EEVblog #956 - Countersurveillance Monitor Teardown - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: December 16, 2016, 03:51:16 am
content: How does a Countersurveillance Monitor (a.k.a Bug Detector) works to sweep a room for bugs?Teardown of the Research Electronics CPM-700Also a look at the NSA "LoudAuto" radar retro-reflector spy bug, and some cold war ear Soviet embassy espionage.NSA Spy Devices Brochure:https://www.eff.org/document/20131230-appelbaum-nsa-ant-catalog

author: Vgkid
author_rank: Super Contributor
timestamp: December 16, 2016, 06:24:17 am
content: Thanks for the teardown.I like the untrimmed resistor lead sticking through the hole above the headphone jack.

author: salbayeng
author_rank: Frequent Contributor
timestamp: December 16, 2016, 06:48:04 am
content: QuoteMethinks a typo there Dave,Maybe "cold wet ear" ?, as a consequence of having to lift your furry hat to get the headphones on, in the middle of a blizzard.

author: Barny
author_rank: Frequent Contributor
timestamp: December 16, 2016, 07:10:15 am
content: Nice teardown.I thought this days, bug detectors are only used for private EMC tests because everyone tabs in the NSA-wet dream (smart phone) and PC's.

author: Towger
author_rank: Super Contributor
timestamp: December 16, 2016, 08:12:30 am
content: Hacked firmware on on your Internet connected thing is all it takes these days. VOIP phones, Conference Phones etc. Even Fraser said they don't like high tech smoke detectors with too much processing power for their own good these days.

author: EPTech
author_rank: Regular Contributor
timestamp: December 16, 2016, 09:15:40 am
content: Hi Dave,You should take it over to Ted Wale and sweep his house for bugs. Maybe there are even some that he no longer remembers making. He'd say: Aw, I made that one 20 years ago.Good battery life on that one. I am almost afraid to ask, but is Ted stil around?Greetings from a Belgian viewer.

author: tszaboo
author_rank: Super Contributor
timestamp: December 16, 2016, 09:25:24 am
content: Quote from: Towger on December 16, 2016, 08:12:30 amAnd people buy Amazon Echo, Google home, Microsoft Xbox with kinect and chinese android phones voluntarily.

author: madires
author_rank: Super Contributor
timestamp: December 16, 2016, 01:26:12 pm
content: You can still buy it (http://www.detective-store.com/counter-surveillance-equipment-probe-cpm-700-981.html) or look for the deluxe version (https://reiusa.net/wp-content/uploads/2016/06/CPM-700-Brochure.pdf) up to 12GHz. Is it useful nowadays? There are much more methods for eavesdropping, a lot without the need to enter the target's building/home for placing some bug. One of the recent hacks showed was an office PC with headphones connected. Hacked PBXs and office phones are old school.

author: SeanB
author_rank: Super Contributor
timestamp: December 16, 2016, 07:29:55 pm
content: Well I can identify the one IC, the good old LM380, used as the power amplifier. Even with that top sanded to nothing you can recognise that 7 grounded pin centre, with the large copper planes either side, exactly the same size as the datasheet footprint as well. I will bet the other opamps are CA3080, as they are really only acting as audio amplifiers, and the high input impedance is a bonus. Then you have a 4066 quad analogue switch, being used as mute for the one in the middle row, and the IC's in the front are probably LM324 used as analogue filters to get the noise down by filtering the bandwidth down to telephone quality, and then one being used as a comparator.Input probe is easy as well, first will be a MAR8, and the second another, operating off 9V supplied up the cable. Probably the first one has been cooked by ESD, as they are running there with sweet FA as input protection, and they are kind of sensitive to ESD damage.http://www.minicircuits.com/app/AN60-060.pdfthe resistor values kind of suggest operation off around 9V, and the ferrite bead and the 100n chip caps are standard values for using them from around 100kHz to microwave band, though the coupling caps will not be a real capacitor at some point when they hit resonance.

author: Fraser
author_rank: Super Contributor
timestamp: December 16, 2016, 07:38:54 pm
content: Interesting video but not all such equipment is so simple.To detect an RF or Mains carrier device used to be a case of just detecting the RF energy. For the attacker it is hard to beat basic physics and a wide band RF detector worked reasonably well. The simple detectors like the one featured do not cope with today's RF rich environment and are considered pretty much obsolete by serious players in the business.The world of TSCM outside Government agencies has always been awash with all manner of detection equipment. Some actually tries to do a decent job, whilst others kit is basically junk with lots of flashy lights etc to make it look impressive to the client. The commercial TSCM industry has been full of cowboys for many years. In the UK there is an accreditation process to sort the men from the boys when it comes to TSCM work.More sophisticated broadband RF and mains carrier detectors, that were produced in the same decade as the featured model are the Autolock, Scanlock and Ranger units. Audiotel (Security Research) were a manufacturer of such equipment 'back in the day' . They tried to make TSCM equipment that actually did a good job. The Autolock and later Scanlock series use a standard swept tuning Superheterodyne receiver with a front end that covers up to 2GHz or 3GHz in later models. The 'clever' bit was the speed of scanning. The full 2 GHz Spectrum in around 1 second. A normal synthesised local oscillator could not achieve this at the time so they used a Harmonic Comb output local oscillator that swept over just 24MHz and produced all the required harmonics that were in turn swept at the fundamental rate.A Harmonic comb oscillator is a terrible idea for a decent radio receiver, but an excellent idea if wanting to sample a large frequency range for RF in a very short period of time. The Scanlock could do a similar low frequency scan of the utility mains and included a double modulation demodulator for the more sneaky devices of the era. The Scanlock also provided normal AM and FM detection and demodulation. A tone mode was included that emitted a loud tone from the units speaker and then scanned the spectrum looking to find a signal that carried the same tone in its modulation. An audio feedback mode also provided the ability to detect an acoustic feedback path from the Transmitter MIC to the Scanlock where it was demodulated and sent to the speaker to cause an intermittent tone Both such techniques are highly alerting to the listening post and so bad trade craft. Remote controlled eavesdropping devices demand very careful TSCM survey tradecraft so as to be as non alerting as possible.The Scanlock worked well for what it was designed for and the era of transmitter technology that it was used against. You still had to sweep the antenna over all surfaces as you took advantage of RF near field characteristics of the transmission. The unit was sensitive enough to receive normal radio stations as well though.Well this was a trip down memory lane. The detailed detection equipment is all very outdated now.Effective TSCM surveys are as much about the knowledge and training of the practitioner as the detection equipment used. A good TSCM practitioner knows that controlled spaces are a key countermeasure and the MK1 eyeball combined with an inquisitive and knowledgeable mind can be a most effective weapon against many eavesdropping techniques. Only the cowboys believe you need all the electronic test equipment you can afford with its associated lights and buzzers...... they are in the game of extracting as much money as possible from clients using scare mongering tactics, and trying to justify the high costs with flashy equipment that in many cases is pretty ineffective, or in some cases totally ineffective due to operator incompetenceThere is big money to be made in the professional world of TSCM so it is no surprise that Cowboys are a plenty offering such services.In case anyone misunderstands me. Yes professional TSCM practitioners do use sophisticated TSCM equipment that actuallly works and they use it with the knowledge required for success. A TSCM practitioner must have knowledge of many attack vectors these days including IT and various communications equipment.Technology is not always the best tool.The very best intelligence gathering method in many cases is a disenchanted employee or an employee with a moral aversion to an organisations activities. Eavesdropping systems, whilst they have their place, cannot be targeted as well as an employee.Snowden ...... hero with a conscience, or naive attention seeking traitor to his country ? Hmmm now there is a question.Fraser

author: cdev
author_rank: Super Contributor
timestamp: December 20, 2016, 11:53:50 pm
content: I have seen a description of a device that scans for non-linear junctions by transmitting a pair of fairly strong RF signals that sweep through the spectrum and monitoring for mixing effects.

author: Fraser
author_rank: Super Contributor
timestamp: December 21, 2016, 10:37:30 am
content: Yes, NLJD aka harmonic radar. Frequencies are normally fixedFraser

author: Fraser
author_rank: Super Contributor
timestamp: December 21, 2016, 12:39:16 pm
content: Audiotel are still in business and produce some Non Linear Junction Detectors for TSCM work.https://www.audiotel-international.com/collections/sbThere are different types of NLJD in terms of frequencies transmitted, RF output power and number of harmonics received. These does effect performance. This can be a sensitive topic so I will limit my comments to public domain knowledge only.Plenty about how non linear junction detector work on the internet. The first working NLJD was made public by Charles Bovill in the late 1960's, early 70's. It was thought to be the panacea to all hidden electronic devices. Not so however. Any metal to metal contact can create a 'false' semiconductor junction that may confuse the operator. A genuine semiconductor junction is detected strong at the 2nd Harmonic. A 'false' junction is also detected at the 2nd Harmonic, but it also creates a 3rd harmonic signal that may be used in a comparator to present the user with a 'Quality' of response indication... True or False Junction. This is based purely on 3rd Harmonic presence and is not that accurate in the real world.Correct use of an NLJD is paramount to success and the user must be trained and gain real world experience on the equipment before becoming truly effective in its use. Many treat it like a 'Broom' sweeping the walls, with little or no knowledge of the physics of the situation and limitations of the NLJD. It always impresses the clients though as they expect to see a 'Sweep' team sweeping the walls with impressive looking kitIIRC Audiotel actually called their NLJD units 'Super Broom'Yea! sweep out those nasty 'bugs' with it.... as if it were that simple !Fraser

author: Fraser
author_rank: Super Contributor
timestamp: December 21, 2016, 12:47:35 pm
content: Audiotel still manufacture TSCM receivers as may be seen here:https://www.audiotel-international.com/collections/scanlock-m3-tscm-counter-surveillance-systemThere is still a large and wealthy customer base for such units.Whether or not they works as well as claimed or are worth the money, I leave for you to decide.Fraser

author: Fraser
author_rank: Super Contributor
timestamp: December 21, 2016, 01:05:58 pm
content: Audiotel bought the rights to another counter surveillance 'receiver/detector' unitIt s named the Delta V. The name came from the fact that it measured the RF energy slope differential (Delta) across its two antennas that were shaped in a 'V' configuration. Audiotel obviously wanted to keep the name but not the V format antennashttps://www.audiotel-international.com/collections/delta-v-advanced-differential-near-field-rf-bug-detector/products/delta-v?variant=4164675908It is quite a clever little unit really. Basically each 'sense' antenna receives a spatial sample of the near field RF energy. The antennas are separated by around 40mm so theoretically are exposed to different levels of RF energy due to position within the near field RF energy. In theory such a device will work in the near field of a transmitted and tend to ignore far fields RF signals with lesser differential across the antennas. The Delta V may also be used as a sensitive non differential RF detector by attaching only one antenna to it.The internals of the unit are pretty simple as you can imagine. Basically the two antennas feed the RF to sensitive microwave rated detector diodes. The DC output from the detector diodes is fed to a comparator circuit that produces a DC output representative of the difference in RF signal level between the two antennas. The varying voltage is fed to a V to F tone stage to generate an audio pitch that changes in response to changes in RF between the antennas. Some later models also offer an LED bar graph differential signal meter as well.The Delta V is actually quite cheap when compared to some TSCM kit. Once again, however, its use is not as simple as the OEM would like you to believe. Good TSCM effectiveness relies upon practitioners having appropriate training and field experience in order to interpret the responses of the equipment they use.Fraser

author: Fraser
author_rank: Super Contributor
timestamp: December 21, 2016, 02:20:54 pm
content: @Cdev,Intermodulation Radar that you asked about does exist. There is much in the public domain about such technology. It is just basic physics in action.Fraser

author: cdev
author_rank: Super Contributor
timestamp: December 21, 2016, 03:06:38 pm
content: This equipment is very interesting in the light of the development over the past few years of cheap software defined radio. One has to wonder whether the value they add is just basically in the software they apply to the problem and the low cost hardware to perform such feats likely already exists and increasingly is not really rocket science to understand..As a taxpayer, when I read about the government spending upwards of US $60,000 on a simple box containing a SDR, regardless of the specialized use its put to, I get a little hot under the collar.@FraserThank you for passing this on, this is really interesting!

author: Fraser
author_rank: Super Contributor
timestamp: December 21, 2016, 04:19:38 pm
content: Sadly with TSCM kit you are entering a world of both scoundrels and custom manufactured hardware. The scoundrels sell crap at high mark-ups and the custom builders of quality TSCM kit are specialists who have an uncommon and deep understanding of the true TSCM challenges. They charge for their skills , knowledge and expertise. They do not come cheap even when recruited into an establishment as staff. £100K is not uncommon for a proof of concept research project. Time is money and much time is often needed.You have to remember that at the Government level, this is not a 'game' and lives can be at stake. The attacker does everything possible to avoid deployed covert equipment being discovered, whilst the defender tries to think outside the box to detect the 'undetectable' it is a battle of minds. Fancy kit with lots of lights on is not the answer.

author: timb
author_rank: Super Contributor
timestamp: December 21, 2016, 09:52:00 pm
content: Great info Fraser!

author: Brumby
author_rank: Unknown
timestamp: December 21, 2016, 09:53:02 pm
content: Quote from: Fraser on December 21, 2016, 04:19:38 pmThe cat-and-mouse challenge has long intrigued me. As much as any bit of TCSM gear may be effective in the field and that it's principles of operation something which would want to be kept secret, the fact is - with both the kit out and the training out in the wild, spies would have an opportunity to get a hold of it. Once in their hands, the exercise would be to find and exploit weaknesses, thus compromising the value of the tech. If done surreptitiously (which is what you would expect) counter surveillance teams may not know about it until some secrets have been compromised. The trick is to then discover how that was done and develop tech to address it. Rinse and repeat.Even more challenging is that I can see both sides of this 'game' not waiting around for signs the bar has been raised - but assume it has and then work on ways to identify threats and solutions.Don't think I'll be holding my breath for many manuals or schematics to be available online.

author: Kelbit
author_rank: Regular Contributor
timestamp: December 24, 2016, 08:23:05 am
content: How does the TSCM business handle spread-spectrum and UWB techniques? With modern ultra-low-power RF tech it's not hard to imagine a bug which takes a digital stream and then modulates it at an obscenely high chip rate, burying the signal well under the noise floor of any spectrum analyzer.