THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
1
Reflecthernet: Exfiltrating 100BASE-TX Ethernet Traffic Using a Retroreflector Hardware Trojan
arXiv:2605.02702v1 [cs.CR] 4 May 2026
Pierre Granier, Matthieu Davy, Philippe Besnier, François Sarrazin Univ Rennes, INSA Rennes, CNRS, IETR - UMR 6164, F-35000 Rennes, France Email: {pierre.granier, matthieu.davy, francois.sarrazin}@univ-rennes.fr [email protected]
Abstract—This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible. Electromagnetic eavesdropping is a well-established attack vector for remotely monitoring a target activity, most notably displays, over considerable ranges. Other targets have been considered resistant to such attacks or do not exhibit sufficient electromagnetic leakage for practical exploitation. Radio-frequency retroreflector attacks (RFRA) were developed to enable covert, active monitoring of a target by implanting a minimal hardware Trojan. These implants, typically implemented using discrete components such as transistors or diodes, do not betray their presence by emitting signals themselves; rather, they modulate the electromagnetic reflectivity of the target depending on the probed signal line data. Prior RFRA work has demonstrated their viability against video links and low-speed peripheral interfaces. In this work, we extend the applicability of RFRA to high-speed targets by presenting a successful attack on the 100BASE-TX Ethernet standard. We describe the design and realization of a compact implant capable of recovering the MLT-3 encoded signaling used in Fast Ethernet, as well as a dedicated demodulation and interpretation pipeline that mitigates errors introduced by the radio channel and maximizes the amount of recovered information. Experimental results validate the feasibility of covertly monitoring Fast Ethernet traffic using RF retroreflection and highlight the viability of such attacks for high-speed links. Index Terms—Hardware security, Data security, Trojans, Electromagnetic reflection
I. I NTRODUCTION Remote eavesdropping of a device’s confidential information through its unintended electromagnetic emanations is a long-standing concern in information security. Known broadly as TEMPEST attacks, these techniques exploit the fact that electronic components (cables, connectors and circuit traces) radiate signals that correlate with the processed data. An adversary equipped with suitable antennas and receivers can capture these radiated signals from a distance and, using signal-processing and reconstruction techniques, recover sensitive information. Display devices have long been identified as significant sources of compromising electromagnetic emanations. The seminal work of Wim van Eck in 1985 [1] demonstrated that images rendered on CRT monitors could be reconstructed from their radiated signals. Subsequent studies revealed that both analog interfaces (e.g., VGA) and digital standards (e.g., DVI, HDMI, LVDS) remain susceptible to such leakage [2]– [4] despite the adoption of high-speed differential signaling. More recently, it was shown that even scrambled interfaces
such as DisplayPort can emit discernible patterns correlated with displayed content [5], [6], indicating that electromagnetic eavesdropping persists as a practical threat across successive generations of display technology. While such attacks have been shown to be practical on video links, compromising emanations are not limited to display interfaces. Prior work has demonstrated similar vulnerabilities in a variety of communication channels, including serial links such as RS-232 [7], keyboard interfaces like PS/2 and USB [8], and even low-speed network connections, where 10BASE-T Ethernet transmissions (10 Mbit/s) have been shown to leak recoverable data through their electromagnetic signatures [9]. While TEMPEST attacks exploit a device’s unintentional electromagnetic emanations, they are inherently limited: the signals are typically weak, noisy and dependent on the target shielding, making data recovery challenging. Indeed, an attacker can only passively observe the device emanations, with no ability to amplify or encode the information, and success often depends on proximity, sensitive equipment, and favorable environmental conditions. These constraints limit the practical applicability of passive eavesdropping, particularly for low-power or shielded devices. In contrast, attacks based on a hardware Trojan (HT), i.e., a malicious modification of a circuit, provides a more controlled and deliberate means of exfiltration. The most straightforward implementation of such an implant would consist of one or more integrated circuits (ICs) capable of parsing the targeted link and transmitting relevant data over a radio link. However, this approach requires a powered implant, a non-negligible physical footprint and an active radio link, making it easily detectable. Retroreflector implants are a subset of HTs that, contrary to the previously-described structure, do not directly transmit anything, do not require a power rail, and present a smaller footprint. The principle was first demonstrated with the infamous Great Seal Bug [10], which consisted of an acoustic cavity whose properties were modulated by ambient sound via a thin moving diaphragm. The cavity was positioned at the end of a wire antenna, effectively acting as a variable impedance. By illuminating the device and recording the backscattered signal, an attacker could remotely eavesdrop on conversations within the bugged room. Retroreflector HTs gained wider attention through the leaked NSA ANT catalog documents [11], which described retroreflector HT implementations capable of recovering low data-rate information, including approximate device positioning, audio, and video content from VGA interfaces. These attacks have been referred to as Radio Frequency
THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
Retroreflector Attacks (RFRAs). In the academic literature, RFRAs have been demonstrated on different technologies, including USB interfaces [12], VGA displays [11], [13], [14], and audio systems [13], [15]. Therefore, they have been limited to either analog targets (in particular VGA, which can exhibit relatively high data rates but where the attack success does not require pixel-level recovery) or digital links with a maximum symbol rate of a few MBd (see Table I). Also, all targeted digital links were limited to a simple binary encoding scheme. Motivations: The primary motivation behind this work is to extend the attack surface of RFRA to high-speed links and more complex physical-layer encodings, by targeting highspeed Ethernet links. Indeed, Ethernet [16] remains one of the most widely deployed standards, connecting desktops, servers, industrial controllers, IoT devices, and critical infrastructures [17]. Although modern Ethernet deployments increasingly employ encryption protocols such as TLS, IPsec, or MACsec to protect sensitive traffic, a portion of Ethernet communication remains unencrypted. In particular, wired internal networks (either partially isolated or even air-gapped) are sometimes considered “safe” and therefore continue to rely on legacy protocols and applications, either by necessity or oversight. To our knowledge, no large-scale studies have systematically quantified the volume of encrypted traffic in enterprise, industrial, or embedded networks; however, it is reasonable to assume that coverage is uneven. Indeed, within enterprise networks, unencrypted DNS traffic is expected, as encrypted DNS adoption is still not widespread even outside private environments [18]. Legacy unencrypted protocols such as NFSv2/3, HTTP, or misconfigured SMB traffic can still be found in enterprise networks. Depending on the layer at which encryption is used, unencrypted lower layers can enable passive packet fingerprinting, leaking information useful for an attacker [19]. The combination of widespread deployment and persistent use in legacy and embedded systems motivates a focused investigation into the eavesdropping capabilities against Ethernet traffic. Attack model and scenarios: • Targeted links: The proposed implant architecture is designed to be embedded within one of the two differential pairs used in a 100BASE-TX Ethernet link, enabling the recovery of traffic in one direction. In the case of deployment on a 1000BASE-T link, additional hardware modifications can be introduced to force a downgrade to the vulnerable 100BASE-TX standard, thereby allowing the implant to operate on most of the commonly deployed Ethernet links. • Implementation scenarios: The proposed hardware Trojan (HT) may be integrated at the cable manufacturing or distribution, corresponding to a supply chain attack. Alternatively, the implant may be introduced when temporary access to the target is possible, enabling modification or replacement of an existing link (i.e., an evil maid attack). • Attack setup: Following implantation, no further physical access is required, and the implant remains inert unless interrogated. Interrogation is performed using two antennas and a high-end software-defined radio (SDR) capable
2
of phase-coherent transmission and reception, operating at an appropriate sampling rate. Contributions In this work, we demonstrate the practicality of targeting 100BASE-TX Ethernet links using a speciallydesigned retroreflector HT. This implant translates signals from one end of the Ethernet link into a modulation of its host’s backscattering behavior, enabling the recovery of transmitted data through an RFRA [12]. This paper makes the following key contributions: First retroreflector attack on Ethernet: We present a complete framework, called Reflecthernet, capable of exfiltrating 100BASE-TX Ethernet traffic using RFRAs. By successfully exfiltrating data at a 125 MBd symbol rate, we extend the applicability of RFRA to data rates an order of magnitude higher than those previously reported for RFRA targeting digital links (see Table I). • Attack range evaluation: We demonstrate that Reflecthernet can achieve near-complete data recovery at a range of 3 meters in an office environment with limited transmitted power. Extensive measurements in a shielded anechoic chamber show that the attack range can be significantly extended by increasing the injected power. •
In order to achieve this, Reflecthernet differs from prior work in three key aspects: Novel HT architecture: We design and implement a new HT architecture based on a simple two-diode structure, enabling effective discrimination and modulation of MLT3 signaling with minimal complexity. • High-bandwidth interrogation setup: We use an attack platform built around an RF System-on-Chip (RFSoC) evaluation board (ZCU111), which supports sampling rates of up to multiple GSa/s. This broadens the range of protocols that can be targeted by RFRAs. • Protocol-aware error correction: We propose a custom demodulation and decoding pipeline that includes an error-correcting mechanism and an error-resistant scrambler-state reconstruction, enabling reliable recovery of the transmitted bit stream by mitigating the impact of ambient noise and signal distortions on the backscatter channel. •
Link targeted
Analog / Digital
Targeted Symbol Rate ? ? ∼47 MBd ∼38 MBd
VGA
Analog
Audio (PDM signal)
Digital
2 MBd
USB Low-Speed
Digital
1.5 MBd
PS/2
Digital
16.7 kBd
100BASE-TX
Digital
125 MBd
[11] [20] [13] [14]
Attack Sample Rate ? 20 Msp/s >100 Msp/s 40 Msp/s
[13]
10 Msp/s
[20] [12] [13] [20] This work
20 Msp/s 10 Msp/s 50 Msp/s 20 Msp/s
Work
1.6 Gsp/s
TABLE I S UMMARY OF PREVIOUS RFRA ATTACKS AND TARGETS , DETAILING THE TARGETED LINK CHARACTERISTICS AND USED SAMPLE RATE PER ATTACK . F OR VGA, THE PIXEL RATE CAN VARY WIDELY, HENCE , DIFFERENT TARGETED SYMBOL RATE PER ATTACK .
THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
Illumination signal
Recovered Data
Shielding 1
0
0
1
0
G
1
TX
D S
Targeted Link
3
SDR
Backscattered signal
1
0
0
1
0
1
Attacker RX
SDR Backscattered signal
Data
Fig. 1. Schematic of an RFRA in which a transistor-based HT allows monitoring of secret data through a backscattered signal. The implant modulates the backscattering characteristics of a shielding section by switching state according to the logic level applied to the gate by the secret data, switching the impedance between drain and source from low to high. Sending the illumination signal and receiving the echo is done with the help of two separate antennas connected to one or multiple SDRs.
Outline: The remainder of this paper is organized as follows. Section II presents the necessary background, including the operating principles of retroreflector HTs and a detailed overview of the 100BASE-TX encoding and decoding schemes. The subsequent sections describe the main technical contributions of this work: the design of the novel HT architecture (Section III), the high-speed interrogation setup (Section IV), the data recovery methodology (Section V) and the application of the attack on an active link in an office environment (Section VI). Finally, Section VII concludes the paper and discusses potential future directions. II. BACKGROUND A. RF Retroreflector Attack A retroreflector HT functions as a backscattering element, analogous to a UHF RFID tag. It consists of an antenna with impedance Zant loaded by an impedance Zload . The corresponding reflection coefficient Γ is given by Γ=
∗ Zload − Zant . Zload + Zant
(1)
If the antenna and load impedances are matched (Zload = ∗ ), then Γ = 0, indicating that no reflection occurs. Zant Conversely, when Zload → ∞ (open-circuit condition), Γ = 1, and the backscattering element completely reflects the incident signal. Therefore, a retroreflector HT requires a variable load whose impedance changes according to the secret data to be exfiltrated. In the literature, this is typically achieved by employing a transistor (typically a FET transistor) where the drain and source terminals are connected to an improvised antenna (usually made from the host shielding [11], [13]). The transistor’s conduction state is controlled by the compromised signal line connected to its gate terminal, as illustrated in Fig 1. When the data line carries a logical ’0’, the transistor is in the OFF state and presents a drain–source impedance with its corresponding reflection coefficient Γoff . Conversely, when the line carries a logical ’1’, the transistor switches ON, resulting in a different reflection coefficient Γon . The variation between these two impedance states directly mirror the digital information transmitted on the data line. When the circuit is illuminated by an external RF signal to perform an RFRA, as illustrated in Fig 1, this impedance modulation produces a corresponding modulation in the backscattered wave. As a result, the confidential data can be reconstructed by demodulating the backscattered signal.
4B5B Encoding
Scrambling
MLT-3 Encoding
TX
4B5B Decoding
Descrambler
MLT-3 Decoding
RX
Fig. 2. Summary of the 100BASE-TX encoding and decoding steps.
Two practical points must be emphasized. First, although the RFRA mechanism is presented here primarily as an amplitude modulation process, the reflection coefficient is in fact complex, resulting in both amplitude and phase modulation components. In practice, the actual reflection behavior depends on the geometry and material properties of the improvised antenna (such as the cable shielding repurposed as a dipole) which are typically uncontrolled. Consequently, the reflection coefficients never correspond to the idealized cases of Γ = 0 or Γ = 1, leading to non-ideal but information-bearing backscatter modulation. Second, the implant’s complex response is overlapped on the environment’s non-modulating response (direct TX→RX coupling, plus static reflections from surrounding objects). This static background offsets the implant response both in magnitude and phase, the implant’s modulation appears then as a small, time-varying perturbation on top of a generally much larger, static term. This implies that the absolute complex response measured at the receiver is unpredictable a priori even for a carefully designed implant, and that the large unmodulated background can dominate the receiver front end and cause saturation (i.e., “blinding” the receiver). B. 100BASE-TX operation 1) Physical layer encoding: The 100BASE-TX standard uses Category 5 (or higher) Ethernet cables. Although such cables typically contain four twisted pairs, only two are actually used (one for each direction), enabling full-duplex operation. Any data originating from the Data Link layer and transmitted over a Ethernet 100BASE-TX link passes through dedicated hardware that prepares it for physical transmission. This process involves multiple encoding and signal transformation stages, as specified by IEEE Std 802.3 [16] and ANSI INCITS 263-1995 (TP-PMD). The transmission process comprises three main stages: a 4B/5B encoding step based on a predefined symbol dictionary, a scrambling operation implemented using a linear feedback shift register (LFSR), and finally an MLT-3 line encoding for physical signaling. These
THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
5-bit codes 11110 01001 10100 10101 01010 01011 01110 01111 10010 10011 10110 10111 11010 11011 11100 11101 11111 00000
Name 0 1 2 3 4 5 6 7 8 9 A B C D E F I P
DATA 4-bit nibbles 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 Undefined 0001
5bit codes 11000 10001 01101 00111
Name J K T R
CONTROL 4 bit nibbles Interpretation 0101 Start of stream delimiter - 1 0101 Start of stream delimiter - 2 undefined End of stream delimiter - 1 undefined End of stream delimiter - 2
5bit codes 00100 00001 00010 00011 00101 00110 01000 01100 10000 11001
Name H
INVALID 4 bit nibbles Undefined Undefined Undefined Undefined Undefined Undefined Undefined Undefined Undefined Undefined
Interpretation Data 0 Data 1 Data 2 Data 3 Data 4 Data 5 Data 6 Data 7 Data 8 Data 9 Data A Data B Data C Data D Data E Data F IDLE inter-stream fill code SLEEP
Interpretation Force Transmit Error Invalid code Invalid code Invalid code Invalid code Invalid code Invalid code Invalid code Invalid code Invalid code
TABLE II 4B/5B TRANSLATION TABLE . G REYED ROWS ARE CODES CONSIDERED AS ERRORS IN OUR CUSTOM DECODING PIPELINE .
stages are summarized in Fig 2 and detailed in the following subsections. a) 4B/5B encoding: Regardless of the context, all data bytes are divided into 4-bit nibbles and encoded into 5-bit symbols according to Table II. Due to this encoding scheme, each twisted pair transmits symbols at a rate of 125 MBd, resulting in an effective data rate of 100 Mbit/s. In the targeted implementation, when bytes are serialized from the data stream (e.g., MAC layer packets) the resulting 4-bit nibbles are transmitted by sending the low-order nibble first, requiring reordering during reconstruction. When no packets are transmitted and the link remains in the IDLE state, a continuous sequence of ’I’ symbols is sent. When a packet transmission begins, a preamble byte composed of the ’J’ and ’K’ nibbles is transmitted, followed by the payload data. At the end of the packet, a postamble consisting of the ’T’ and ’R’ symbols marks the transition to the IDLE state. The interval between frame delimiters, including the delimiters themselves, spans 96 bits and defines the minimum inter-packet gap (IPG), as specified in IEEE 802.3, Section 4.4.2 [16].
... 1 1 1 1 1
4
1 1 0 2 1 3 1 4 0 5 1 6 0 7 1 8 0 9 010 011 0 1 1 2 1 3 0 4 1 5 0 6 1 7 0 8 0 9 010 111
0 1 0 0 1 ... Fig. 3. An example of the scrambler operation for a single bit. The scrambler output k[0] at time t[0] is computed from the bit 9 and 11 of it’s internal state. The plain text is scrambled resulting in p[0] ⊕ k[0] = c[0]. The scrambler internal state is then updated to time t[1] shifting it’s internal state and inserting k[0].
b) Scrambling: After the 4B/5B translation, the bit stream is scrambled. The purpose of the scrambler is not to provide security; rather, it helps create a pseudo-random distribution of logic levels to improve electromagnetic compatibility (EMC) by minimizing long sequences of identical bits (e.g., when the link is IDLE). The scrambler is implemented using an 11-bit linear feedback shift register (LFSR) defined by the polynomial x11 − x9 − 1. At each clock cycle, the XOR of taps 9 and 11 is used as the scrambling bit and fed back into the LFSR input. This configuration produces a maximallength pseudo-random sequence of 211 − 1 = 2047 bits before repeating. The scrambler input/output can be defined using: • p[n]: the plaintext bit sequence • k[n]: the bit stream at the scrambler output • c[n]: the scrambled bit-stream The scrambling process, illustrated in Fig 3, operates as follows: Each plaintext bit p[n] is XORed with the scrambler output k[n], where k[n] = k[n − 9] ⊕ k[n − 11], resulting in the scrambled bit c[n] = k[n] ⊕ p[n]. Each output bit updates the internal state of the LFSR, advancing the pseudo-random sequence. c) MLT-3: The bit stream at the output of the scrambler is then converted into electrical signaling levels using a MultiLevel Transmit-3 (MLT-3) encoding scheme. In this scheme, data is represented by three discrete voltage levels, denoted as –1 (D+ < D− ), 0 (D+ = D− ), and +1 (D+ > D− ). The differential pair cycles through the following sequence of four states: D+ > D− → D+ = D− → D+ < D− → D+ = D− The progression through this sequence depends on the transmitted data bit: • When transmitting a 0, the output level remains unchanged (the sequence “stalls”). • When transmitting a 1, the output advances to the next state in the sequence. This encoding scheme produces a pseudo-sine wave with a maximum frequency of: fmax =
125 MHz (symbol rate) = 31.25 MHz. 4 (shortest cycle in the sequence)
2) Physical layer decoding: On the receiver side, all operations are applied in the reverse order to recover the original bit sequence.
THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
Original shielding
Original shielding
BAT63-02V * 2
gap
Retroreflector Implant
Dummy shielding
Dummy shielding
= 15 cm
= 15 cm
T568B Connector
T568B Connector
Shielding
Dummy shielding
5
Original shielding
Fig. 4. A retroreflector implant composed of two Schottky diodes (BAT63-02V) and two 620 Ω resistors. The implant is connected to an improvised antenna made from copper tape, which replaces the original cable shielding and is electrically isolated from it. The two antenna segments create a dipole of total length 2l cm.
When decoding the MLT-3 logical levels, each transition within a bit period is interpreted as 1, while a constant logic level is interpreted as 0. Discriminating between –1 (D+ < D− ) and +1 (D+ > D− ) is unnecessary, as the intermediate state 0 (D+ = D− ) always occurs between them, preventing direct transitions from –1 to +1 or vice versa. The scrambler sequence must be recovered to decode each received bit. The internal state of the scrambler can be inferred from known patterns in the transmitted data. In particular, during the mandatory IPG, a repeating IDLE pattern (all bits at one) is transmitted; this known sequence enables synchronization of the scrambler state using k[n] = c[n] ⊕ 1(IDLE). The 96-bit IPG ensures that if scrambler synchronization is lost, it can be recovered after any subsequent packet transmission. Once the scrambler is synchronized, the original plaintext bits can be recovered using the relation p[n] = k[n] ⊕ c[n]. The 4B/5B translation table (Table II) is applied to all 5-bit codes. The alignment of the 5-bit sequences is required and performed each time the unscrambling operation yields a 0 (i.e., when a start of stream delimiter marks the end of the IDLE state). III. I MPLANT ARCHITECTURE TARGETING MLT-3 Because of the three logic levels in the MLT-3 encoding, any implant architecture used for other targets [11]–[14], [20] would fail to accurately translate the logic levels without losing information. To overcome this, we developed the architecture shown in Fig 4. Two Schottky diodes (BAT63-02V) of opposite polarity are connected to both lines of a differential MLT3 pair, in this configuration either diode becomes conducting when D+ ̸= D− , translating the absolute differential voltage, |D+ −D− |, into impedance change for Zload . Directly placing the diodes across the pair would create a short circuit, so a series resistance is required to preserve link operation; experimentally, two 620 Ω resistors (one at each terminal of the variable load) provided sufficient isolation while still biasing the diodes. For very long cables, where signaling amplitude is naturally attenuated, the implant insertion may render the link non-functional; we did not investigate this effect on the maximum usable cable length. The implant is installed by connecting a variable load into the differential pair: two wires connect the load to D+ and D− , while two additional conductors connect it to the
Target
Illumination signal
(5)
Laptop
LNA (1) Attacker RF-SoC (4)
Implant (5)
Filter (3)
Raspberry Pi
LNA (2)
Backscattered signal
Fig. 5. Interrogation setup. (1) OPA WBLNA wide-band LNA, ∼ 17 dB gain on the transmitting path. (2) PE15A63012 Broadband LNA, ∼ 40 dB gain in the receiving path. (3) SHP-300+ Lumped LC High Pass Filter, 290 - 3000 MHz. (4) Illumination signal via a ZCU111 RFSoC evaluation board. (5) LPDAMAX RF Space antennas (4-7 dBi over 300-1000 MHz).
antenna parts. According to the cable construction, two types of improvised dipole antennas can be created. For cables with an overall shield (F/*TP, S/*TP, SF/*TP) the original shielding may be disconnected at the implant location ± l cm or substituted to create an antenna of arbitrary composition. For unshielded cables (U/UTP), conductors from unused twisted pairs may be employed as the antenna; this approach has the side effect of preventing the negotiation of a 1000BASE-T link between the connected terminals. Intentionally preventing 1000BASE-T negotiation by disabling unused pairs help make the implant more context independent (allowing monitoring of original 100BASE-TX links and automatically downgrading 1000BASE-T) but this downgrade could be detected via software at both ends of the link, significantly decreasing covertness of the attack. An example implant is shown in Fig 4. In that implementation, we used an F/UTP cable whose shield was replaced by copper tape over a length l = 15 cm, this implant design is at the basis for all results reported below. The component used in our implant is made from two BAT63-02V in an SC79 package (dimension 2 mm x 0.9 mm x 1.25 mm) and two resistors in a 0603 package (dimension 1.55 mm x 0.85 mm x 0.45 mm). These component sizes permit an implant to be embedded within Cat-5 (or higher) cable with minimal visible alterations. IV. I MPLANT INTERROGATION Although MLT-3 signaling occupies a 31.25 MHz bandwidth, our implant architecture reduces the three-level encoding to a binary form by taking the absolute value |D+ − D− |. This operation yields a waveform with a maximum frequency
20 0 20 40 60 80 100
PSD raw signal fc low pass filter (130 MHz) fc - 125 Mhz fc + 125 Mhz
300 400 500 600 700 800 900 1000 1100 1200 1300 Frequency (MHz) ×106 Fig. 6. Power spectral density (PSD) of the raw and filtered samples. This recording was made at a sample rate of 1.6 Gsp/s, with a center frequency fc of 840 MHz. Significant amplitude is present at fc ± 125 MHz due to the symbol rate of the 100BASE-TX link.
of 125 MHz. Consequently, interrogation of the implant requires a receiver bandwidth of at least 125 MHz, and (to satisfy the Nyquist–Shannon sampling theorem) a sampling rate of at least 2×125 MHz = 250 Msp/s. In practice, higher sampling rates simplify signal processing and help yield better results. These interrogation requirements exceed the capabilities of most SDRs, necessitating the use of high-performance hardware. In our implementation, we employed an RFSoC evaluation board (ZCU111), which supports sampling rates in the gigasample-per-second range. To interface with this platform, the Xilinx ’RF Data Converter Evaluation Tool’ was controlled via a custom Python API. This API enables bidirectional data exchange between the instrumenting computer and two synchronized ADC/DAC channels, allowing phase coherent interrogation. Furthermore, because the transmitted waveform samples used for illumination are directly controlled, the illumination power can be dynamically adjusted by modifying the output waveform amplitude. This setup is complemented by two low-noise amplifiers (LNAs), one on the transmit path (∼ 17 dB gain) and one on the receive path (∼ 40 dB gain). This configuration enables transmission at a carrier power of approximately 17 dBm over frequencies ranging from 300 MHz to 1 GHz. On the reception side, the signal is filtered using an SHP-300+ highpass filter, which attenuates frequencies below 300 MHz to suppress parasitic components that could otherwise saturate the receiving LNA. Both illumination and reception rely on wideband PCB log-periodic antennas. The complete interrogation setup is illustrated in Fig 5. Using this setup, illumination and data acquisition were performed at a sampling rate of 1.6 Gsp/s. This rate, although higher than strictly necessary, was selected to maximize the quality of the received data. However, streaming and storing I/Q samples at this rate is technically demanding, we therefore rely solely on the limited DDR memory assigned to this ADC (128 MB in the default RF Data Converter Evaluation Tool FPGA image, which fills in approximately 2 ms at 1.6 Gsp/s). A more practical attack setup would incorporate real-time streaming to external storage and offload a portion of the demodulation pipeline to the FPGA, reducing the effective data rate and overall storage requirements. After samples are received, a band-pass filter is centered around the interrogation frequency with a 125 MHz bandwidth to attenuate ambient noise. Figure 6 shows the measured
6
spectrum, before and after filtering at an interrogation frequency of 840 MHz. The target of our measurements is an Ethernet link embedding an HT as described in Section III connecting a laptop and a Raspberry Pi 3. Samples were collected across multiple carrier frequencies, at output power levels ranging from 0 dBm to 17 dBm, for an IDLE and active Ethernet link. To evaluate raw attack performance in a controlled environment, all measurements reported here were conducted at a range of 4 m inside an anechoic chamber. V. DATA RECOVERY In a conventional Ethernet interface, decoding is straightforward and follows the procedure described in Section II-B. However, due to the errors inherent to the radio interrogation link, directly applying the standard decoding steps would result in excessive bit errors, preventing reliable data recovery. The decoding algorithms presented below were developed to evaluate the feasibility and effectiveness of information extraction from recorded samples in a realistic interrogation scenario. Whereas a standard Ethernet controller prioritizes error detection and throughput to maintain a stable communication link, our method focuses on maximizing information retrieval under degraded signal conditions. To correct errors, we rely heavily on context-dependent decoding, where both past and future data are analyzed to select the most plausible outcome when impossible sequences are detected. A. Demodulation (a) Constellation Kernel density 1
Quadrature
Magnitude
THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
0 0
In phase Detected Hotspot
1
1.0 0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0.0
'0' label
(b)
Hotspot based labeling
1
0 0
In phase
1
'1' label
Fig. 7. (a) Gaussian KDE shown as hue, with highlighted “hotspots” in highdensity regions. (b) Sample-to-bit attribution using the median of the samples distance to the hotspots as the decision criterion. Axes are normalized using hotspots positions.
After filtering, the recorded samples will comprise the implant response intertwined with the illumination signal. The interaction between the illumination signal and the retroreflected states is unpredictable and leads to the data being encoded through both phase and amplitude modulation. Because extreme states Γon and Γoff will create sample clusters in the complex plane, we can use the distance between each sample to the densest sample hotspot (i.e., the brightest region in Fig 7(a)) to recover |D+ − D− |. Before proceeding with the different decoding steps, we can verify that this signal is correlated to the original on-wire data.
Power (dBm)
Power (dBm)
Correlation and BER for measurement of an IDLE link Correlation with LFSR sequence Bit Error Rate 0.0 0.2 0.4 0.6 0.8 1.0 0.5 0.4 0.3 0.2 0.1 0.0 (a) (b) 17 17 14 14 11 11 8 8 5 5 2 2 1 1 4 4 7 7 10 10 550 650 750 850 950 550 650 750 850 950 Frequency (MHz) Frequency (MHz) ×106 ×106
Fig. 8. (a) Correlation of received backscattered data (IDLE link) with a known 2048-bit scrambler sequence. Displayed values correspond to Pearson product–moment correlation coefficients. Samples and the scrambler sequence are aligned by maximizing their cross-correlation. The scrambler sequence, which is known a priori, is resampled and low-pass filtered to match the spectral characteristics of the backscattered signal. (b) Bit error rate after LFSR synchronization averaged over n = 11 recovered LFSR sequences.
B. Symbol Attribution Now that we have confirmed the presence of data correlated with the link activity in the backscattered signal samples, the next step toward data recovery is to extract individual symbols. a) Sample Attribution (hotspot distance): Since the implant switches based on |D+ − D− |, and due to the MLT-3 signaling scheme, symbols associated with D+ ̸= D− occur twice as often as D+ = D− . These two states produce a biased distribution of samples in the complex plane, as shown in Fig 7(a), where one hotspot appears approximately twice as dense as the other. Constellation hotspots are identified using Gaussian kernel density estimation (KDE), from which the centers of the two highest-density clusters are extracted. Next, the distance from each sample to both hotspots is computed, where a value of 0
Hotspot Distance
To this end, a simulated scrambler sequence is generated by initializing the LFSR to a random state, and its output is lowpass filtered at 125 MHz to emulate the spectral characteristics of the recovered signal. Time synchronization between the simulated waveform and the recorded backscattered signal (here known to correspond to an IDLE link) is achieved by maximizing their cross-correlation over one scrambler output sequence period (2047 bits). This ensures the recovery of the correct alignment even in the presence of a weak correlation. The Pearson product–moment correlation coefficient is then computed for all subsequent samples, as shown in Fig 8(a). Correlation values close to zero indicate noise-dominated regions without usable backscattered data, whereas values approaching one denote a strong correspondence between the on-wire data and the recovered backscattered states. Fig 8(a) show a strong correlation for a wide range of frequencies and directly dependent on the power used for illumination, indicating that data recovery with a low error would be achievable.
Voltage (V)
THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
7
Original signal logics levels and associated backscattered signal 1 0 1
D
D+
1.0 0.5 0.0 0
5
10
15
20 25 30 Time (symbol)
35
(a)
(b)
40 45 50 Recovered signal
Fig. 9. (a) MLT-3 logic levels obtained from on-wire captures using an oscilloscope. The corresponding backscattered signal recovered by illuminating an implant is presented in (b) (logic levels extracted from sample distances to hotspots). Despite the degraded waveform, it remains possible to distinguish between D+ = D− and D+ ̸= D− . All samples are normalized within [-1,1] for oscilloscope measurements and [1,0] for retroreflected samples. The measurements correspond to the same data sequence, matched in postprocessing but not acquired simultaneously.
indicates perfect alignment with the first hotspot, and 1 with the second (see Fig 7(b)). To accurately assign each sample to a logical 0 or 1, the signal is first resampled so that the symbol duration corresponds to an integer number of samples. This yields a metric based on |D+ − D− |, as illustrated in Fig 9. This metric is also used as a confidence indicator for each sample’s labeling. Finally, the median of all computed distances is used as a threshold to assign each sample a binary label. The median is preferred over the mean due to the biased distribution introduced by the implant. b) Sample alignment and symbol extraction: To assign a symbol value to a window of n samples, the samples must be properly aligned. Otherwise, a window may span the boundary between two symbols, leading to incorrect assignments. To find the correct alignment, we test all possible window offsets within one symbol period (i.e., the number of samples per symbol at 125 MBd). For each offset, we compute a coherence metric: within each window, samples labeled ’1’ and ’0’ are mapped to +1 and −1, respectively, and their sum taken in absolute value. This value is then averaged over many windows. The offset that maximizes this average is selected, as it corresponds to the most consistent labeling within windows. Once the optimal offset is found, each window is assigned a final symbol and confidence level based on the distribution of its samples. c) Symbol Attribution (SVC): To obtain an alternative and more tailored symbol attribution we can train a linear classifier based on a C-Support Vector Classification (SVC) model. The classifier was made using scikit-learn [21], which relies on libsvm [22] for its SVM implementations. This approach requires a dataset of sample windows and their associated symbol labels. To obtain such a dataset, we first perform symbol attribution and alignment using the hotspot-distance-based method on a known IDLE link. During this training phase, the link is assumed to be in the IDLE state, and the scrambler sequence must be successfully recovered (see Section V-C). Under these conditions, symbol attribution errors can be easily corrected, as all transmitted unscrambled
THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
bits are equal to 1, thereby enabling the establishment of a ground truth for training the SVC classifier. Each sample within a symbol period is then used as an input feature. The trained classifier outputs both the predicted symbol value and an associated confidence metric. Because the model parameters depend on the interrogation conditions (e.g., illumination settings, hardware configuration, and surrounding environment), retraining is required whenever these conditions change significantly. The benefits of this method, including its improved robustness against decoding error, are discussed in Section V-E. C. Bit recovery and unscrambling a) MLT-3 decoding: Once the symbols S are recovered, the scrambled bit cn are decoded according to the following rule: ( 0, if Sn = Sn−1 cn = 1, if Sn ̸= Sn−1 The confidence metric associated with the symbols is not preserved during this conversion but is later exploited in the implementation of error detection and correction (see Section V-E). b) LFSR state recovery: To descramble each bit of the MLT-3 decoded bitstream, we must first determine the associated scrambler output. When the link is in the IDLE state, the scrambler state K can be reconstructed by taking the bitwise complement of 11 consecutive bits (as described in Section II-B2). To enhance the robustness of scrambler state recovery against bit misattribution, we extend the standard recovery procedure by using multiple (N ) 11-bit sequences indexed by j. For each 11-bit sequence, the associated LFSR state K j is recovered as: K j = ¬c[11j : 11(j + 1)[ To synchronize all K j sequences, each recovered scrambler state is advanced by a number of iterations equal to the full sequence period minus its positional offset, i.e., 2047 − 11j. This process realigns all states with the first recovered sequence and, in the absence of errors, should yield identical bit sequences. The set of possible LFSR states K j is then averaged and rounded to the nearest integer, yielding the most probable current scrambler state. In our case, the number of sequences chosen was 11 as no significant improvement in BER was observed for higher values of N . The choice of N is dependent on the link activity as a heavily used link may not provide sufficient IDLE time to accommodate higher N . It should also be noted that using N = 2 can increase the error rate, as this accumulates potential errors over 22 bits without benefiting from averaging. To assess the performance of the proposed scrambler recovery method, we compare it to the correlation baseline shown in Fig 8(a). Using the same measurement associated to the IDLE link and applying the Bit Recovery and LFSR State Recovery procedures, we should obtain a sequence comprised
8
only of ’1’. Hence, we can compute the BER as the ratio of decoded ’1’ to the total number of recovered bits. The resulting BER is shown in Fig 8(b) and closely follows the trend of the correlation plot in Fig 8(a). Since successful LFSR state recovery is essential for subsequent bit decoding, the BER sharply increases in regions where the scrambler synchronization fails. D. Bit alignment recovery Once the bitstream has been fully decoded, the next step is to reconstruct data bytes using 4B/5B translation. Prior to this step, the correct alignment of the 5-bit codes must be determined. In a conventional 100BASE-TX link, where decoding errors are infrequent, alignment can be identified by detecting any ’0’ within an otherwise IDLE bitstream, which indicates the start of a packet (i.e., the J and K symbols in Table II). In this case, however, the presence of decoding errors prevents the use of this method. Instead, we perform the 4B/5B translation for all five possible bit alignments on a set of non-IDLE bit sequences. For each alignment, the number of invalid 5-bit codes obtained is counted, and the alignment yielding the fewest invalid codes is selected as the most probable alignment. E. 4B/5B code translation and error correction Once the correct alignment has been established, each 5-bit code must be translated into a 4-bit nibble using the mapping in Table II. Pairs of nibbles are then grouped into bytes. Although this decoding process is straightforward, it propagates errors: a single decoding error within a 6-symbol sequence corrupts the corresponding 5-bit code and its associated 4-bit nibble, thereby altering an entire byte. Because of how a single error propagates, we now aim to correct as many errors as possible. To devise an error detection and correction mechanism and evaluate its benefit, we will use the following terminology: Any 6-symbol sequence results in a decoded code that is either: • Uncorrupted: no symbol is in error. • Corrupted: at least one symbol is erroneous. When translating a 5-bit sequence into a 4-bit nibble using the lookup table, each decoded code can be classified as: • Valid: corresponds to an entry in the translation table. • Invalid: does not correspond to any entry in the table. An invalid code necessarily originates from a corrupted sequence; however, a valid code may still result from a corrupted sequence (i.e., it may map to an incorrect table entry). Valid codes are further classified as: • Correct: matches the originally transmitted data. • Incorrect: differs from the original data. Although the 100BASE-TX standard does not include an error detection or correction mechanism, we can exploit the properties of the 4B/5B translation. Excluding control and reserved symbols, only 20 out of the 32 possible 5-bit combinations are valid (Table II). When packet boundaries are known (which is assumed here), this set is further reduced
THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
Confidence score 0.93 0.21 0.46 0.80 0.17 0.03 ... 1 0 0 1 0 0
MLT-3 decoding
4B5B table
LFSR decode state = x
00000 (invalid) 00100 (invalid)
0.93 0.21 0.46 0.80 0.17 0.03
... 1
0 1 1 0 0
Compute all bit sequence resulting in a valid 5b code MLT-3 encoding
Patch to the closest valid neighbour
LFSR encode state = x - 5
9
... (invalid) 11110 (valid) 01001 (valid) ... (valid)
table entry ?
Yes
Valid codes correct or incorrect
No (invalid codes)
Code rate
Fig. 10. Schematic of the error-correction process, in which codes are mapped to their nearest most probable neighbor. Green arrows denote the additional steps compared to conventional decoding.
Incorrect codes types
(a) 1.0 0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0.0
(b)
Correct codes types
(c)
SVC - Incorrect codes types (d)
SVC - Correct codes types Corrected mean= 0.76
Corrected mean = 0.67
SER mean = 0.10
SER mean = 0.08
0.00
0.05 0.10 0.15 0.20 0.00 0.05 0.10 0.15 0.20 0.00 0.05 0.10 0.15 0.20 0.00 0.05 0.10 0.15 0.20 Symbol error rate (SER) Symbol error rate (SER) Symbol error rate (SER) Symbol error rate (SER) Invalid codes Incorrect codes Correct codes (after correction) Correct codes (before correction)
Fig. 11. (a,c) Proportion of incorrect codes (red), including a subset of invalid codes (blue), as a function of the symbol error rate (SER) of the analyzed data. (b,d) Proportion of correct codes, either originally uncorrupted (purple) or obtained after correction (orange). (a,b) SER and correction made from median based discrimination see Sec V-B(a). (c,d) SER and correction made from SVC based discrimination see Sec V-B(b) each point represents the performance of a custom SVC model. The identification of invalid codes is based solely on the data-byte code table; special codes are excluded.
to 16 valid codes. Any decoded code outside this subset can therefore be classified as invalid, allowing the detection of errors and an attempt at their correction. Once errors are detected, we can use the following correction procedure (illustrated in Fig. 10). For each invalid code, all candidate 6-symbol sequences producing valid 5-bit codes are enumerated. The most likely sequence is selected based on similarity between hypothesized 6-symbol sequences and the associated confidence metrics described in Section V-B. If successful, this procedure yields either a valid and correct code or a valid but incorrect code if the correction was unsuccessful. F. Error correction performance To estimate the performance of this algorithm, a subset of the same dataset associated to an IDLE link used in Section V-B is used. In this case, all 5-bit codes should be 11111, which is not a valid entry in the table used for error detection. Because of this, and solely for the purpose of evaluating the benefits of this method, a custom 4B/5B table was derived by XORing all 5-bit code entries with 00001. This transformation inserts 11111 into the valid set while preserving the relative Hamming distances between entries, thus preserving the validity of the evaluation. When decoding data on an active link the original 16 entries of DATA codes should be used. To quantify the error rate in the decoded data, we use the code error rate (CER), denoted by pc . Since each code depends on a MLT-3 encoded 6-symbol sequence, the expected CER is defined as the probability that at least one error occurs
within this window (excluding the case where all symbols are inverted): pc = 1 − (1 − pe )6 + p6e where pe denotes the symbol error rate (SER). A value of pe = 0 corresponds to an error-free sequence, while pe = 0.5 yields a fully randomized sequence. In Fig. 11(a), a subset of incorrect codes (red) are invalid (blue) and thus do not match any entry in the 4B/5B table; these codes can be targeted for correction. Prior to correction, only uncorrupted codes (purple) are correctly decoded, as shown in Fig. 11(b). Applying the proposed correction to invalid codes increases the proportion of correctly decoded codes by approximately 10 % (orange). A similar evaluation was conducted for the SVC-based bit attribution and confidence estimation approach (see Figure 11(c)). In this case, we observed both a reduction in the average symbol error probability (pe ≃ 0.08 compared to 0.1) and an improvement in the code error rate (CER) (pc ≃ 0.24 compared to 0.33) see Figure 11(d). These results indicate both improved initial symbol classification and a more reliable confidence metric, enabling more effective error correction. G. Packets extraction After applying the previously described error-correcting steps to recordings of an active Ethernet link, we are able to reconstruct packets that are either error-free or exhibit only rare, isolated errors. To simplify the analysis and ensure a high frequency of short, well-defined frames, the link was flooded with ICMP echo (ping) requests whose payloads were
THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
Packet Start / Stop / IPG / IDLE 802.3 Ethernet Frame IPV4 Datagram ICMP Echo IPG + Start of Stream .IIJK555555555555D5
10
DEADCODEDE1DCODE Error
Mac Addresses
IPV4 Addresses
B827EBBDF2EE C025A573D5CB 0800
45000054AF3940004001081A C0A80103 C0A80102
D6D7070000000000DEADBEE0DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF
0800F409DA678160C6C4DB6800000000 C99071BD
ICMP Echo padding bytes "0xDEADBEEF"
TRIIIIRIIIIIIIIII.. End of Stream + IPG
Fig. 12. Examples of a recovered Ethernet packet obtained from backscattered data after decoding and error correction. Layer structure and remaining byte-level errors are highlighted.
padded with the sequence 0xDEADBEEF, enabling easy identification of transmission errors. Figure 12 shows an example of a successfully recovered packet (BER around 0.01); the main protocol fields remain intact and only a few isolated byte-level errors are present. All essential information within the frame (MACs / IPs addresses, payload) remains readable, and the payload pattern is clearly identifiable. The same decoding and interpretation procedure generalizes to longer frames and other traffic patterns that contain known structure. VI. R EPLICATION IN AN OFFICE SETTING AND THEORETICAL INTERROGATION RANGE
3m
3m Amplification and filtering
TX-Antenna
RX-Antenna RF-SoC
Fig. 13. Reflecthernet attack setup. (Top) The target, consisting of a laptop connected to a Raspberry Pi through an Ethernet cable embedding the HT (inset). (Bottom) The attack setup, consisting of an RF SoC and two logperiodic antennas.
The attack was reproduced outside an anechoic chamber in a standard office environment. The experimental setup is shown in Fig. 13, where both the attacker hardware and the target are placed on standard office tables. The attack is performed under line-of-sight (LOS) conditions at a distance of 3 m, with an illumination power of 13 dBm. Under these conditions, a BER below 0.1 was achieved, indicating that the technique remains viable under realistic indoor propagation conditions. While achieving long interrogation ranges would require a setup with higher amplification, we can estimate the required power as a function of distance. In free space, and neglecting
platform-dependent propagation factors, the received power from a retroreflector implant can be approximated by the radar equation for a backscattering target using the same antenna for transmission and reception: Pr (Γon , Γoff ) =
Pt G2 λ2 σ(Γon , Γoff ) (4π)3 R4
where Pr and Pt are the received and transmitted powers, respectively, G is the gain of the transmitting and receiving antennas (assumed to be identical), λ is the carrier wavelength, σ(Γon , Γoff ) is the implant’s radar cross-section which depends on the implant reflection state (here parameterized by the load states Γon and Γoff ), and R is the range between the antenna system and the implant. The primary factor governing the achievable interrogation distance in RFRA systems is the transmitted (illumination) power. Because the incident wave must propagate to the implant and the backscattered signal must then return to the receiving antenna, the received power decreases proportionally to R4 . Consequently, doubling the interrogation range from 3 m to 6 m requires an increase in the transmitted power by a factor of 16 (an increase of approximately 12 dB), corresponding to about 25 dBm for the setup used in this study. Along with illumination power, the antenna gain and the implant’s design (both its variable load characteristics and its antenna structure) are critical parameters for successful interrogation and data recovery. Although the transmitted power could, in principle, be further increased to extend the range, practical limitations arise from the receiver’s dynamic range. Without appropriate isolation or cancellation mechanisms, the strong illumination signal can saturate the receiver front end, effectively blinding it and preventing demodulation of the much weaker backscattered signal. VII. C ONCLUSION We demonstrated the practicality of an RFRA on a 100BASE-TX Ethernet link by recovering complete MAClayer frames from one traffic direction. Our results extend the effective data rate of RFRA attacks to 125 MBd, demonstrating that retroreflection-based attacks remain feasible even against significantly higher-speed links than those examined in prior works. The attack was successfully demonstrated at a distance of 3 meters in an office environment. An analysis of the BER as a function of the transmitted power in an anechoic
THIS WORK HAS BEEN SUBMITTED TO THE IEEE FOR POSSIBLE PUBLICATION. COPYRIGHT MAY BE TRANSFERRED WITHOUT NOTICE.
chamber suggests that substantially longer interrogation ranges are achievable for an attacker. A custom demodulation and interpretation pipeline was created, enabling mitigation of errors introduced by the radio channel and the interrogation process. The pipeline exploits the 4B/5B code used in the link to detect and correct a subset of errors; the same methodology could be adapted to other line codes and link technologies targeted by RFRA. The experiments presented here target a single direction of the full-duplex Ethernet link. Extending the attack to both directions would be possible by implanting a second retroreflector HT on the other differential pair and performing a multi-Trojan interception by leveraging frequency diversity, as demonstrated in [14]. ACKNOWLEDGMENTS This publication is supported by the European Union through European Regional Development Fund (ERDF), Ministry of Higher Education and Research, CNRS, Brittany region, Conseils Départementaux d’Ille-et-Vilaine and Côtes d’Armor, Rennes Métropole, and Lannion Trégor Communauté, through the CPER Project CyMoCod, by the French government through the “Agence Nationale de la Recherche” (ANR) both under Grant ANR-22-CPJ1-0070-01 and as part of the “programme d’Investissements d’Avenir” (PIA) under Grant ANR-18-EURE-0004. R EFERENCES [1] W. van Eck, “Electromagnetic radiation from video display units: An eavesdropping risk?” Computers & Security, vol. 4, no. 4, pp. 269–286, 1985. [Online]. Available: https://www.sciencedirect.com/ science/article/pii/016740488590046X [2] M. G. Kuhn, “Electromagnetic eavesdropping risks of flat-panel displays,” in International Symposium on Privacy Enhancing Technologies, 2004. [Online]. Available: https://api.semanticscholar. org/CorpusID:16596308 [3] ——, “Compromising emanations of lcd tv sets,” in 2011 IEEE International Symposium on Electromagnetic Compatibility. Long Beach, CA, USA: IEEE, Aug. 2011, pp. 931–936. [Online]. Available: http://ieeexplore.ieee.org/document/6038442/ [4] H. S. Lee, D. H. Choi, K. Sim, and J.-G. Yook, “Information recovery using electromagnetic emanations from display devices under realistic environment,” IEEE Transactions on Electromagnetic Compatibility, vol. 61, no. 4, pp. 1098–1106, 2019. [5] D. Erdeljan, “Eavesdropping risks of the displayport video interface,” Ph.D. dissertation, Apollo - University of Cambridge Repository, 2023. [Online]. Available: https://doi.org/10.17863/CAM.106182 [6] D. Erdeljan and M. G. Kuhn, “Electromagnetic Eavesdropping on DisplayPort,” IEEE Transactions on Dependable and Secure Computing, pp. 1–18, 2026. [Online]. Available: https://ieeexplore.ieee. org/document/11352973/ [7] P. Smulders, “The threat of information theft by reception of electromagnetic radiation from RS-232 cables,” Computers & Security, vol. 9, no. 1, pp. 53–58, Feb. 1990. [Online]. Available: https: //linkinghub.elsevier.com/retrieve/pii/016740489090157O [8] M. Vuagnoux and S. Pasini, “Compromising electromagnetic emanations of wired and wireless keyboards,” in Proceedings of the 18th Conference on USENIX Security Symposium, ser. SSYM’09. USA: USENIX Association, 2009, p. 1–16. [9] M. Schulz, P. Klapper, M. Hollick, E. Tews, and S. Katzenbeisser, “Trust the wire, they always told me! on practical non-destructive wire-tap attacks against ethernet,” in Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks, ser. WiSec ’16. New York, NY, USA: Association for Computing Machinery, 2016, p. 43–48. [Online]. Available: https://doi.org/10.1145/2939918.2940650
11
[10] P. Nikitin, “Leon Theremin (Lev Termen),” IEEE Antennas and Propagation Magazine, vol. 54, no. 5, pp. 252–257, Oct. 2012. [Online]. Available: http://ieeexplore.ieee.org/document/6348173/ [11] NSA. (2008 (redaction)) NSA ANT catalog. [12] S. Wakabayashi, S. Maruyama, T. Mori, S. Goto, M. Kinugawa, Y. Hayashi, and M. Smith, “A feasibility study of radio-frequency retroreflector attack,” in 12th USENIX Workshop on Offensive Technologies (WOOT 18). Baltimore, MD: USENIX Association, Aug. 2018. [Online]. Available: https://www.usenix.org/conference/woot18/ presentation/wakabayashi [13] M. Kinugawa, D. Fujimoto, and Y. Hayashi, “Electromagnetic information extortion from electronic devices using interceptor and its countermeasure,” IACR Transactions on Cryptographic Hardware and Embedded Systems, vol. 2019, no. 4, p. 62–90, Aug. 2019. [Online]. Available: https://tches.iacr.org/index.php/TCHES/article/view/8345 [14] P. Granier, M.-A. Nicolas, J. Lorandel, C. Moy, P. Besnier, M. Davy, and F. Sarrazin, “Diode-based multi-trojan rf retroreflector attack,” in 2025 International Symposium on Electromagnetic Compatibility – EMC Europe, 2025, pp. 784–789. [15] G. Wang, Z. Shi, Y. Yang, Z. An, G. Zhang, P. Hu, X. Cheng, and J. Cao, “Wireless Eavesdropping on Wired Audio With RadioFrequency Retroreflector Attack,” IEEE Transactions on Mobile Computing, vol. 24, no. 4, pp. 3178–3195, Apr. 2025. [Online]. Available: https://ieeexplore.ieee.org/document/10766401/ [16] “Ieee standard for ethernet,” IEEE Std 802.3-2022 (Revision of IEEE Std 802.3-2018), pp. 1–7025, 2022. [17] C. Zunino, A. Valenzano, R. Obermaisser, and S. Petersen, “Factory communications at the dawn of the fourth industrial revolution,” Computer Standards & Interfaces, vol. 71, p. 103433, 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S0920548919300868 [18] M. Lyu, H. H. Gharakheili, and V. Sivaraman, “A survey on dns encryption: Current development, malware misuse, and inference techniques,” ACM Computing Surveys, vol. 55, no. 8, p. 1–28, Dec. 2022. [Online]. Available: http://dx.doi.org/10.1145/3547331 [19] B. Anderson and D. McGrew, “Os fingerprinting: New techniques and a study of information gain and obfuscation,” 2017. [Online]. Available: https://arxiv.org/abs/1706.08003 [20] M. Ossmann. (2014) The NSA playset: RF retroreflectors. [Online]. Available: https://archive.org/details/nsaplayset-toorcamp2014 [21] F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and Édouard Duchesnay, “Scikit-learn: Machine learning in python,” Journal of Machine Learning Research, vol. 12, no. 85, pp. 2825–2830, 2011. [Online]. Available: http://jmlr.org/papers/v12/pedregosa11a.html [22] C.-C. Chang and C.-J. Lin, “LIBSVM: A library for support vector machines,” ACM Transactions on Intelligent Systems and Technology, vol. 2, pp. 27:1–27:27, 2011, software available at http://www.csie.ntu. edu.tw/∼cjlin/libsvm.