5 ms·

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire,

by ohazi 9y ago

Can you really call it an air-gap if you're using a BLE radio? I mean, yes, technically the information is transferred over the air rather than through a wire, but you wouldn't call a cell-phone an air-gapped device because it has half a zillion radios inside, many of which you can't even reliably turn off. Looking at the recent Broadcom wifi vulnerability -- just having a phone sitting there with the radio on is enough to let an attacker gain root on some devices. I've generally seen the term "air-gap" used to mean "as isolated as possible" -- i.e. take apart a laptop and remove all networking hardware, microphones, speakers, fill all the ports with epoxy, and connect it to an isolated battery / power supply. If an attacker can poke at your device by sending it custom BLE packets without your knowledge, I'd argue that it doesn't qualify. From the video: The firefly is receive only, so it cannot be remotely hacked. Bullshit.

shannongreen 9y ago
The nRF24L01 is not really a BLE radio, though the modulation is effectively the same. It supports only a very simple protocol that is proprietary to Nordic Semi. In this case it looks like they're abusing it to sniff BLE advertising packets, but it wouldn't be able to do much else. I still agree that we shouldn't call it air-gapped, though.
- avian 9y ago
  You can send BLE advertisement packets with nRF24: http://dmitry.gr/index.php?r=05.Projects&proj=15&proj=11.+Bluetooth+LE+fakery http://dmitry.gr/index.php?r=05.Projects&proj=15&proj=11.+Bl...
azurelogic 9y ago
A more "air gap"-ish concept would have been a camera on the Firefly. Take a pic of a QR code on the phone, sign on the device, use the phone to take a pic of the output QR.
- grizzles 9y ago
  Another option would be to use a microphone and do an audiocap.
- icebraining 9y ago
  I'm sure an image could be generated that would crash the QR code recognizer.
  - jacobush 9y ago
    Sure? A possibility, but sure?
  - azurelogic 9y ago
    I'm just critiquing the air gap design/claim. Getting a malicious QR code in front of the camera would either require the attacker to gain physical access to the device, at which point it is game over for any device, or they would have to compromise the app presenting the first QR code. This would be a problem regardless of the air gap design for something like this, even if you had to enter the data by hand into the device.
    - DiThi 9y ago
      If I understood correctly, the wireless transmission is one way. So the attacker would ask the wallet to sign a transaction, then the confirm button would be mistakingly pressed... and you have to scan the screen to be able to send that transaction. Possible problem: The attacker sends a transaction at the same time (or just before) a legit one is sent. Not a big deal: The user is asked to send a specific quantity to a specific address on the screen. If somehow the user didn't check or the attacker fooled him with the same quantity etc, the picture still has to be taken and check it is the same transaction. Additionally, the wireless communication can have a second authentication factor.
deleted 9y ago
[deleted]
hackcasual 9y ago
Agreed. Call it "minimal threat surface," not airgapped. Air gapped means you as the user have total control over providing it data.
dang 9y ago
OK, we took 'air-gapped' out of the title above.
ge96 9y ago
faraday cage?
brianpgordon 9y ago
I had the same thought. The presenter takes pains to emphasize that it cannot transmit. Is that a software limitation or a hardware limitation? If it's just software that doesn't transmit during its normal operation, the wallet could still be vulnerable to a malicious payload that turns on the radio and sends data.
yebyen 9y ago
Another question about the "air-gap" I maybe am not understanding some part of the Ethereum protocol that is important to knowing how this can work... If the wallet is stored on the device, and the device can only receive payment requests over BLE and nothing else, and the device does not store the block chain, and the device does not have Wi-Fi to go out and ask for information about the block chain state, how can the device know its own balance, or know whether it has sufficient funds to sign a transaction? (Can it sign transactions that it can not immediately fulfill from the stored balances? Can they be used as IOUs?)

by ohazi 9y ago

shannongreen 9y ago

The nRF24L01 is not really a BLE radio, though the modulation is effectively the same. It supports only a very simple protocol that is proprietary to Nordic Semi. In this case it looks like they're abusing it to sniff BLE advertising packets, but it wouldn't be able to do much else. I still agree that we shouldn't call it air-gapped, though.

avian 9y ago
You can send BLE advertisement packets with nRF24: http://dmitry.gr/index.php?r=05.Projects&proj=15&proj=11.+Bluetooth+LE+fakery http://dmitry.gr/index.php?r=05.Projects&proj=15&proj=11.+Bl...

azurelogic 9y ago

A more "air gap"-ish concept would have been a camera on the Firefly. Take a pic of a QR code on the phone, sign on the device, use the phone to take a pic of the output QR.

grizzles 9y ago
Another option would be to use a microphone and do an audiocap.
icebraining 9y ago
I'm sure an image could be generated that would crash the QR code recognizer.
- jacobush 9y ago
  Sure? A possibility, but sure?
- azurelogic 9y ago
  I'm just critiquing the air gap design/claim. Getting a malicious QR code in front of the camera would either require the attacker to gain physical access to the device, at which point it is game over for any device, or they would have to compromise the app presenting the first QR code. This would be a problem regardless of the air gap design for something like this, even if you had to enter the data by hand into the device.
  - DiThi 9y ago
    If I understood correctly, the wireless transmission is one way. So the attacker would ask the wallet to sign a transaction, then the confirm button would be mistakingly pressed... and you have to scan the screen to be able to send that transaction. Possible problem: The attacker sends a transaction at the same time (or just before) a legit one is sent. Not a big deal: The user is asked to send a specific quantity to a specific address on the screen. If somehow the user didn't check or the attacker fooled him with the same quantity etc, the picture still has to be taken and check it is the same transaction. Additionally, the wireless communication can have a second authentication factor.

deleted 9y ago

[deleted]

hackcasual 9y ago

Agreed. Call it "minimal threat surface," not airgapped. Air gapped means you as the user have total control over providing it data.

dang 9y ago

OK, we took 'air-gapped' out of the title above.

ge96 9y ago

faraday cage?

brianpgordon 9y ago

I had the same thought. The presenter takes pains to emphasize that it cannot transmit. Is that a software limitation or a hardware limitation? If it's just software that doesn't transmit during its normal operation, the wallet could still be vulnerable to a malicious payload that turns on the radio and sends data.

yebyen 9y ago

Another question about the "air-gap" I maybe am not understanding some part of the Ethereum protocol that is important to knowing how this can work... If the wallet is stored on the device, and the device can only receive payment requests over BLE and nothing else, and the device does not store the block chain, and the device does not have Wi-Fi to go out and ask for information about the block chain state, how can the device know its own balance, or know whether it has sufficient funds to sign a transaction? (Can it sign transactions that it can not immediately fulfill from the stored balances? Can they be used as IOUs?)