http://Irongeek.com

EMP, YEAH YOU KNOW ME!Adrian CrenshawNaughty by Nuke!

(With apologies to Naughty by Nature)

http://Irongeek.com

About Adrian I run Irongeek.com I have an interest in InfoSec

education I don’t know everything - I’m just a

geek with time on my hands I’m an (Ir)regular on the InfoSec

Daily Podcast: http://isdpodcast.com

Sr. Information Security Engineer at a Fortune 1000

Co-Founder of Derbyconhttp://www.derbycon.com/

Twitter: @Irongeek_ADC

http://Irongeek.com

What is EMP?

EMP = Electromagnetic Pulse A powerful burst of radio waves cause by quickly

changing electromagnetic fields Has the effect of inducing currents into conductors

and can “burn” them up or cause interference Early British term was “Radioflash”

http://Irongeek.com

Why this subject?

I don’t consider myself a prepper or survivalist (but I did collect a lot of Paladin Press books as a kid)

I like the smell of fried electronics (as long as they ain’t mine)

Lots of scare monger videos, justified or not, but little with the science behind EMP

It fit the theme!

http://Irongeek.com

EMP: Entertaining Misinformed People

Signal to Noise is high on this subject Many people will speak authoritatively, but not know the actual fact Tried searching for site:mil and site:gov

Limited practical testing seems to have been done Radio Waves do weird things… When/where was the testing done?

Audience Some stuff is classified Some stuff aims toward the non technical

I’m not an expert either, so take all this with a huge grain of salt

http://Irongeek.com

Examples

???

http://Irongeek.com

Spark Gap?

Ever run a vacuum/electric motor while watching an analog TV?

Sparks cause a broad band of radio waves to propagate, which can cause interference.

http://Irongeek.com

Inducing current

Changing magnetic fields cause current in a conductor

Current in a conductor cause a magnetic field

+

-

http://Irongeek.com

Near-Field and Far-Fields

Distance? 1/(d^3) vs. 1/(d^2)

Image from http://en.wikipedia.org/wiki/Near_and_far_field

http://Irongeek.com

Self Propagating EM Wave

Image from http://en.wikipedia.org/wiki/Electromagnetic_radiation

http://Irongeek.com

Bit Of History

Apparently EMP was expected by Enrico Fermi, and equipment during the Trinity test (July 16, 1945) was shielded in anticipation of it

Apparently some recording were lost due to “spurious pickup”

Greater interest came about afterStarfish Prime

Hi Guys!!!

http://Irongeek.com

Starfish Prime

High altitude test of a nuclear weapon on July 9, 1962

1.4 megaton W49 thermonuclear warhead detonated 250mi (400km)above a point about 19 miles southwest of Johnston Island in thePacific Ocean

EMP effect was greater than anticipated

http://Irongeek.com

Starfish Prime EMP Effects

Drove instruments off the scale, presumably as expectations of the effect was lower

Damaged electrical systems 898 miles away in Hawaii 300 street lights blown Telephone microwave link damaged Set off burglar alarms

Further tests in the “Operation Fishbowl” series gave more data on EMP’s effects

http://Irongeek.com

EMP: Multiple Pulse in Three Parts

E1 – Very short, powerful burst that induce high currents in conductors.

E2 – Comes shortly after E1. Somewhat akin to the EM effects of a lightning strike. Many systems may already be prepared, but precursor damage from E1 may soften them up.

E3 – Longer, slower pulse that can last many seconds caused by the Earth’s magnetic field being pushed out of the way. Can induce current in long conductors and cause damage to power systems.

http://Irongeek.com

Volts per Meter

Volts per Meter – V/m – Voltage across a one Meter conductor as the magnetic field sweeps across it. EMP: 100,000 V/m Ground Burst Radar: 200 V/m Radio Communications: 10 V/m Metropolitan Noise: 0.1 V/m

Ball park figures from http://www.lrc.fema.gov/downloads/attack_env_4.pdf

http://Irongeek.com

Range from Ground Zero for Surface Burst

If you are too close, you are already having a bad day!

Image source http://www.lrc.fema.gov/downloads/attack_env_4.pdf

http://Irongeek.com

Burst location

Surface/Near Surface Burst – Ground level EMP is an issue, but other effects may take precedence Geography limits area Air density limit range

High Altitude – above 30km 20km to 40km is where we get the Compton effect Can hit a larger area Saturation at about 50,000V/m 500km burst could cover continental United State

Air Burst - 100-1000m, maybe below 30km? Not as interesting for EMP*

* http://www.fas.org/nuke/intro/nuke/emp/c-2fig.pdfhttp://www.lrc.fema.gov/downloads/attack_env_4.pdf

http://Irongeek.com

More Acronym (and Electron) Soup

SREMP = Source Region EMP (low/surface burst) HEMP = High-altitude EMP MHD-EMP = Magnetohydrodynamic EMP

Caused by shifting of Earth’s magnetic field SGEMP = System Generated EMP

Caused by Gamma/X-Rays hitting the outside of a satellite/space craft

NNEP = Non-Nuclear EMP

http://Irongeek.com

+Ground Burst

Net Electron Current

Ground absorbs some Gamma

.+

Current Return Path Through Ground

Outward Radiating EMP

.+

http://Irongeek.com

AirburstNet Electron Current

Caused ByAtmospheric Density Gradient Leading To Weak Vertical Dipole

Gamma Rays Cause “Compton Scattering”,

Knocking Electrons Out Of Molecules In The Air,

Causing A Charge Seperation

http://Irongeek.com

Chain of events E1/E2: HEMP

EM

P

EMP

EM

P

Gamma Rays knock Electrons out of air molecules (Compton Effect) at about 20 to 40km altitudein a mostly down direction

Gamma Rays caused by detonation

Electrons direction effect by Earth’s magnetic field, now we have EMP

Gamma ray diffusion and other effects cause delayed E2

http://Irongeek.com

Chain of Events E3Earth’s magnetic field just sitting there, minding it’s own business

Detonation happens

“Fireball” affects magnetic permeability,causing changes in Earth’s magnetic field

http://Irongeek.com

Spectrum

Lots of interference

Image source http://www.lrc.fema.gov/downloads/attack_env_4.pdf

http://Irongeek.com

Earth’s Magnetic Lines

Latitude and Altitude make a big difference

Image from Wikipedia/Figure 2.143 from page 76 of the book, "The Effects of Nuclear Weapons" by Samuel Glasstone and Phillip J. Dolan. 1977 edition published by the United States Department of Defense. {{PD-USGov}} Used to illustrate the concept of magnetic conjugate regions

http://Irongeek.com

EMP Production Factors

Altitude Yield and Construction Distance from detonation Geography Magnetic Field Strength

http://Irongeek.com

Prompt Gamma Yield More Important Than Total Yield

0.115–0.5% of nuke’s energy is Prompt Gamma Yield

Starfish Prime was 1.4MT, but 0.1% PGY, so 1.4Kt for EMP effect

500Kt Nuke optimized for 0.5% PGY would give 2.5Kt for EMP effect

Pre-ionization in thermonuclear bombs may cause less EMP effects to take place than more primitive fission weapons

Image from http://en.wikipedia.org/wiki/Electromagnetic_pulse

http://Irongeek.com

EMP Horseshoe Effect

Image from http://en.wikipedia.org/wiki/Electromagnetic_pulse

http://Irongeek.com

Entry Points

Direct – in through the holes Induced

Antennas Satellite Dishes Power Lines Network Cables Telephone Wire Other Cables Plumbing

http://Irongeek.com

Damage Types

Functional Damage – Over load, hit break down voltage, heat up and fry! Blue smoke is gone, it’s dead Jim!

Operational Damage – Circuit upset for transient current. Circuit breaker blown, or circuit logic disturbed.

Pulled from http://www.lrc.fema.gov/downloads/attack_env_4.pdf

http://Irongeek.com

Super EMP Nuke

Can you optimize a nuclear bomb to have more of an EMP effect? Reduce ionization from heat Make case and explosive gamma transparent Produce as much gamma as quick as possible

http://Irongeek.com

Non Nuclear EMP (NNEMP)

What about just the EMP, without the other nasty nuke effects?

Effect electrical systems, but not buildings/roads “Force Multiplier” from loss of enemy

communications Less (immediate) deaths = less political

ramifications?

http://Irongeek.com

Marx Generator Charge capacitors in parallel, discharge in series

Images from http://en.wikipedia.org/

ATLAS-I/ The Sandia TrestleMarx Generator

http://Irongeek.com

Explosively Pumped Flux Compression Generator

EPFCG uses a magnetic field with conventional explosives (many configurations)

Below is a “Helical generator”

+-

Coil

Armature

Capacitor

High Explosive

http://Irongeek.com

High-Energy Radio Frequency weapons (HERF)

Ever put a CD in the Microwave?

Can fry/disrupt equipment Can effect humans in negative

ways Some people make

homemade versions from old Microwave oven’s magnetron, wave guide, and other parts Active Denial System

Image from Wikipedia

http://Irongeek.com

The Vircator

VIRtual CAthode oscillaTOR

Image from http://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html

http://Irongeek.com

Geomagnetic Storm

Tied with “space weather” like sunspot and solar flares and Coronal mass ejection

Messes with Earth’s magnetic field More akin to the effect of E3 Largest recorded was September 1 – 2, 1859, really

screwing with the telegraph system March 1989 Geomagnetic Storm had its way with

Hydro-Québec's power grid

http://Irongeek.com

Type of Tech

Things can be unpredictable Solid State, fall down go boom, let magic blue

smoke out (maybe) Thermionic technology (Vacuum Tubes) more

resilient but not perfect. Also, try building a modern computer from them. There are also power concerns.

Fiber optic: No conduct mean no fry Shorter conductors are better

http://Irongeek.com

Fry Chart

Image source http://www.lrc.fema.gov/downloads/attack_env_4.pdf

http://Irongeek.com

Surge Protection

Metal Oxide Varistor (MOV) Is it fast enough?

E1 peaks at ~5ns Can signal propagate other ways? Electromagnetic arresting devices?

MOV

MOV

MOV

Fuse

EAD Image based on one from http://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html

http://Irongeek.com

Power Sources

I’m soooo in need of better test data Tradition Fossil Fuel Generators Hydro Electric

SCADA Systems Transformers

Solar Wind

Voltage regulation circuits? Charging components?

http://Irongeek.com

Shielding Faraday Cage Fiber Optic Cable Preferred What about power lines in? Water? Any holes? Propagation direction Grounded? For slow moving magnetic

fields (<100kHz) look into Permalloy or Mu-metal

X X

Metal Shell

Earth Ground

Insulator

http://Irongeek.com

Hypothetical computer room

• Seal those holes!• Mesh of size to stop microwaves• Fiber optic in• Doubles as Tempest shield

Image from http://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html

http://Irongeek.com

Improvised Faraday Cage? Microwave File Cabinets Trashcans Ammo Boxes Metal Mailbox Foil Wrapped Containers? Anti-Static Bag? Mesh with holes less than

1/10 diameter of wavelength to be blocked (NSWAG)

http://Irongeek.com

EMP Tips and Guidance

Unplug gear Disconnect antennas Have spares Use voltage clipping devices Avoid large conductor loops Shielded conduit and cables Bury lines (though I have heard mixed opinions)

http://Irongeek.com

Resources EMP Commission Report (April 2008)

http://www.empcommission.org/reports.php The Effects of Nuclear Weapons Chapter 11 (Compiled and edited by Samuel

Glasstone and Philip J. Dolan)http://www.fourmilab.ch/etexts/www/effects/eonw_11.pdf

FEMA 128-Attack Environment Manual-Chapter 4 http://www.lrc.fema.gov/downloads/attack_env_4.pdf

Wikipedia EMP Article http://en.wikipedia.org/wiki/Electromagnetic_pulse

Electromagnetic Pulse Threats in 2010 by Colin R. Miller, Major, USAFhttp://www.au.af.mil/au/awc/awcgate/cst/bugs_ch12.pdf

The Electromagnetic Bomb - a Weapon of Electrical Mass Destruction Carlo Kopphttp://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html

The Early-Time (E1) High-Altitude Electromagnetic Pulse (HEMP) and Its Impact on the U.S. Power Grid by Edward

Savage, James Gilbert, and William Radaskyhttp://www.ornl.gov/sci/ees/etsd/pes/pubs/ferc_Meta-R-320.pdf

Future Science EMP Pagehttp://www.futurescience.com/emp.html

http://Irongeek.com

Thanks

Conference organizers for having me By buddies from Derbycon and the ISDPodcast Open Icon Library for some of my images

http://openiconlibrary.sourceforge.net

http://Irongeek.com

EventsDerbycon

???http://www.derbycon.com

Othershttp://www.louisvilleinfosec.com

http://skydogcon.com http://hack3rcon.org

http://outerz0ne.org

http://phreaknic.info http://notacon.org

Ph

oto

Cre

dits

to

KC

(d

eva

uto

)De

rbyco

n A

rt Cre

dits to

Dig

iP

http://Irongeek.com

QUESTIONS?42

Twitter: @Irongeek_ADC