Don't mind the air gap - Maximizing exfiltration speeds via HDMI TEMPEST

The talk starts with a persistent radio noise the speaker kept hearing at home. Plotting its samples as an image revealed a recognisable desktop, showing that a display link was leaking what it showed. Because HDMI encodes each colour as a 10-bit symbol with differing radio amplitudes, the speaker mapped colours to signal levels and built a crude one-way channel using stripes on screen.

From there the speaker designed a unidirectional protocol with packets, position headers, forward error correction, checksums, preambles and frame repetition, since there is no return channel to request retransmission. An early vertical layout suffered from cache misses and tearing on a Raspberry Pi 4, so the layout was changed to horizontal. Reception used a cheap software-defined radio, a directional antenna and a laptop. Throughput reached roughly 200 kbit/s through a closed door, and about a megabit per second after optimisation. The talk also covered hiding data in screensaver-like images, the limits for file transfer versus streaming, and possible uses such as keylogging and game debugging.

Near the end the speaker described HDMI 2.0 spread-spectrum as a mitigation that makes the signal less repeatable, and reported that foil and chicken wire had no measurable effect in tests. The takeaway is that a display link can leak outside an air gap, so physical emanations should be treated as a possible channel in sensitive environments.