5 ms·

The only valid safety model is airgapped computers, stripped of any networking equipment, fed data only using dedicated thumbdrives coming from another computer

by 1996 8y ago

The only valid safety model is airgapped computers, stripped of any networking equipment, fed data only using dedicated thumbdrives coming from another computer running a different OS VM are a problem waiting to happen.

craftyguy 8y ago
Considering all of the issues with usb, you'd be better off using floppy disks or optical drives for data transfer to this hypothetical 'secure' system. > VM are a problem waiting to happen. Something something security threat model and personal risk tolerance...
- 1996 8y ago
  The problem of optical drives is the size limit and the time to make them. They can contain malicious code just as well as a thumbdrive. The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code. Purchasing many similar drives of a well known brand in a random supermarket is a reasonable alternative. Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid.
  - craftyguy 8y ago
    > They can contain malicious code just as well as a thumbdrive Of course. > The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code. Right, that's the concern I was alluding to above. You'd still be better off burning optical media (and disabling any autoplay crap on the target system). You can still store severl GB of data on optical media. > Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid. This may work if you only stick with very popular makes/models, since they would have a higher chance of being 'noticed' for doing something wrong.
    - 1996 8y ago
      > This may work if you only stick with very popular makes/models, since they would have a higher chance of being 'noticed' for doing something wrong Security is in the spotlight, not in the shadows Prefer tools that everyone else uses, unless you have a very compelling reason not to (windows: too many 0 days, complexity, and surface of attack ; wifi: too easy to start a rogue network) Because when these popular tools get hacked, you will know it. I keep an eye on rogue firmware. I have not seen a real world threat yet, but I do expect spear fishing attacks for people involved in crypto (fortunately, not for us just writing software)
- white-flame 8y ago
  RS232 would probably be usable and convenient for said hypothetical setup as well. Don't run PPP or anything; manually initiate transfers on both sides.
  - astrodust 8y ago
    You can pop a box over serial if that serial connection allows you to execute arbitrary code. Buffer overflows happen in surprising places.
    - wahern 8y ago
      Of course. But the baseline stack of hardware and software for RS232 is (or at least can be) significantly simpler. USB and Ethernet are nightmares by comparison, and that's before considering the additional protocols that invariably sit between those low-level transports and your application. For a project idea I've been considering how to attach a sensitive (but powerful) machine to the network with the smallest possible interface (in terms of code exposure). RS232 is probably the simplest yet still functional without getting into niche hardware standards. On balance I think USB might be worse than Ethernet[2] or even Ethernet+TCP/IP just because typical network stacks have probably seen more scrutiny than USB stacks. But at the end of the day I know I'm going to want to use something like seL4 to protect the application from the transport stack(s). And even then you still have to worry about the hardware. There's a real dilemma in choosing the simplest hardware that is still viable in terms of performance, support (including ease of porting or writing drivers), and long-term availability. [1] Assuming a simple ethernet controller with all the fancy features disabled or, ideally, not even present.
      - astrodust 8y ago
        Remember that someone found out how to exploit the Nintendo NES using only the official controller just by pressing buttons at very specific times. https://arstechnica.com/gaming/2015/01/pokemon-plays-twitch-how-a-robot-got-irc-running-on-an-unmodified-snes/ https://arstechnica.com/gaming/2015/01/pokemon-plays-twitch-...
Piskvorrr 8y ago
Valid against what threat? As seen with Stuxnet, even that is not enough...if your opponent is determined enough.
- 1996 8y ago
  Employees can be a threat, yes. Ideally, the ports to connect data should be non standard - or just glued shut. Or have no employee! The problem with stuxnet was that non dedicated thumbdrive brought in the worm. Also their equipment was networked. Bad idea. If data must be exchanged, use unidirectional links. Good old serial ports, with only TX or RX wired (Edit: I do not think centrifuges need a full ethernet stack. Depending on high level abstractions like TCP/IP for simple operations comes at a cost) My model is not perfect safety, but if it take something the scale of stuxnet to attack, I feel safe enough. I laughed when the recent spectre and meltdown exploits were revealed, because the good old airgap model meant I did not have to care.
  - bcoates 8y ago
    It's a SCADA system coordinating thousands of centrifuges, if it's not networked you may as well turn it off!
  - astrodust 8y ago
    Yes, I'm sure it's practical to manage thousands of centrifuges without networking.
googlemyfomato 8y ago
You forgot to not use anything from Intel post 2008 (or whenever ME was introduced), and any other processors like that. Afterall there "could" be a wireless chip within the ME hardware. (I know there isn't, I'm just playing overly paranoid)
- AstralStorm 8y ago
  Not in there, but if you have an Intel wireless chipset ME will happily use it.

by 1996 8y ago

craftyguy 8y ago

Considering all of the issues with usb, you'd be better off using floppy disks or optical drives for data transfer to this hypothetical 'secure' system. > VM are a problem waiting to happen. Something something security threat model and personal risk tolerance...

1996 8y ago
The problem of optical drives is the size limit and the time to make them. They can contain malicious code just as well as a thumbdrive. The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code. Purchasing many similar drives of a well known brand in a random supermarket is a reasonable alternative. Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid.
- craftyguy 8y ago
  > They can contain malicious code just as well as a thumbdrive Of course. > The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code. Right, that's the concern I was alluding to above. You'd still be better off burning optical media (and disabling any autoplay crap on the target system). You can still store severl GB of data on optical media. > Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid. This may work if you only stick with very popular makes/models, since they would have a higher chance of being 'noticed' for doing something wrong.
  - 1996 8y ago
    > This may work if you only stick with very popular makes/models, since they would have a higher chance of being 'noticed' for doing something wrong Security is in the spotlight, not in the shadows Prefer tools that everyone else uses, unless you have a very compelling reason not to (windows: too many 0 days, complexity, and surface of attack ; wifi: too easy to start a rogue network) Because when these popular tools get hacked, you will know it. I keep an eye on rogue firmware. I have not seen a real world threat yet, but I do expect spear fishing attacks for people involved in crypto (fortunately, not for us just writing software)
white-flame 8y ago
RS232 would probably be usable and convenient for said hypothetical setup as well. Don't run PPP or anything; manually initiate transfers on both sides.
- astrodust 8y ago
  You can pop a box over serial if that serial connection allows you to execute arbitrary code. Buffer overflows happen in surprising places.
  - wahern 8y ago
    Of course. But the baseline stack of hardware and software for RS232 is (or at least can be) significantly simpler. USB and Ethernet are nightmares by comparison, and that's before considering the additional protocols that invariably sit between those low-level transports and your application. For a project idea I've been considering how to attach a sensitive (but powerful) machine to the network with the smallest possible interface (in terms of code exposure). RS232 is probably the simplest yet still functional without getting into niche hardware standards. On balance I think USB might be worse than Ethernet[2] or even Ethernet+TCP/IP just because typical network stacks have probably seen more scrutiny than USB stacks. But at the end of the day I know I'm going to want to use something like seL4 to protect the application from the transport stack(s). And even then you still have to worry about the hardware. There's a real dilemma in choosing the simplest hardware that is still viable in terms of performance, support (including ease of porting or writing drivers), and long-term availability. [1] Assuming a simple ethernet controller with all the fancy features disabled or, ideally, not even present.
    - astrodust 8y ago
      Remember that someone found out how to exploit the Nintendo NES using only the official controller just by pressing buttons at very specific times. https://arstechnica.com/gaming/2015/01/pokemon-plays-twitch-how-a-robot-got-irc-running-on-an-unmodified-snes/ https://arstechnica.com/gaming/2015/01/pokemon-plays-twitch-...

Piskvorrr 8y ago

Valid against what threat? As seen with Stuxnet, even that is not enough...if your opponent is determined enough.

1996 8y ago
Employees can be a threat, yes. Ideally, the ports to connect data should be non standard - or just glued shut. Or have no employee! The problem with stuxnet was that non dedicated thumbdrive brought in the worm. Also their equipment was networked. Bad idea. If data must be exchanged, use unidirectional links. Good old serial ports, with only TX or RX wired (Edit: I do not think centrifuges need a full ethernet stack. Depending on high level abstractions like TCP/IP for simple operations comes at a cost) My model is not perfect safety, but if it take something the scale of stuxnet to attack, I feel safe enough. I laughed when the recent spectre and meltdown exploits were revealed, because the good old airgap model meant I did not have to care.
- bcoates 8y ago
  It's a SCADA system coordinating thousands of centrifuges, if it's not networked you may as well turn it off!
- astrodust 8y ago
  Yes, I'm sure it's practical to manage thousands of centrifuges without networking.

googlemyfomato 8y ago

You forgot to not use anything from Intel post 2008 (or whenever ME was introduced), and any other processors like that. Afterall there "could" be a wireless chip within the ME hardware. (I know there isn't, I'm just playing overly paranoid)

AstralStorm 8y ago
Not in there, but if you have an Intel wireless chipset ME will happily use it.