Saturday, October 17, 2009

EM weapons

Interested in EM weapons? Enjoyed reading the GBPPR archives?

Guess what?  Almost everything (including built projects) in those pages was done wrong. Quite a lot of the theory is wrong. Some of the devices just aren't reliably effective (ie; ANY device built from a microwave oven magnetron). Some of them present more of a danger to the user than the target.

I just re-read -- for the first time in maybe ten years -- Winn Schwartau's classic piece (ch.10 of "Information Warfare") on "HERF Guns & EMP/T Bombs". There's a lot of good stuff in there, but nowadays, I have the background and knowledge to see that there is more sensationalism than solid science in the writing. He got some important theory wrong, and missed a lot of important details.

EDIT, A DAY LATER: it just occurred to me that that might have been deliberate.  It's not my intent to criticize his work, I just want to point out to the budding mad scientists & junior hackers out there who might be researching this subject that what's in that document isn't gold-plated.   I hope to meet him some day, he seems like an interesting and smart guy.

Besides, he managed to get lots of corporate wigs excited about information security at a time when most people other than hackers weren't thinking about it much, promptly founded an information security company just as the furor peaked, and made bank. How many information security consulting companies have I started up?  Right then, moving on...

David Schriner's TED using a ground plane horn and built into a VW microbus is probably the best "amateur" effort I've seen to date, and I haven't been able to find out a whole lot about the pulser he used. It looks crude. I don't think it's an UWB system, which means it is MUCH less effective against partially shielded electronic commodities such as personal computers. If there is one thing I have learned from my EMC testing experiences (and from talking to the engineers who are experts in RF susceptibility) it is that you can almost never predict what frequencies will get inside a partially shielded enclosure such as a car, a mobile phone, a laptop, or even say, a 5ESS / 5E-XC switch. (Yes, some COs are shielded, but not as many as you'd think. According to one engineer I know who worked in the telco industry, a great many COs, and the racks inside them, are not NEBS-compliant.

The frequencies to which a particular piece of gear is susceptible depend on many factors - the various combinations of slot widths (long gaps in the case) holes around connectors, the lengths of the various "antennas" connected to the equipment (power cord or charger, network cable, USB, etc) and so on. The orientation of gaps - horizontal or vertical- also dramatically affect susceptibility if the radiation is polarized, as it usually will be. (by the way, it is difficult tho not impossible to build a circularly polarized EM-weapon, but it generally involves levels of sophistication - such as EFCGs - that the amateur is unlikely to have access to.

Impulse plane-wave impulses launched from sophisticated antennas driven by a UWB pulsers appear to offer the best chance of "getting into" target equipment. And lo, that's exactly where the AFWL is putting a great deal of their EM-weapons money.
HPM is almost dead because it is too narrow-band.

If I ever dabble in this sort of thing, I will probably try a ground plane TEM horn like Schriner's device, because it's easier than a proper Impulse Radiating Antenna (a relatively new invention, with most of the research being driven by a single company/man working with the people at Sandia & AFWL). Those things look just barely possible, but rather unpleasant, to build by even a well-funded amateur, whereas TEM ground plane horns are almost as directive and only slightly less broadband.

kind regards,
Tyler Durden

PS: your helium-neon laser still doesn't count as a HERF gun, kid.
(thanks for that laugh, Tim, I'll never forget it)

No comments: