4 ms·

Years ago I was in the same building during the installation of a "NATO standard" (whatever that means) environment suitable for developing sensitive software,

Years ago I was in the same building during the installation of a "NATO standard" (whatever that means) environment suitable for developing sensitive software, and the air gap was indeed pretty large, the entire 2 rooms were air gapped from the building (at 4th floor), enclosed in a Faraday cage and with special precautions (out of my clearance level) for electricity going in. It was very quiet inside (even cell phone did not have any signal, of course).

netsharc 9y ago
Hopefully cellphones weren't allowed? Otherwise it would be interesting to hack the phone to go to "record AM signals" if there's no cell/wifi/FM/GPS signals (if it were on a plane it would still see GPS signals). Or maybe to announce its presence using ultrasonic, so if there's also compromised machines/CPUs/hypervisor environments inside the secured environment, it would detect the "Hello" and start uploading data to it. Later when the phone user reconnects to the cell network, it can upload your secret data..
- gtufano 9y ago
  Of course they were forbidden, as it was every not authorized device. The physical security was tight. I just entered it during the building, before the certification (I was in a manager role in the building)
- meatmanek 9y ago
  Have you seen the GSMem paper? They demonstrate pretty much exactly what you've proposed: https://www.usenix.org/node/190937 https://www.usenix.org/node/190937
DKnoll 9y ago
https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename)
exikyut 9y ago
I'm very curious (from an academic thought-experiment standpoint) what sorts of mitigations could be used for electrical lines in an environment like this. My first thought - an alternate reality where you could turn power to (say) 100kW of light and then back again - would actually not be enough, as light can be pulsed so rapidly we're already using it to encode data. Welp. I'm guessing that UPS-type equipment was used as a form of powerline isolation, at least.
- beached_whale 9y ago
  My understanding is that what capacitors would mitigate. Computers run on DC.
closeparen 9y ago
A surprising amount of detail about SCIFs is public available [0]. [0] https://www.wbdg.org/FFC/DOD/UFC/ufc_4_010_05_2013_c1.pdf https://www.wbdg.org/FFC/DOD/UFC/ufc_4_010_05_2013_c1.pdf

netsharc 9y ago

Hopefully cellphones weren't allowed? Otherwise it would be interesting to hack the phone to go to "record AM signals" if there's no cell/wifi/FM/GPS signals (if it were on a plane it would still see GPS signals). Or maybe to announce its presence using ultrasonic, so if there's also compromised machines/CPUs/hypervisor environments inside the secured environment, it would detect the "Hello" and start uploading data to it. Later when the phone user reconnects to the cell network, it can upload your secret data..

gtufano 9y ago
Of course they were forbidden, as it was every not authorized device. The physical security was tight. I just entered it during the building, before the certification (I was in a manager role in the building)
meatmanek 9y ago
Have you seen the GSMem paper? They demonstrate pretty much exactly what you've proposed: https://www.usenix.org/node/190937 https://www.usenix.org/node/190937

DKnoll 9y ago

https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename)

exikyut 9y ago

I'm very curious (from an academic thought-experiment standpoint) what sorts of mitigations could be used for electrical lines in an environment like this. My first thought - an alternate reality where you could turn power to (say) 100kW of light and then back again - would actually not be enough, as light can be pulsed so rapidly we're already using it to encode data. Welp. I'm guessing that UPS-type equipment was used as a form of powerline isolation, at least.

beached_whale 9y ago
My understanding is that what capacitors would mitigate. Computers run on DC.

closeparen 9y ago

A surprising amount of detail about SCIFs is public available [0]. [0] https://www.wbdg.org/FFC/DOD/UFC/ufc_4_010_05_2013_c1.pdf https://www.wbdg.org/FFC/DOD/UFC/ufc_4_010_05_2013_c1.pdf