6 ms·

If it's airgapped, how do you use it for communication?

andai 10y ago
I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".
- danbruc 10y ago
  Have you considered light instead of sound, a simple optical link either through air or fiber? And it can be exploited in the same way it happens on any computer, somewhere in the path from reading the input through processing the message to sending the response is a bug and a specifically crafted sequence of inputs causes unintended things to happen, possibly allowing an attacker to execute arbitrary code. However, if you specifically build a very simple interface and application, then you can keep the attack surface small as compared to your average computer. There will be no programmable NIC, no hardware driver, no TCP/IP stack, and probably only a single application processing messages and using the interface. But this of course also depends heavily on the implementation. Controlling the GPIO pins of a Raspberry Pi with a Python application build on top of a Python library, Python, a GPIO driver and Linux provides quite a bit of attack surface. If you use a microcontroller and a hand full lines of assembly to poll input and drive output pins, then the attack surface becomes really small.
  - andai 10y ago
    Yes indeed! A few years ago I read about a project using infrared "lasers" for a LAN. (Can't find it now since the concept has become quite popular.) I only wish I was that badass... I can barely do C, let alone asm. I imagine attempting those now would only make the system less secure! haha. I'm just getting started with Arduino. I think I'll keep it simple for now :) I do plan to learn them (c/asm) some day, then I will be able to make the system even more secure. Thanks for the tips!
- mmcwilliams 10y ago
  I think that what imaginenore is suggesting is that if you are communicating between your public network-connected machine and your air gapped machine, there is no longer an air gap (barring some very specific use cases). The technique you're describing is actually an attack used to defeat security of machines not on untrusted networks[0]. [0] https://en.wikipedia.org/wiki/Air_gap_malware https://en.wikipedia.org/wiki/Air_gap_malware EDIT: This is specifically the method I was thinking of: http://www.jocm.us/index.php?m=content&c=index&a=show&catid=124&id=600 http://www.jocm.us/index.php?m=content&c=index&a=show&catid=...
  - andai 10y ago
    Ahh.. remember BadBIOS? :) It did need USB flash drives to spread though. (See BadUSB.. and weep!)
    - mmcwilliams 10y ago
      I do remember BadBIOS, though looking it up not it seems it might have been a hoax(?) or at least vaporware. Personally when I think of expertly hopping air gaps, stuxnet always comes to mind.
- andyjohnson0 10y ago
  Peer-to-peer IrLAN [1] is less prone to interference then sound, and being directional is harder to attack if the air-gap is small. Nowadays its probably obscure enough to make creating an exploit prohibitively expensive, even more so if you write your own drivers. With some electronics knowledge you could probably build your own simple transceivers too.
  - andai 10y ago
    Yes, I am considering precisely these kinds of solutions! There was an IR LAN project a while back (ten years?) but I can't remember the name (and the concept has skyrocketed in popularity making Googling difficult). Excellent suggestion :)
  - JshWright 10y ago
    How does an obscure transport help you if it's still just a LAN connection?
    - andai 10y ago
      In the scenario I am describing it would only ever be used to transmit ASCII for a cryptosystem. I do not require networking or internet or file transfer, just a low bitrate modem for text input and output.
- kevincox 10y ago
  Airgapped means it has no communication. But yes, in practice it is often useful to move data to and from. In a "perfect" airgap this would probably be you typing and reading the screen. However this isn't the most convient but the more things automatically accessing it the less security you will have. If you are going to connect it I won't bother maknig your own system and just use something standard (like ethernet) but now you have a firewalled system then an airgapped one.
  - andai 10y ago
    Yes, I also considered using text input, and then something like converting encrypted bytes into english words for ease of input. But I've noticed that not all my friends are very good at typing, so an automated solution is more user friendly... and a security solution that actually gets used is more secure than one that doesn't :)
  - JshWright 10y ago
    There are plenty of (proximity dependent) attacks that could leverage the monitor or keyboard you're using to passively collect information from the system. The only completely secure airgapped system is the one that's never powered on ;) (and kept physically safe).
- aurelianito 10y ago
  Then my notebook is 'airgapped'. It connects to internet via wifi :). More seriously, if it connects through non popular means (such as a protocol over sound) it is just security through obscurity.
  - giergirey 10y ago
    If andai is just connecting a full-function laptop to the internet with some ethernet-over-audio bridge, then you're right. But don't you think he has a point if he's talking about a simple, single-purpose device like an arduino - say - that can't connect to the internet, but allows keyboard entry of plaintext, then encrypts it, sends ciphertext to a PC via audio? I which case I think there are some advantages in using audio; if the device used wifi / ethernet / USB then you have to trust a lot of code to be exploit free: - ethernet driver code - wifi chip firmware - kernel network code - USB drivers etc Whereas if he's written his own simple bytes-to-audio converter in a few hundred lines of code that can be audited, then I can be be more easily convinced that it's not possible for an adversary to remotely install a keylogger or extract keys from my little encryption device.
- roywiggins 10y ago
  Honestly a floppy drive that you only connect to the raspi to transfer stuff is the only secure-ish way I can think of transferring data to your non-networked computer. Floppies are nice and dumb. If you want a persistent, networked connection then just use a serial cable, but then... you're not airgapped anymore.
- sitkack 10y ago
  Airgaps are not just the physical separation of systems, but also auditing and filtering of what goes on to the airgapped machine. One can get many of the properties of an air gapped system by compartmentalizing ones activities. Only playing media in the media-vm, only surfing the web in the web-vm, and only doing banking and high security stuff in the security-vm. Many of these systems wouldn't need persistent storage. And each one has different requirements, for the VM doing banking one could remove the root certs for everything except the sites you care about. Each VM could be on its own VPN, for the security-vm one could choose a network exit that was closest to the desired endpoint. Copying media files from a guest to the host would compromise the air gapped machine. The host should not do any general purpose computing and nor should there be an account with special administrator privileges. Look at https://www.qubes-os.org/ https://www.qubes-os.org/

andai 10y ago

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

danbruc 10y ago
Have you considered light instead of sound, a simple optical link either through air or fiber? And it can be exploited in the same way it happens on any computer, somewhere in the path from reading the input through processing the message to sending the response is a bug and a specifically crafted sequence of inputs causes unintended things to happen, possibly allowing an attacker to execute arbitrary code. However, if you specifically build a very simple interface and application, then you can keep the attack surface small as compared to your average computer. There will be no programmable NIC, no hardware driver, no TCP/IP stack, and probably only a single application processing messages and using the interface. But this of course also depends heavily on the implementation. Controlling the GPIO pins of a Raspberry Pi with a Python application build on top of a Python library, Python, a GPIO driver and Linux provides quite a bit of attack surface. If you use a microcontroller and a hand full lines of assembly to poll input and drive output pins, then the attack surface becomes really small.
- andai 10y ago
  Yes indeed! A few years ago I read about a project using infrared "lasers" for a LAN. (Can't find it now since the concept has become quite popular.) I only wish I was that badass... I can barely do C, let alone asm. I imagine attempting those now would only make the system less secure! haha. I'm just getting started with Arduino. I think I'll keep it simple for now :) I do plan to learn them (c/asm) some day, then I will be able to make the system even more secure. Thanks for the tips!
mmcwilliams 10y ago
I think that what imaginenore is suggesting is that if you are communicating between your public network-connected machine and your air gapped machine, there is no longer an air gap (barring some very specific use cases). The technique you're describing is actually an attack used to defeat security of machines not on untrusted networks[0]. [0] https://en.wikipedia.org/wiki/Air_gap_malware https://en.wikipedia.org/wiki/Air_gap_malware EDIT: This is specifically the method I was thinking of: http://www.jocm.us/index.php?m=content&c=index&a=show&catid=124&id=600 http://www.jocm.us/index.php?m=content&c=index&a=show&catid=...
- andai 10y ago
  Ahh.. remember BadBIOS? :) It did need USB flash drives to spread though. (See BadUSB.. and weep!)
  - mmcwilliams 10y ago
    I do remember BadBIOS, though looking it up not it seems it might have been a hoax(?) or at least vaporware. Personally when I think of expertly hopping air gaps, stuxnet always comes to mind.
andyjohnson0 10y ago
Peer-to-peer IrLAN [1] is less prone to interference then sound, and being directional is harder to attack if the air-gap is small. Nowadays its probably obscure enough to make creating an exploit prohibitively expensive, even more so if you write your own drivers. With some electronics knowledge you could probably build your own simple transceivers too.
- andai 10y ago
  Yes, I am considering precisely these kinds of solutions! There was an IR LAN project a while back (ten years?) but I can't remember the name (and the concept has skyrocketed in popularity making Googling difficult). Excellent suggestion :)
- JshWright 10y ago
  How does an obscure transport help you if it's still just a LAN connection?
  - andai 10y ago
    In the scenario I am describing it would only ever be used to transmit ASCII for a cryptosystem. I do not require networking or internet or file transfer, just a low bitrate modem for text input and output.
kevincox 10y ago
Airgapped means it has no communication. But yes, in practice it is often useful to move data to and from. In a "perfect" airgap this would probably be you typing and reading the screen. However this isn't the most convient but the more things automatically accessing it the less security you will have. If you are going to connect it I won't bother maknig your own system and just use something standard (like ethernet) but now you have a firewalled system then an airgapped one.
- andai 10y ago
  Yes, I also considered using text input, and then something like converting encrypted bytes into english words for ease of input. But I've noticed that not all my friends are very good at typing, so an automated solution is more user friendly... and a security solution that actually gets used is more secure than one that doesn't :)
- JshWright 10y ago
  There are plenty of (proximity dependent) attacks that could leverage the monitor or keyboard you're using to passively collect information from the system. The only completely secure airgapped system is the one that's never powered on ;) (and kept physically safe).
aurelianito 10y ago
Then my notebook is 'airgapped'. It connects to internet via wifi :). More seriously, if it connects through non popular means (such as a protocol over sound) it is just security through obscurity.
- giergirey 10y ago
  If andai is just connecting a full-function laptop to the internet with some ethernet-over-audio bridge, then you're right. But don't you think he has a point if he's talking about a simple, single-purpose device like an arduino - say - that can't connect to the internet, but allows keyboard entry of plaintext, then encrypts it, sends ciphertext to a PC via audio? I which case I think there are some advantages in using audio; if the device used wifi / ethernet / USB then you have to trust a lot of code to be exploit free: - ethernet driver code - wifi chip firmware - kernel network code - USB drivers etc Whereas if he's written his own simple bytes-to-audio converter in a few hundred lines of code that can be audited, then I can be be more easily convinced that it's not possible for an adversary to remotely install a keylogger or extract keys from my little encryption device.
roywiggins 10y ago
Honestly a floppy drive that you only connect to the raspi to transfer stuff is the only secure-ish way I can think of transferring data to your non-networked computer. Floppies are nice and dumb. If you want a persistent, networked connection then just use a serial cable, but then... you're not airgapped anymore.
sitkack 10y ago
Airgaps are not just the physical separation of systems, but also auditing and filtering of what goes on to the airgapped machine. One can get many of the properties of an air gapped system by compartmentalizing ones activities. Only playing media in the media-vm, only surfing the web in the web-vm, and only doing banking and high security stuff in the security-vm. Many of these systems wouldn't need persistent storage. And each one has different requirements, for the VM doing banking one could remove the root certs for everything except the sites you care about. Each VM could be on its own VPN, for the security-vm one could choose a network exit that was closest to the desired endpoint. Copying media files from a guest to the host would compromise the air gapped machine. The host should not do any general purpose computing and nor should there be an account with special administrator privileges. Look at https://www.qubes-os.org/ https://www.qubes-os.org/