5 ms·
Stealing is a rookie move. But I don't think there was a choice about using his work laptop. You can't connect an arbitrary device to Google's network. https:/
by Jabbles 10y ago
Stealing is a rookie move. But I don't think there was a choice about using his work laptop. You can't connect an arbitrary device to Google's network.
https://research.google.com/pubs/pub43231.html https://research.google.com/pubs/pub43231.html
- dsacco 10y agoNice link, this is a great read for anyone interested in endpoint security research.
- throwaway23190 10y ago... all which are easily compromised by a commodity phone. "Ah you know, I forgot my charger! Dang! I'll just plug this into the USB port of this sooper secure machine connected to this sooper secure network."
- taneq 10y agoComputer says no.
- kuschku 10y agoThat's... an impossible task. All ways to identify a machine in a network are dependent on the machine itself — if properly configured, I can create a machine that can not be told different from another machine. Just extract the device certificate from one device and store it on another. Problem solved. Extracting data from the TPM or equivalent stores in ARM devices is also not impossible, as the DRM-breaking community has shown with extracting keys from TPM-based DRM.
- grogenaut 10y agoLeaving TPM breaking aside, is dude who did all these things on work network the same dude who's going to break a TPM?
- Jabbles 10y agoPlease don't dismiss something from your armchair. I've just mentioned that Google relies on this technology to secure their network.
- kuschku 10y agoThe problem is that it’s basically a fancy version of using MAC addresses for auth. I’m more surprised a Google engineer couldn’t circumvent it.
- billhathaway 10y agoIf you read the "Beyond Corp" doc, there are also certificates involved.
- bmon 10y agoHow about a whitelist of hardware fingerprints, similar to what Microsoft does with Windows installations. Also, Google is known to have custom manufactured hardware, specifically with security in mind. I don't think the idea that Google is able to secure their own network against foreign devices is really that far-fetched.
- kuschku 10y agoNone of that would solve the issue. Google can only verify what hardware you're running by sending a packet via ethernet to your device. You control all software running on your device, and can send a spoofed result. If you were crazy, you could even just emulate Google's hardware entirely and proxy all requests to that emulated hardware. Nonetheless, while this guy certainly wouldn't be able to do it, many Google employees would.
- etler 10y agoCouldn't they do a chip and pin style hardware solution where a security chip generates a response using a unique secret algorithm?
- kuschku 10y agoThat would work — until someone decaps a few of these chips. They're already doing something similar, after all.
- etler 10y agoWouldn't you need to decap every individual chip you want to compromise?
- MertsA 10y agoBut that's really not the case here. Making secure computing elements like TPMs or HSMs, or Apple's Secure Enclave or the plethora of other devices out there is a solved problem. You can decap it and try to get that data out of it but at the very least with the current state of the art you can make this very unlikely to succeed and extremely expensive to even attempt. Handwaving away all of this as just a minor nuisance is silly. An attacker would have to find some unknown side channel or try to physically modify the TPM to get at the data, either approach means the attacker has significant resources, certainly well beyond the means of our hypothetical attacker. Heck, it's been speculated that even the NSA couldn't get data out of something like Apple's Secure Enclave without risking destroying it in an attempt.
- taneq 10y agoIf I were to put my evil hat on, I'd arrange for an innocent and not-very-well acquainted coworker to have their laptop outside away from cameras while I used it to siphon data off onto a USB drive. But I wouldn't, because I'm not evil.