6 ms·

As often happens, very nice, but of no practical use whatever, I mean first thing you have to BOTH infect the PC AND place a "magnetic receiver" within 100 cm,

by jaclaz 9y ago

As often happens, very nice, but of no practical use whatever, I mean first thing you have to BOTH infect the PC AND place a "magnetic receiver" within 100 cm, but the "magnetic receiver" needs anyway to transmit the data, and that is IMHO the unresolved problem, as this method of transmission would be easily detected (if electromagnetic/radio) or impossible to deploy (cable/wire) in 99.9999% of the "secure sites" where actually an air-gapped computer is used inside a faraday cage.

titzer 9y ago
The magnetic receiver could as well be under the floor, in the wall, in a picture, etc. It doesn't have to immediately transmit, either. It'd be easy enough to put 128gb flash on it and then come collect it later, sneaker-net style.
- ChuckMcM 9y ago
  This. Secure facilities might not be used 24/7/365 and so going in to collect the bug would be the mode used. It is yet another clever way to extract information and I expect to see CPU coolers with ferrite flux redirectors to appear at some point to counter it.
  - jandrese 9y ago
    Seems to me that if you're talking about smuggling hardware into a SCIF and installing exploits on the servers then doing this exotic form of data collection seems like overkill. There should be faster and more reliable options at that point, like turning the keyboard cable into a crude transmitter by banging bit patterns over it. I've never seen a SCIF where going in after hours is the "easy route". They're full of motion detectors and the entrance is typically a heavy metal door with a combination lock. The air ducts are too small to crawl through. :)
    - olivermarks 9y ago
      Currently the only way to exploit this would be a Hollywood style infiltration of a human, at which point a usb stick might be easier to use to get in and out quick... https://youtu.be/ar0xLps7WSY https://youtu.be/ar0xLps7WSY
  - jaclaz 9y ago
    > ... so going in to collect the bug would be the mode used. Well, the whole point is that it is supposedly a "secure" facility, so you may have the rare occasion to enter it again, after having beeen exceptionally been able to access it once to install the software (since you cannot install it remotely due to the air gap and faraday cage even if you can get access and by-pass firewalls and/or data-diodes) and deploy the receiver with flash under the floor (no pictures are allowed on walls of a "secure" facility, and someone may notice a fresh patch of plaster on the wall[1]), in order to gather the data next year, on the 4th of July, not exactly "in a timely fashion". [1] And no, it is not like any "secure" facility is confining with an easily accessible area, the walls are normally reinforced concrete and with no less than 30-40 cm thickness.
    - hobs 9y ago
      Depends on how things come in and out, who built the facility, etc. It's not the first time things like this have happened http://www.cryptomuseum.com/covert/bugs/selectric/index.htm http://www.cryptomuseum.com/covert/bugs/selectric/index.htm
    - ChuckMcM 9y ago
      First, I've never been in a SCIF as far as I know. That said, one of the history classes at USC was "Espionage and Terrorism" (which was a killer History elective if you were an engineering major) and the professor discusses various tradecraft strategies. One of which is local recording. Because "bugs" that transmit are susceptible to being sniffed by RF signal detectors, opponents would disguise devices which could record their environment, and figure out ways to 'leave' them in places of interest and recover them later. Because I've not been in a SCIF I don't know if it gets janitorial service or any regular maintenance at all but if it did, then that might be how this might work. Mostly I was responding to the challenge of "it's only 100cm and you can't transmit anyway" assertion that the vulnerability was not exploitable. I'm expect someone could figure out how to exploit it.
      - jaclaz 9y ago
        >First, I've never been in a SCIF as far as I know. Well, several years ago I have actually built a couple of them (actually something very similar to them, the term SCIF is US) for the military here in Italy. Though admittedly not - at least from the construction specs - to be used for this kind of air-gapped computing, they were either a "safe conference room" or a (very large) "storing safe" (to store paper documents and/or weapons). I have no idea which security measures/protocols were later employed to limit access to them, of course, but there were a number of safety features that would make physical access by any means seemingly impossible. Of course if you could impersonate someone else authorized or if you can bribe someone with legitimate access, than any construction/safety measure would be m00t, but then if you can obtain that kind of access it would be easier to simply get the data from the computer.
djtriptych 9y ago
This sort of exploit is attractive to state actors with virtually unlimited budgets. For them, it might be quite practical. The CIA has been toying with insect-sized remote controllable flying vehicles for decades. Stick a USB stick and magnetic receiver on one of them and you've basically got your exploit. You and I wouldn't spend 20 man-years and $50 million to do that, but our government definitely would if there were a chance to, say, disrupt Iran's nuclear ambitions for a few months.
- conbandit 9y ago
  easier to just write stuxnet
mirimir 9y ago
Yes. And properly secured air-gapped devices don't get malware.

by jaclaz 9y ago

titzer 9y ago

The magnetic receiver could as well be under the floor, in the wall, in a picture, etc. It doesn't have to immediately transmit, either. It'd be easy enough to put 128gb flash on it and then come collect it later, sneaker-net style.

ChuckMcM 9y ago
This. Secure facilities might not be used 24/7/365 and so going in to collect the bug would be the mode used. It is yet another clever way to extract information and I expect to see CPU coolers with ferrite flux redirectors to appear at some point to counter it.
- jandrese 9y ago
  Seems to me that if you're talking about smuggling hardware into a SCIF and installing exploits on the servers then doing this exotic form of data collection seems like overkill. There should be faster and more reliable options at that point, like turning the keyboard cable into a crude transmitter by banging bit patterns over it. I've never seen a SCIF where going in after hours is the "easy route". They're full of motion detectors and the entrance is typically a heavy metal door with a combination lock. The air ducts are too small to crawl through. :)
  - olivermarks 9y ago
    Currently the only way to exploit this would be a Hollywood style infiltration of a human, at which point a usb stick might be easier to use to get in and out quick... https://youtu.be/ar0xLps7WSY https://youtu.be/ar0xLps7WSY
- jaclaz 9y ago
  > ... so going in to collect the bug would be the mode used. Well, the whole point is that it is supposedly a "secure" facility, so you may have the rare occasion to enter it again, after having beeen exceptionally been able to access it once to install the software (since you cannot install it remotely due to the air gap and faraday cage even if you can get access and by-pass firewalls and/or data-diodes) and deploy the receiver with flash under the floor (no pictures are allowed on walls of a "secure" facility, and someone may notice a fresh patch of plaster on the wall[1]), in order to gather the data next year, on the 4th of July, not exactly "in a timely fashion". [1] And no, it is not like any "secure" facility is confining with an easily accessible area, the walls are normally reinforced concrete and with no less than 30-40 cm thickness.
  - hobs 9y ago
    Depends on how things come in and out, who built the facility, etc. It's not the first time things like this have happened http://www.cryptomuseum.com/covert/bugs/selectric/index.htm http://www.cryptomuseum.com/covert/bugs/selectric/index.htm
  - ChuckMcM 9y ago
    First, I've never been in a SCIF as far as I know. That said, one of the history classes at USC was "Espionage and Terrorism" (which was a killer History elective if you were an engineering major) and the professor discusses various tradecraft strategies. One of which is local recording. Because "bugs" that transmit are susceptible to being sniffed by RF signal detectors, opponents would disguise devices which could record their environment, and figure out ways to 'leave' them in places of interest and recover them later. Because I've not been in a SCIF I don't know if it gets janitorial service or any regular maintenance at all but if it did, then that might be how this might work. Mostly I was responding to the challenge of "it's only 100cm and you can't transmit anyway" assertion that the vulnerability was not exploitable. I'm expect someone could figure out how to exploit it.
    - jaclaz 9y ago
      >First, I've never been in a SCIF as far as I know. Well, several years ago I have actually built a couple of them (actually something very similar to them, the term SCIF is US) for the military here in Italy. Though admittedly not - at least from the construction specs - to be used for this kind of air-gapped computing, they were either a "safe conference room" or a (very large) "storing safe" (to store paper documents and/or weapons). I have no idea which security measures/protocols were later employed to limit access to them, of course, but there were a number of safety features that would make physical access by any means seemingly impossible. Of course if you could impersonate someone else authorized or if you can bribe someone with legitimate access, than any construction/safety measure would be m00t, but then if you can obtain that kind of access it would be easier to simply get the data from the computer.

djtriptych 9y ago

This sort of exploit is attractive to state actors with virtually unlimited budgets. For them, it might be quite practical. The CIA has been toying with insect-sized remote controllable flying vehicles for decades. Stick a USB stick and magnetic receiver on one of them and you've basically got your exploit. You and I wouldn't spend 20 man-years and $50 million to do that, but our government definitely would if there were a chance to, say, disrupt Iran's nuclear ambitions for a few months.

conbandit 9y ago
easier to just write stuxnet

mirimir 9y ago

Yes. And properly secured air-gapped devices don't get malware.