ttp://Irongeek.com EMP, YEAH YOU KNOW ME! Adrian Crenshaw Naughty by Nuke! (With apologies to Naughty by Nature)
Dec 14, 2015
http://Irongeek.com
EMP, YEAH YOU KNOW ME!Adrian CrenshawNaughty by Nuke!
(With apologies to Naughty by Nature)
http://Irongeek.com
About Adrian I run Irongeek.com I have an interest in InfoSec
education I don’t know everything - I’m just a
geek with time on my hands I’m an (Ir)regular on the InfoSec
Daily Podcast: http://isdpodcast.com
Sr. Information Security Engineer at a Fortune 1000
Co-Founder of Derbyconhttp://www.derbycon.com/
Twitter: @Irongeek_ADC
http://Irongeek.com
What is EMP?
EMP = Electromagnetic Pulse A powerful burst of radio waves cause by quickly
changing electromagnetic fields Has the effect of inducing currents into conductors
and can “burn” them up or cause interference Early British term was “Radioflash”
http://Irongeek.com
Why this subject?
I don’t consider myself a prepper or survivalist (but I did collect a lot of Paladin Press books as a kid)
I like the smell of fried electronics (as long as they ain’t mine)
Lots of scare monger videos, justified or not, but little with the science behind EMP
It fit the theme!
http://Irongeek.com
EMP: Entertaining Misinformed People
Signal to Noise is high on this subject Many people will speak authoritatively, but not know the actual fact Tried searching for site:mil and site:gov
Limited practical testing seems to have been done Radio Waves do weird things… When/where was the testing done?
Audience Some stuff is classified Some stuff aims toward the non technical
I’m not an expert either, so take all this with a huge grain of salt
http://Irongeek.com
Examples
???
http://Irongeek.com
Spark Gap?
Ever run a vacuum/electric motor while watching an analog TV?
Sparks cause a broad band of radio waves to propagate, which can cause interference.
http://Irongeek.com
Inducing current
Changing magnetic fields cause current in a conductor
Current in a conductor cause a magnetic field
+
-
http://Irongeek.com
Near-Field and Far-Fields
Distance? 1/(d^3) vs. 1/(d^2)
Image from http://en.wikipedia.org/wiki/Near_and_far_field
http://Irongeek.com
Self Propagating EM Wave
Image from http://en.wikipedia.org/wiki/Electromagnetic_radiation
http://Irongeek.com
Bit Of History
Apparently EMP was expected by Enrico Fermi, and equipment during the Trinity test (July 16, 1945) was shielded in anticipation of it
Apparently some recording were lost due to “spurious pickup”
Greater interest came about afterStarfish Prime
Hi Guys!!!
http://Irongeek.com
Starfish Prime
High altitude test of a nuclear weapon on July 9, 1962
1.4 megaton W49 thermonuclear warhead detonated 250mi (400km)above a point about 19 miles southwest of Johnston Island in thePacific Ocean
EMP effect was greater than anticipated
http://Irongeek.com
Starfish Prime EMP Effects
Drove instruments off the scale, presumably as expectations of the effect was lower
Damaged electrical systems 898 miles away in Hawaii 300 street lights blown Telephone microwave link damaged Set off burglar alarms
Further tests in the “Operation Fishbowl” series gave more data on EMP’s effects
http://Irongeek.com
EMP: Multiple Pulse in Three Parts
E1 – Very short, powerful burst that induce high currents in conductors.
E2 – Comes shortly after E1. Somewhat akin to the EM effects of a lightning strike. Many systems may already be prepared, but precursor damage from E1 may soften them up.
E3 – Longer, slower pulse that can last many seconds caused by the Earth’s magnetic field being pushed out of the way. Can induce current in long conductors and cause damage to power systems.
http://Irongeek.com
Volts per Meter
Volts per Meter – V/m – Voltage across a one Meter conductor as the magnetic field sweeps across it. EMP: 100,000 V/m Ground Burst Radar: 200 V/m Radio Communications: 10 V/m Metropolitan Noise: 0.1 V/m
Ball park figures from http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com
Range from Ground Zero for Surface Burst
If you are too close, you are already having a bad day!
Image source http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com
Burst location
Surface/Near Surface Burst – Ground level EMP is an issue, but other effects may take precedence Geography limits area Air density limit range
High Altitude – above 30km 20km to 40km is where we get the Compton effect Can hit a larger area Saturation at about 50,000V/m 500km burst could cover continental United State
Air Burst - 100-1000m, maybe below 30km? Not as interesting for EMP*
* http://www.fas.org/nuke/intro/nuke/emp/c-2fig.pdfhttp://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com
More Acronym (and Electron) Soup
SREMP = Source Region EMP (low/surface burst) HEMP = High-altitude EMP MHD-EMP = Magnetohydrodynamic EMP
Caused by shifting of Earth’s magnetic field SGEMP = System Generated EMP
Caused by Gamma/X-Rays hitting the outside of a satellite/space craft
NNEP = Non-Nuclear EMP
http://Irongeek.com
+Ground Burst
Net Electron Current
Ground absorbs some Gamma
.+
Current Return Path Through Ground
Outward Radiating EMP
.+
http://Irongeek.com
AirburstNet Electron Current
Caused ByAtmospheric Density Gradient Leading To Weak Vertical Dipole
Gamma Rays Cause “Compton Scattering”,
Knocking Electrons Out Of Molecules In The Air,
Causing A Charge Seperation
http://Irongeek.com
Chain of events E1/E2: HEMP
EM
P
EMP
EM
P
Gamma Rays knock Electrons out of air molecules (Compton Effect) at about 20 to 40km altitudein a mostly down direction
Gamma Rays caused by detonation
Electrons direction effect by Earth’s magnetic field, now we have EMP
Gamma ray diffusion and other effects cause delayed E2
http://Irongeek.com
Chain of Events E3Earth’s magnetic field just sitting there, minding it’s own business
Detonation happens
“Fireball” affects magnetic permeability,causing changes in Earth’s magnetic field
http://Irongeek.com
Spectrum
Lots of interference
Image source http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com
Earth’s Magnetic Lines
Latitude and Altitude make a big difference
Image from Wikipedia/Figure 2.143 from page 76 of the book, "The Effects of Nuclear Weapons" by Samuel Glasstone and Phillip J. Dolan. 1977 edition published by the United States Department of Defense. {{PD-USGov}} Used to illustrate the concept of magnetic conjugate regions
http://Irongeek.com
EMP Production Factors
Altitude Yield and Construction Distance from detonation Geography Magnetic Field Strength
http://Irongeek.com
Prompt Gamma Yield More Important Than Total Yield
0.115–0.5% of nuke’s energy is Prompt Gamma Yield
Starfish Prime was 1.4MT, but 0.1% PGY, so 1.4Kt for EMP effect
500Kt Nuke optimized for 0.5% PGY would give 2.5Kt for EMP effect
Pre-ionization in thermonuclear bombs may cause less EMP effects to take place than more primitive fission weapons
Image from http://en.wikipedia.org/wiki/Electromagnetic_pulse
http://Irongeek.com
EMP Horseshoe Effect
Image from http://en.wikipedia.org/wiki/Electromagnetic_pulse
http://Irongeek.com
Entry Points
Direct – in through the holes Induced
Antennas Satellite Dishes Power Lines Network Cables Telephone Wire Other Cables Plumbing
http://Irongeek.com
Damage Types
Functional Damage – Over load, hit break down voltage, heat up and fry! Blue smoke is gone, it’s dead Jim!
Operational Damage – Circuit upset for transient current. Circuit breaker blown, or circuit logic disturbed.
Pulled from http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com
Super EMP Nuke
Can you optimize a nuclear bomb to have more of an EMP effect? Reduce ionization from heat Make case and explosive gamma transparent Produce as much gamma as quick as possible
http://Irongeek.com
Non Nuclear EMP (NNEMP)
What about just the EMP, without the other nasty nuke effects?
Effect electrical systems, but not buildings/roads “Force Multiplier” from loss of enemy
communications Less (immediate) deaths = less political
ramifications?
http://Irongeek.com
Marx Generator Charge capacitors in parallel, discharge in series
Images from http://en.wikipedia.org/
ATLAS-I/ The Sandia TrestleMarx Generator
http://Irongeek.com
Explosively Pumped Flux Compression Generator
EPFCG uses a magnetic field with conventional explosives (many configurations)
Below is a “Helical generator”
+-
Coil
Armature
Capacitor
High Explosive
http://Irongeek.com
High-Energy Radio Frequency weapons (HERF)
Ever put a CD in the Microwave?
Can fry/disrupt equipment Can effect humans in negative
ways Some people make
homemade versions from old Microwave oven’s magnetron, wave guide, and other parts Active Denial System
Image from Wikipedia
http://Irongeek.com
The Vircator
VIRtual CAthode oscillaTOR
Image from http://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html
http://Irongeek.com
Geomagnetic Storm
Tied with “space weather” like sunspot and solar flares and Coronal mass ejection
Messes with Earth’s magnetic field More akin to the effect of E3 Largest recorded was September 1 – 2, 1859, really
screwing with the telegraph system March 1989 Geomagnetic Storm had its way with
Hydro-Québec's power grid
http://Irongeek.com
Type of Tech
Things can be unpredictable Solid State, fall down go boom, let magic blue
smoke out (maybe) Thermionic technology (Vacuum Tubes) more
resilient but not perfect. Also, try building a modern computer from them. There are also power concerns.
Fiber optic: No conduct mean no fry Shorter conductors are better
http://Irongeek.com
Fry Chart
Image source http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com
Surge Protection
Metal Oxide Varistor (MOV) Is it fast enough?
E1 peaks at ~5ns Can signal propagate other ways? Electromagnetic arresting devices?
MOV
MOV
MOV
Fuse
EAD Image based on one from http://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html
http://Irongeek.com
Power Sources
I’m soooo in need of better test data Tradition Fossil Fuel Generators Hydro Electric
SCADA Systems Transformers
Solar Wind
Voltage regulation circuits? Charging components?
http://Irongeek.com
Shielding Faraday Cage Fiber Optic Cable Preferred What about power lines in? Water? Any holes? Propagation direction Grounded? For slow moving magnetic
fields (<100kHz) look into Permalloy or Mu-metal
X X
Metal Shell
Earth Ground
Insulator
http://Irongeek.com
Hypothetical computer room
• Seal those holes!• Mesh of size to stop microwaves• Fiber optic in• Doubles as Tempest shield
Image from http://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html
http://Irongeek.com
Improvised Faraday Cage? Microwave File Cabinets Trashcans Ammo Boxes Metal Mailbox Foil Wrapped Containers? Anti-Static Bag? Mesh with holes less than
1/10 diameter of wavelength to be blocked (NSWAG)
http://Irongeek.com
EMP Tips and Guidance
Unplug gear Disconnect antennas Have spares Use voltage clipping devices Avoid large conductor loops Shielded conduit and cables Bury lines (though I have heard mixed opinions)
http://Irongeek.com
Resources EMP Commission Report (April 2008)
http://www.empcommission.org/reports.php The Effects of Nuclear Weapons Chapter 11 (Compiled and edited by Samuel
Glasstone and Philip J. Dolan)http://www.fourmilab.ch/etexts/www/effects/eonw_11.pdf
FEMA 128-Attack Environment Manual-Chapter 4 http://www.lrc.fema.gov/downloads/attack_env_4.pdf
Wikipedia EMP Article http://en.wikipedia.org/wiki/Electromagnetic_pulse
Electromagnetic Pulse Threats in 2010 by Colin R. Miller, Major, USAFhttp://www.au.af.mil/au/awc/awcgate/cst/bugs_ch12.pdf
The Electromagnetic Bomb - a Weapon of Electrical Mass Destruction Carlo Kopphttp://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html
The Early-Time (E1) High-Altitude Electromagnetic Pulse (HEMP) and Its Impact on the U.S. Power Grid by Edward
Savage, James Gilbert, and William Radaskyhttp://www.ornl.gov/sci/ees/etsd/pes/pubs/ferc_Meta-R-320.pdf
Future Science EMP Pagehttp://www.futurescience.com/emp.html
http://Irongeek.com
Thanks
Conference organizers for having me By buddies from Derbycon and the ISDPodcast Open Icon Library for some of my images
http://openiconlibrary.sourceforge.net
http://Irongeek.com
EventsDerbycon
???http://www.derbycon.com
Othershttp://www.louisvilleinfosec.com
http://skydogcon.com http://hack3rcon.org
http://outerz0ne.org
http://phreaknic.info http://notacon.org
Ph
oto
Cre
dits
to
KC
(d
eva
uto
)De
rbyco
n A
rt Cre
dits to
Dig
iP
http://Irongeek.com
QUESTIONS?42
Twitter: @Irongeek_ADC