Loading ...
Sorry, an error occurred while loading the content.
 

Selectric typewriter security

Expand Messages
  • Albert LaFrance
    While working as a federal government contractor in the early-mid 1980 s, I heard of (but never saw) IBM Selectric typewriters which were modified to prevent a
    Message 1 of 7 , Oct 26, 2005
      While working as a federal government contractor in the early-mid 1980's, I
      heard of (but never saw) IBM Selectric typewriters which were modified to
      prevent a potential security compromise.

      For those not familiar with the machine, the Selectric's printing mechanism
      was a removable plastic (or metal?) ball whose surface carried raised
      impressions of the character set. Pressing a key activated a complex system
      of mechanical linkages and clutches which tilted and/or rotated the ball to
      face the appropriate character toward the platen, then struck the ball
      against the inked ribbon and the paper.

      Power to operate the mechanism was supplied by a continuously-rotating
      shaft, driven by an electric motor. The security risk, as I understand it,
      involved the fact that each key initiated a unique series of mechanical
      operations, which translated to a unique sequence of load fluctuations on
      the motor, which in turn caused variations in the electric power drawn from
      the circuit supplying the typewriter. In theory, an adversary could record
      and analyze the resulting minute voltage fluctuations on the circuit to
      determine what was being typed, by observing the "signature" of each
      keystroke.

      I believe the "fix" was simply to install a flywheel on the typewriter's
      drive shaft, thus smoothing out the load variations on the motor and, hence,
      on the power circuit.

      Albert
    • blitz
      You are correct, we used selectrics in a former business I was VP of, and we installed a kit from IBM to do exactly that, de-clutch the motor...it was a
      Message 2 of 7 , Oct 27, 2005
        You are correct, we used selectrics in a former business I was VP of, and
        we installed a kit from IBM to do exactly that, de-clutch the motor...it
        was a flywheel thingie.


        At 00:38 10/27/2005, you wrote:
        >While working as a federal government contractor in the early-mid 1980's, I
        >heard of (but never saw) IBM Selectric typewriters which were modified to
        >prevent a potential security compromise.
        >
        >For those not familiar with the machine, the Selectric's printing mechanism
        >was a removable plastic (or metal?) ball whose surface carried raised
        >impressions of the character set. Pressing a key activated a complex system
        >of mechanical linkages and clutches which tilted and/or rotated the ball to
        >face the appropriate character toward the platen, then struck the ball
        >against the inked ribbon and the paper.
        >
        >Power to operate the mechanism was supplied by a continuously-rotating
        >shaft, driven by an electric motor. The security risk, as I understand it,
        >involved the fact that each key initiated a unique series of mechanical
        >operations, which translated to a unique sequence of load fluctuations on
        >the motor, which in turn caused variations in the electric power drawn from
        >the circuit supplying the typewriter. In theory, an adversary could record
        >and analyze the resulting minute voltage fluctuations on the circuit to
        >determine what was being typed, by observing the "signature" of each
        >keystroke.
        >
        >I believe the "fix" was simply to install a flywheel on the typewriter's
        >drive shaft, thus smoothing out the load variations on the motor and, hence,
        >on the power circuit.
        >
        >Albert
        >
        >
        >
        >
        >
        >
        >Yahoo! Groups Links
        >
        >
        >
        >


        [Non-text portions of this message have been removed]
      • David Lesher
        ... Security motors had a massive flywheel - 3 + inches in dia and ~2 long. The problem was, there was no room to also make the motor bigger to start
        Message 3 of 7 , Oct 27, 2005
          Speaking on Deep Background, the Press Secretary whispered:
          >
          > While working as a federal government contractor in the early-mid 1980's, I
          > heard of (but never saw) IBM Selectric typewriters which were modified to
          > prevent a potential security compromise.
          ...
          > I believe the "fix" was simply to install a flywheel on the typewriter's
          > drive shaft, thus smoothing out the load variations on the motor and, hence,
          > on the power circuit.


          'Security' motors had a massive flywheel - 3"+ inches in dia
          and ~2" long. The problem was, there was no room to also make
          the motor bigger to start spinning that flywheel -- the standard
          motor couldn't even start the Selectric directly.

          So there was added centrifical clutch inside the security motor;
          the motor would start, pick up speed, the clutch would engage
          & the flywheel start spinning. Only after IT was going full-tilt
          would the original clutch engage, and the belt would start the
          Selectric... Of course, if the typewriter was cold, and the line
          voltage low.....

          There was of course the OTHER Selectric compromise -- the ones
          found in Moscow.



          --
          A host is a host from coast to coast.................wb8foz@...
          & no one will talk to a host that's close........[v].(301) 56-LINUX
          Unless the host (that isn't close).........................pob 1433
          is busy, hung or dead....................................20915-1433
        • Kenneth Coney
          That was one solution. At the HQ of a large alphabet agency I was affiliated with the other solution was to filter the electric when it left the floor and
          Message 4 of 7 , Oct 27, 2005
            That was one solution. At the HQ of a large alphabet agency I was
            affiliated with the other solution was to filter the electric when it
            left the floor and grill every window. Also ribbons were secured daily
            and teams of security officers swept the floors nightly after the clerks
            left to be sure the ribbons, new plattens and any carbon paper (another
            ancient technology unknown to today's youth) had been secured and the
            safes locked and no clue (beyond public domain books in book shelfs)
            remained behind as indicators of what was done in that office. Wang
            drums were secured as were KY3 cabinets, the cards for them, etc.

            Albert LaFrance wrote:

            >While working as a federal government contractor in the early-mid 1980's, I
            >heard of (but never saw) IBM Selectric typewriters which were modified to
            >prevent a potential security compromise.
            >
            >For those not familiar with the machine, the Selectric's printing mechanism
            >was a removable plastic (or metal?) ball whose surface carried raised
            >impressions of the character set. Pressing a key activated a complex system
            >of mechanical linkages and clutches which tilted and/or rotated the ball to
            >face the appropriate character toward the platen, then struck the ball
            >against the inked ribbon and the paper.
            >
            >Power to operate the mechanism was supplied by a continuously-rotating
            >shaft, driven by an electric motor. The security risk, as I understand it,
            >involved the fact that each key initiated a unique series of mechanical
            >operations, which translated to a unique sequence of load fluctuations on
            >the motor, which in turn caused variations in the electric power drawn from
            >the circuit supplying the typewriter. In theory, an adversary could record
            >and analyze the resulting minute voltage fluctuations on the circuit to
            >determine what was being typed, by observing the "signature" of each
            >keystroke.
            >
            >I believe the "fix" was simply to install a flywheel on the typewriter's
            >drive shaft, thus smoothing out the load variations on the motor and, hence,
            >on the power circuit.
            >
            >Albert
            >
            >
            >
            >
            >
            >
            >Yahoo! Groups Links
            >
            >
            >
            >
            >
            >
            >
            >
            >
          • paul rosa
            Kenneth: Funny you should mention carbon paper. Some of you may recall the carbon sets with the carbon paper attached at the top to onion skin paper for
            Message 5 of 7 , Oct 27, 2005
              Kenneth:

              Funny you should mention carbon paper. Some of you may recall the
              carbon sets with the carbon paper attached at the top to onion skin
              paper for second and third copies. When I was with an intel unit in
              Vietnam I worked the overnight shift for some time. Since we slept
              during the day we would hit our commander's trash can and read all the
              carbons to see what was going on. Then everything would get burned. It
              proved to be a pretty good intel system to learn what was going on in-house.

              Paul Rosa
              Harpers Ferry, WV

              Kenneth Coney wrote:

              >That was one solution. At the HQ of a large alphabet agency I was
              >affiliated with the other solution was to filter the electric when it
              >left the floor and grill every window. Also ribbons were secured daily
              >and teams of security officers swept the floors nightly after the clerks
              >left to be sure the ribbons, new plattens and any carbon paper (another
              >ancient technology unknown to today's youth) had been secured and the
              >safes locked and no clue (beyond public domain books in book shelfs)
              >remained behind as indicators of what was done in that office. Wang
              >drums were secured as were KY3 cabinets, the cards for them, etc.
              >
              >Albert LaFrance wrote:
              >
              >
              >
              >>While working as a federal government contractor in the early-mid 1980's, I
              >>heard of (but never saw) IBM Selectric typewriters which were modified to
              >>prevent a potential security compromise.
              >>
              >>For those not familiar with the machine, the Selectric's printing mechanism
              >>was a removable plastic (or metal?) ball whose surface carried raised
              >>impressions of the character set. Pressing a key activated a complex system
              >>of mechanical linkages and clutches which tilted and/or rotated the ball to
              >>face the appropriate character toward the platen, then struck the ball
              >>against the inked ribbon and the paper.
              >>
              >>Power to operate the mechanism was supplied by a continuously-rotating
              >>shaft, driven by an electric motor. The security risk, as I understand it,
              >>involved the fact that each key initiated a unique series of mechanical
              >>operations, which translated to a unique sequence of load fluctuations on
              >>the motor, which in turn caused variations in the electric power drawn from
              >>the circuit supplying the typewriter. In theory, an adversary could record
              >>and analyze the resulting minute voltage fluctuations on the circuit to
              >>determine what was being typed, by observing the "signature" of each
              >>keystroke.
              >>
              >>I believe the "fix" was simply to install a flywheel on the typewriter's
              >>drive shaft, thus smoothing out the load variations on the motor and, hence,
              >>on the power circuit.
              >>
              >>Albert
              >>
              >>
              >>
              >>
              >>
              >>
              >>Yahoo! Groups Links
              >>
              >>
              >>
              >>
              >>
              >>
              >>
              >>
              >>
              >>
              >>
              >
              >
              >
              >
              >
              >Yahoo! Groups Links
              >
              >
              >
              >
              >
              >
              >
              >
              >
              >


              [Non-text portions of this message have been removed]
            • Albert LaFrance
              I m curious: does anyone know if the Selectric vulnerability has been demonstrated in the laboratory? Was there ever any suspicion that it was being exploited
              Message 6 of 7 , Oct 31, 2005
                I'm curious: does anyone know if the Selectric vulnerability has been
                demonstrated in the laboratory? Was there ever any suspicion that it was
                being exploited by an enemy?

                I imagine the task would have been feasible, in that era, in a laboratory
                with a "clean" power source supplying only the one typewriter. But in an
                actual operating environment, the typewriter would probably be connected to
                a circuit feeding several other fluctuating loads of various magnitudes,
                possibly including other Selectrics.

                Albert
              • David Lesher
                ... Yes to both. [I think it s safe to say anything that non-specific..] ... In general, recall that there were far fewer appliances in use in that era, esp.
                Message 7 of 7 , Oct 31, 2005
                  Speaking on Deep Background, the Press Secretary whispered:
                  >
                  > I'm curious: does anyone know if the Selectric vulnerability has been
                  > demonstrated in the laboratory? Was there ever any suspicion that it was
                  > being exploited by an enemy?

                  Yes to both. [I think it's safe to say anything that non-specific..]

                  > I imagine the task would have been feasible, in that era, in a laboratory
                  > with a "clean" power source supplying only the one typewriter. But in an
                  > actual operating environment, the typewriter would probably be connected to
                  > a circuit feeding several other fluctuating loads of various magnitudes,
                  > possibly including other Selectrics.

                  In general, recall that there were far fewer appliances in use
                  in that era, esp. in a USG office....


                  --
                  A host is a host from coast to coast.................wb8foz@...
                  & no one will talk to a host that's close........[v].(301) 56-LINUX
                  Unless the host (that isn't close).........................pob 1433
                  is busy, hung or dead....................................20915-1433
                Your message has been successfully submitted and would be delivered to recipients shortly.