adjacent room, corridor, or public street, where proximity to a booth near a wall may facilitate capture.A real polling station is described as having adjacent rooms and a public street separated from a booth by potentially only a masonry wall.Source: §3 · pp. 3–4
- Scenario 2 recruits someone with legitimate station access to carry a portable, battery-powered SDR for later offline analysis, potentially bypassing the 0.5-meter distance boundary for UE2020 and UE2022.The cited boundary is associated with expected electromagnetic attenuation in those models.Source: §3 · p. 4
- Tests used 1280 × 768@60 and 1920 × 1080@60 signals; intercepted signals were sampled at 54 MHz, with legible captures at the 3rd, 6th, and 7th harmonics.The experiments used an Ettus USRP B200 and converted resynchronized samples into images with GNU Radio’s gr-tempest module.Source: §3 · p. 4
- The displayed candidate number was identifiable in both experimental scenarios, while additional walls or greater distances prevented visually intelligible reconstruction.The figure presents reconstructions across a masonry wall and without obstacles.Source: §3 · p. 4, Figure 2 · p. 5
- The authors recommend informing poll workers, voters, and party representatives about TEMPEST attacks and SDR devices to strengthen oversight and deter the threat.They emphasize both the existence of the attacks and the typical appearance and operating characteristics of SDRs.Source: §3 · p. 5
4. Conclusions and Recommendations
The paper experimentally evaluates two TEMPEST attack scenarios against the Brazilian voting machine interface and finds that nearby adversaries can infer displayed information. It recommends physical-placement precautions and awareness efforts for polling-station participants.
4. Conclusions and Recommendations
- The scenarios tested an adversary about 1 meter away behind a masonry wall and a recruited insider carrying a compact radio for later analysis.Experiments used a VGA monitor reproducing the UEB interface’s visual characteristics.Source: §4 · p. 5
- Displayed information could be inferred in both tested scenarios, but not at greater distances and/or with additional obstacles.The authors identify physical proximity as a key factor in risk.Source: §4 · p. 5
- The authors recommend avoiding UEB placement beside walls adjoining poorly monitored spaces and informing voters, poll workers, and party representatives about TEMPEST attacks and SDR devices.They also suggest the work may encourage discussion of electromagnetic security, public transparency, and side-channel mitigation in Brazil’s electoral context.Source: §4 · pp. 5–6