6 ms·

I have a friend who works in a casino, and the industry standard is to put untrusted devices on a segregated network. Even trusted devices are segregated by ve

I have a friend who works in a casino, and the industry standard is to put untrusted devices on a segregated network. Even trusted devices are segregated by vendor.

icefox 9y ago
It would be nice if at home routers made this easy to do too
- StavrosK 9y ago
  Tomato makes this very easy. I've set up an "untrusted" network, devices in which can't connect anywhere, neither to local nor to remote machines (only I can connect to them).
- wil421 9y ago
  You can get Home routers that setup VLAN. Ubiquiti Edge Routers will do almost anything you need to do.
  - flyinghamster 9y ago
    I have one of those (but no Internet of Shit devices to segregate). Still, it's nice to know I can do so if I need to. Unfortunately, all is not rainbows and unicorns. Ubiquiti's GUI doesn't treat IPv6 as a first-class citizen; if you want IPv6 you need to head for the CLI and hope you hit upon the right recipe to enable it for your provider - and make sure you set up your firewall rules to only open IPv6 addresses/ports you want open.
  - danesparza 9y ago
    This is also a feature on Pfsense, or just about any high end router, switch, or firewall. The article asserts, "It expands the attack surface and most of this isn't covered by traditional defenses", which is bogus. It's just another device that doesn't need to be on the same network as critical services.
- itakedrugs 9y ago
  My router, the Asus RT-N66U can have multiple Wi-Fi guest networks with the default firmware.
giancarlostoro 9y ago
Industry standard is not always truly followed by everyone as seen here. Still can't believe this sounds like something out of Mr. Robot
- pnloyd 9y ago
  When I first saw the title I thought this was about extracting data from an air gapped network through some crazy thermometer enabled means. Truth seems to be much more mundane. Curious.. are there any recorded instances of air gapped networks being breached?
  - vuln 9y ago
    Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet
  - tim333 9y ago
    Not totally sure of the details but the dropped flash drive hack seems popular https://www.wired.com/2011/06/the-dropped-drive-hack/ https://www.wired.com/2011/06/the-dropped-drive-hack/ http://articles.latimes.com/2006/apr/10/world/fg-disks10 http://articles.latimes.com/2006/apr/10/world/fg-disks10
mistermann 9y ago
As someone who has used the web-based room reservation software for rewards members, I find this a bit hard to believe.
- mistermann 9y ago
  Uncanny the number of times I get precisely two downvotes.
bigiain 9y ago
Didn't that Wired article about the Jeep hack tell us something about how well that sometimes gets implemented? From memory, there was an "untrusted trusted entertainment system" network segment, and a firewall which allowed one-way traffic out of the "trusted" vehicle management network (so the entertainment system could get car speed and similar), and the firewall could have it's firmware updated. From the untrusted network segment...
- mfe5003 9y ago
  The problem with the entertainment system hack is that the can bus used in vehicles uses a priority system that is designed so that higher priority device can always claim the bus. If I remember correctly the entertainment system hack moved up the priority of the entertainment system on the bus so that it was higher priority than whatever nominally controls the car. A can bus isn't robust against bad actors and should have been air gapped to any external connection.
  - taneq 9y ago
    Priority doubles as ID in most CAN systems, so changing the priority means you're no longer sending the message to the same endpoint. As you say, though, CAN isn't secure against someone with physical access to the bus. IMO "the problem" isn't the CAN priority system, it's that a remotely programmable device (the CAN gateway) was connected to both the control network and the internet (via the entertainment center). For something so security critical, it should have been kept as dumb as a box of rocks, and certainly never made network-updatable.
mark-r 9y ago
That is an obvious and sound plan. It would be interesting to know how that broke down in this particular case.
- greglindahl 9y ago
  Yep. With the usual sorts of regulations, a casino can lose its license and be shut down for screwing up this kind of security. Compared to other sorts of businesses, casino regulation is very strict. I'd love to know how it played out.

I have a friend who works in a casino, and the industry standard is to put untrusted devices on a segregated network. Even trusted devices are segregated by vendor.

icefox 9y ago

It would be nice if at home routers made this easy to do too

StavrosK 9y ago
Tomato makes this very easy. I've set up an "untrusted" network, devices in which can't connect anywhere, neither to local nor to remote machines (only I can connect to them).
wil421 9y ago
You can get Home routers that setup VLAN. Ubiquiti Edge Routers will do almost anything you need to do.
- flyinghamster 9y ago
  I have one of those (but no Internet of Shit devices to segregate). Still, it's nice to know I can do so if I need to. Unfortunately, all is not rainbows and unicorns. Ubiquiti's GUI doesn't treat IPv6 as a first-class citizen; if you want IPv6 you need to head for the CLI and hope you hit upon the right recipe to enable it for your provider - and make sure you set up your firewall rules to only open IPv6 addresses/ports you want open.
- danesparza 9y ago
  This is also a feature on Pfsense, or just about any high end router, switch, or firewall. The article asserts, "It expands the attack surface and most of this isn't covered by traditional defenses", which is bogus. It's just another device that doesn't need to be on the same network as critical services.
itakedrugs 9y ago
My router, the Asus RT-N66U can have multiple Wi-Fi guest networks with the default firmware.

giancarlostoro 9y ago

Industry standard is not always truly followed by everyone as seen here. Still can't believe this sounds like something out of Mr. Robot

pnloyd 9y ago
When I first saw the title I thought this was about extracting data from an air gapped network through some crazy thermometer enabled means. Truth seems to be much more mundane. Curious.. are there any recorded instances of air gapped networks being breached?
- vuln 9y ago
  Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet
- tim333 9y ago
  Not totally sure of the details but the dropped flash drive hack seems popular https://www.wired.com/2011/06/the-dropped-drive-hack/ https://www.wired.com/2011/06/the-dropped-drive-hack/ http://articles.latimes.com/2006/apr/10/world/fg-disks10 http://articles.latimes.com/2006/apr/10/world/fg-disks10

mistermann 9y ago

As someone who has used the web-based room reservation software for rewards members, I find this a bit hard to believe.

mistermann 9y ago
Uncanny the number of times I get precisely two downvotes.

bigiain 9y ago

Didn't that Wired article about the Jeep hack tell us something about how well that sometimes gets implemented? From memory, there was an "untrusted trusted entertainment system" network segment, and a firewall which allowed one-way traffic out of the "trusted" vehicle management network (so the entertainment system could get car speed and similar), and the firewall could have it's firmware updated. From the untrusted network segment...

mfe5003 9y ago
The problem with the entertainment system hack is that the can bus used in vehicles uses a priority system that is designed so that higher priority device can always claim the bus. If I remember correctly the entertainment system hack moved up the priority of the entertainment system on the bus so that it was higher priority than whatever nominally controls the car. A can bus isn't robust against bad actors and should have been air gapped to any external connection.
- taneq 9y ago
  Priority doubles as ID in most CAN systems, so changing the priority means you're no longer sending the message to the same endpoint. As you say, though, CAN isn't secure against someone with physical access to the bus. IMO "the problem" isn't the CAN priority system, it's that a remotely programmable device (the CAN gateway) was connected to both the control network and the internet (via the entertainment center). For something so security critical, it should have been kept as dumb as a box of rocks, and certainly never made network-updatable.

mark-r 9y ago

That is an obvious and sound plan. It would be interesting to know how that broke down in this particular case.

greglindahl 9y ago
Yep. With the usual sorts of regulations, a casino can lose its license and be shut down for screwing up this kind of security. Compared to other sorts of businesses, casino regulation is very strict. I'd love to know how it played out.