Adrian Crenshaw
Naughty by Nuke!
(With apologies to Naughty by Nature)
http://Irongeek.com






I run Irongeek.com
I have an interest in InfoSec
education
I don’t know everything - I’m just a
geek with time on my hands
I’m an (Ir)regular on the InfoSec
Daily Podcast:
http://isdpodcast.com
Sr. Information Security Engineer at
a Fortune 1000
Co-Founder of Derbycon
http://www.derbycon.com/
http://Irongeek.com
Twitter: @Irongeek_ADC




EMP = Electromagnetic Pulse
A powerful burst of radio waves cause by quickly
changing electromagnetic fields
Has the effect of inducing currents into conductors
and can “burn” them up or cause interference
Early British term was “Radioflash”
http://Irongeek.com




I don’t consider myself a prepper or survivalist (but
I did collect a lot of Paladin Press books as a kid)
I like the smell of fried electronics (as long as they
ain’t mine)
Lots of scare monger videos, justified or not, but
little with the science behind EMP
It fit the theme!
http://Irongeek.com

Signal to Noise is high on this subject



Limited practical testing seems to have been done



Radio Waves do weird things…
When/where was the testing done?
Audience



Many people will speak authoritatively, but not know the actual fact
Tried searching for site:mil and site:gov
Some stuff is classified
Some stuff aims toward the non technical
I’m not an expert either, so take all this with a huge grain of
salt
http://Irongeek.com

???
http://Irongeek.com


Ever run a vacuum/electric motor while watching
an analog TV?
Sparks cause a broad band of radio waves to
propagate, which can cause interference.
http://Irongeek.com


Changing magnetic fields cause current in a
conductor
Current in a conductor cause a magnetic field
-
+
http://Irongeek.com

Distance? 1/(d^3) vs. 1/(d^2)
Image from http://en.wikipedia.org/wiki/Near_and_far_field
http://Irongeek.com
Image from http://en.wikipedia.org/wiki/Electromagnetic_radiation
http://Irongeek.com



Apparently EMP was expected by Enrico Fermi, and
equipment during the Trinity test (July 16, 1945)
Hi Guys!!!
was shielded in anticipation of it
Apparently some recording were lost
due to “spurious pickup”
Greater interest came about after
Starfish Prime
http://Irongeek.com



High altitude test of a nuclear weapon on July 9,
1962
1.4 megaton W49 thermonuclear
warhead detonated 250mi (400km)
above a point about 19 miles
southwest of Johnston Island in the
Pacific Ocean
EMP effect was greater than
anticipated
http://Irongeek.com


Drove instruments off the scale, presumably as
expectations of the effect was lower
Damaged electrical systems 898 miles away in
Hawaii




300 street lights blown
Telephone microwave link damaged
Set off burglar alarms
Further tests in the “Operation Fishbowl” series
gave more data on EMP’s effects
http://Irongeek.com



E1 – Very short, powerful burst that induce high
currents in conductors.
E2 – Comes shortly after E1. Somewhat akin to the
EM effects of a lightning strike. Many systems may
already be prepared, but precursor damage from E1
may soften them up.
E3 – Longer, slower pulse that can last many
seconds caused by the Earth’s magnetic field being
pushed out of the way. Can induce current in long
conductors and cause damage to power systems.
http://Irongeek.com

Volts per Meter – V/m – Voltage across a one Meter
conductor as the magnetic field sweeps across it.
EMP: 100,000 V/m Ground Burst
 Radar: 200 V/m
 Radio Communications: 10 V/m
 Metropolitan Noise: 0.1 V/m

Ball park figures from http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com

If you are too close, you are already having a bad
day!
Image source http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com

Surface/Near Surface Burst – Ground level




High Altitude – above 30km





EMP is an issue, but other effects may take precedence
Geography limits area
Air density limit range
20km to 40km is where we get the Compton effect
Can hit a larger area
Saturation at about 50,000V/m
500km burst could cover continental United State
Air Burst - 100-1000m, maybe below 30km?

Not as interesting for EMP*
*
http://www.fas.org/nuke/intro/nuke/emp/c-2fig.pdf
http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com





SREMP = Source Region EMP (low/surface burst)
HEMP = High-altitude EMP
MHD-EMP = Magnetohydrodynamic EMP
Caused by shifting of Earth’s magnetic field
SGEMP = System Generated EMP
Caused by Gamma/X-Rays hitting the outside of a
satellite/space craft
NNEP = Non-Nuclear EMP
http://Irongeek.com
Outward
Radiating EMP
Net
Electron
Current
Ground absorbs
some Gamma
http://Irongeek.com
+
.
+
.
Current Return Path
Through Ground
Net Electron Current
Caused By
Atmospheric Density
Gradient Leading To
Weak Vertical Dipole
Gamma Rays Cause
“Compton Scattering”,
Knocking Electrons Out
Of Molecules In The Air,
Causing A Charge
Seperation
http://Irongeek.com
Gamma Rays caused by detonation
Gamma Rays knock Electrons out of air molecules (Compton Effect) at about 20 to 40km altitude
in a mostly down direction
Electrons direction effect by Earth’s magnetic field, now we have EMP
Gamma ray diffusion and other effects cause delayed E2
http://Irongeek.com
Earth’s magnetic field just sitting there, minding it’s own business
Detonation happens
“Fireball” affects magnetic permeability,
causing changes in Earth’s magnetic field
http://Irongeek.com

Lots of interference
Image source http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com

Latitude and Altitude make a big difference
Image from Wikipedia/Figure 2.143 from page 76 of the book, "The Effects of Nuclear Weapons" by Samuel Glasstone and
Phillip J. Dolan. 1977 edition published by the United States Department of Defense. {{PD-USGov}} Used to illustrate the
concept of magnetic conjugate regions
http://Irongeek.com





Altitude
Yield and Construction
Distance from detonation
Geography
Magnetic Field Strength
http://Irongeek.com




0.115–0.5% of nuke’s energy is
Prompt Gamma Yield
Starfish Prime was 1.4MT, but 0.1%
PGY, so 1.4Kt for EMP effect
500Kt Nuke optimized for 0.5% PGY
would give 2.5Kt for EMP effect
Pre-ionization in thermonuclear
bombs may cause less EMP effects
to take place than more primitive
fission weapons
Image from http://en.wikipedia.org/wiki/Electromagnetic_pulse
http://Irongeek.com
Image from http://en.wikipedia.org/wiki/Electromagnetic_pulse
http://Irongeek.com


Direct – in through the holes
Induced
Antennas
 Satellite Dishes
 Power Lines
 Network Cables
 Telephone Wire
 Other Cables
 Plumbing

http://Irongeek.com

Functional Damage – Over load, hit break down
voltage, heat up and fry! Blue smoke is gone, it’s
dead Jim!

Operational Damage – Circuit upset for transient
current. Circuit breaker blown, or circuit logic
disturbed.
Pulled from http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com
Can you optimize a nuclear bomb to have more of an
EMP effect?
 Reduce ionization from heat
 Make case and explosive gamma transparent
 Produce as much gamma as quick as possible
http://Irongeek.com




What about just the EMP, without the other nasty
nuke effects?
Effect electrical systems, but not buildings/roads
“Force Multiplier” from loss of enemy
communications
Less (immediate) deaths = less political
ramifications?
http://Irongeek.com

Charge capacitors in parallel, discharge in series
ATLAS-I/ The Sandia Trestle
http://Irongeek.com
Images from http://en.wikipedia.org/
Marx Generator


EPFCG uses a magnetic field with conventional
explosives (many configurations)
Below is a “Helical generator”
Armature
High Explosive
Capacitor
+
-
http://Irongeek.com
Coil




Ever put a CD in the
Microwave?
Can fry/disrupt equipment
Can effect humans in negative
ways
Some people make
homemade versions from old
Microwave oven’s magnetron,
wave guide, and other parts
http://Irongeek.com
Active Denial System
Image from Wikipedia

VIRtual CAthode oscillaTOR
Image from http://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html
http://Irongeek.com





Tied with “space weather” like sunspot and solar
flares and Coronal mass ejection
Messes with Earth’s magnetic field
More akin to the effect of E3
Largest recorded was September 1 – 2, 1859, really
screwing with the telegraph system
March 1989 Geomagnetic Storm had its way with
Hydro-Québec's power grid
http://Irongeek.com





Things can be unpredictable
Solid State, fall down go boom, let magic blue
smoke out (maybe)
Thermionic technology (Vacuum Tubes) more
resilient but not perfect. Also, try building a modern
computer from them. There are also power
concerns.
Fiber optic: No conduct mean no fry
Shorter conductors are better
http://Irongeek.com
Image source http://www.lrc.fema.gov/downloads/attack_env_4.pdf
http://Irongeek.com


Metal Oxide Varistor (MOV)
Is it fast enough?


Can signal propagate other ways?
Electromagnetic arresting devices?
Fuse

E1 peaks at ~5ns
MOV
MOV
MOV
EAD Image based on one from http://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html
http://Irongeek.com
I’m soooo in need of better test data
 Tradition Fossil Fuel Generators
 Hydro Electric




SCADA Systems
Transformers
Solar
Wind


Voltage regulation circuits?
Charging components?
http://Irongeek.com








Faraday Cage
Fiber Optic Cable Preferred
What about power lines in?
XX
Water?
Any holes?
Propagation direction
Grounded?
For slow moving magnetic
fields (<100kHz) look into
Permalloy or Mu-metal
Earth Ground
http://Irongeek.com
Metal Shell
Insulator
•
•
•
•
Seal those holes!
Mesh of size to stop microwaves
Fiber optic in
Doubles as Tempest shield
Image from http://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html
http://Irongeek.com








Microwave
File Cabinets
Trashcans
Ammo Boxes
Metal Mailbox
Foil Wrapped Containers?
Anti-Static Bag?
Mesh with holes less than
1/10 diameter of wavelength
to be blocked (NSWAG)
http://Irongeek.com







Unplug gear
Disconnect antennas
Have spares
Use voltage clipping devices
Avoid large conductor loops
Shielded conduit and cables
Bury lines (though I have heard mixed opinions)
http://Irongeek.com









EMP Commission Report (April 2008)
http://www.empcommission.org/reports.php
The Effects of Nuclear Weapons Chapter 11 (Compiled and edited by Samuel
Glasstone and Philip J. Dolan)
http://www.fourmilab.ch/etexts/www/effects/eonw_11.pdf
FEMA 128-Attack Environment Manual-Chapter 4
http://www.lrc.fema.gov/downloads/attack_env_4.pdf
Wikipedia EMP Article
http://en.wikipedia.org/wiki/Electromagnetic_pulse
Electromagnetic Pulse Threats in 2010 by Colin R. Miller, Major, USAF
http://www.au.af.mil/au/awc/awcgate/cst/bugs_ch12.pdf
The Electromagnetic Bomb - a Weapon of Electrical Mass Destruction Carlo Kopp
http://www.airpower.maxwell.af.mil/airchronicles/cc/apjemp.html
The Early-Time (E1) High-Altitude
Electromagnetic Pulse (HEMP) and Its Impact on the U.S. Power Grid by Edward
Savage, James Gilbert, and William Radasky
http://www.ornl.gov/sci/ees/etsd/pes/pubs/ferc_Meta-R-320.pdf
Future Science EMP Page
http://www.futurescience.com/emp.html
http://Irongeek.com



Conference organizers for having me
By buddies from Derbycon and the ISDPodcast
Open Icon Library for some of my images
http://openiconlibrary.sourceforge.net
http://Irongeek.com
Derbycon
???
Derbycon Art Credits to DigiP
Photo Credits to KC (devauto)
http://www.derbycon.com
Others
http://www.louisvilleinfosec.com
http://skydogcon.com
http://hack3rcon.org
http://Irongeek.com
http://outerz0ne.org
http://phreaknic.info
http://notacon.org
42
Twitter: @Irongeek_ADC
http://Irongeek.com