2 ms·

Google's datacenter-to-datacenter links probably weren't going over the public internet, so they didn't feel the need to protect against man-in-the-middle attac

by pyre 11y ago

Google's datacenter-to-datacenter links probably weren't going over the public internet, so they didn't feel the need to protect against man-in-the-middle attacks on physical lines that they owned. If you connected two computers to each other with a cross-over cable, would you feel the need to encrypt all communications between them, just in case?

nickpsecurity 11y ago
I'm sure that's what they thought. It's so common it's in textbooks. As in, any point-to-point line running outside two buildings through public land and a third party network owned by sneaky, Tier 1 types could never result in eavesdropping by anyone with physical or logical access. It was ridiculous claim when I read it and wasnt doing INFOSEC at the time. Horrendously stupid. There were already link encryptors on market for those exact lines for a reason. A good one in this case. Far as your contrived example, yes I did recommend Layer 2 or 3 encryption, authentication, and monitoring between all nodes for a variety of benefits. It was also in Red Book (Orange Book for networking) as a high-assurance security requirement due to malicious hosts or tapped lines. All the times I eavesdropped on and screwed with Intranets fully justified it. Moreover, reading the Security Monkey later showed he handled a situation where an intruder did a physical splice of the line into a nearby building for his attacks. Just more evidence. So, yes, security must be applied to every layer inside of and around endpoints, networks, and more. The risk you mentioned, minus crossover part, resulted in numerous hacks in the real world that my methods and 80's era methods would've stopped. In a PCI form factor, too, as DiamondTEK secure LAN did exactly that.
robotresearcher 11y ago
> If you connected two computers to each other with a cross-over cable, would you feel the need to encrypt all communications between them, just in case? If I cared about privacy and I couldn't control physical access to the cable? Yes, of course.

by pyre 11y ago

nickpsecurity 11y ago

I'm sure that's what they thought. It's so common it's in textbooks. As in, any point-to-point line running outside two buildings through public land and a third party network owned by sneaky, Tier 1 types could never result in eavesdropping by anyone with physical or logical access. It was ridiculous claim when I read it and wasnt doing INFOSEC at the time. Horrendously stupid. There were already link encryptors on market for those exact lines for a reason. A good one in this case. Far as your contrived example, yes I did recommend Layer 2 or 3 encryption, authentication, and monitoring between all nodes for a variety of benefits. It was also in Red Book (Orange Book for networking) as a high-assurance security requirement due to malicious hosts or tapped lines. All the times I eavesdropped on and screwed with Intranets fully justified it. Moreover, reading the Security Monkey later showed he handled a situation where an intruder did a physical splice of the line into a nearby building for his attacks. Just more evidence. So, yes, security must be applied to every layer inside of and around endpoints, networks, and more. The risk you mentioned, minus crossover part, resulted in numerous hacks in the real world that my methods and 80's era methods would've stopped. In a PCI form factor, too, as DiamondTEK secure LAN did exactly that.

robotresearcher 11y ago

> If you connected two computers to each other with a cross-over cable, would you feel the need to encrypt all communications between them, just in case? If I cared about privacy and I couldn't control physical access to the cable? Yes, of course.