3 ms·

Anyone know how practical these attacks are in the real world? Are they just an academic exercise or is there a real threat? One issue that jumps out at me is

Anyone know how practical these attacks are in the real world? Are they just an academic exercise or is there a real threat? One issue that jumps out at me is if the system is air-gapped, how does the malicious software get there in the first place without being detected?

bob1029 7y ago
I would say they are impractical if you have perfect physical security. Assuming your initial condition is that the air-gapped system is 100% clean to start with, you would need physical access at least one time to kick off the show for all of these crazy schemes.
- estebarb 7y ago
  Unless you control each and every provider is difficult to achieve perfect physical security. Most companies just bought the fans from somebody else.
tams 7y ago
Air gapping only means lack of network interfaces, so sneakernet is used to transmit data. And sneakernet (floppies back then) was the primary delivery medium for computer viruses before it was common for personal computers to have internet access.
pseudoramble 7y ago
In regard to your 2nd question, there are a few ways I'm aware of: 1. USB devices. If you need to move software from outside the air gap to inside, it's pretty easy to imagine somebody copying malicious software unintentionally through that. You might think that typical AV could detect it, but that could either be worked around, disabled by the operators of those systems, or simply not up-to-date because they're in the air gap. 2. Sometimes, air-gapped systems still have some kind of tunnel that allows an exceptional connection between a system outside the air gap. If you knew how to access that tunnel, you could effectively compromise the air gapped network. I'm sure there are more ways too. But those are a few I know off-hand.
mettamage 7y ago
If stuxnet [1] is a possibility, then yes, these attacks are a thing in the real world. They may be rare, but I think nation states are very interested in research like this for precisely the reason that this could happen to them. [1] Stuxnet had compromised airgapped computers
galacticaactual 7y ago
Consider the threat model for a moment. You have an airgapped machine, users who use that airgapped machine, and data that must get loaded onto the airgapped machine through some means. You need to land your malware on the machine so you need to understand the security posture of it to tailor proper evasions and which also align to your goals. Can you run with a simple recompiled Mimikatz or do you need to craft a custom multi-stage post-exploitation toolkit? The malware needs to be deployed via existing trusted means of data transfer so you need to understand what that trust model is and search for weaknesses you may exploit. Is data transfer as simple as plugging in a USB stick or are there multiple gating functions like signature verification, etc on adjacent systems before you can move to the primary? The data transfer is usually executed by a human being who must plug in some media with your malware on it either wittingly or unwittingly. The former requires working that human as an asset over a long term blackmail or HUMINT campaign. The latter involves compromising the supply chain that ends with executables being copied to the media vector. These are concentric circles of controls between you and that airgap - but each has a weakness. There are entire agencies and organizations who live, breath, and execute targeted searches for those weaknesses. So yes, in my opinion these are real threats IF an adversary that has the capability, time, and funding to perform the above falls within your organization's threat model.
afrcnc 7y ago
Wasn't this like one of Snowden's jobs at the CIA. Also, check out the Vault7 leaks for tools like these.
hutzlibu 7y ago
https://www.bleepingcomputer.com/news/security/new-magneto-and-odini-techniques-steal-data-from-faraday-cage-protected-equipment/ https://www.bleepingcomputer.com/news/security/new-magneto-a... "Banks regularly use Faraday-shielded rooms to protect servers." But they do not seem to be air gapped, as then the use of the data would be very limited. I would assume, the main interest in air gapped systems are top secret, high value research projects, as well as many secret agencies, who must assume, that their IT equipment comes with a backdoor installed at hardware level. Other ways of getting the virus in: at some point, the computer needs software and data. When the data comes in, so can a virus and uae a unknown zero day exploit.
ackbar03 7y ago
Except for the ultra slow data extraction part, all other aspects are feasible to a highly motivated state actor. There's a habit of stuxnet being raised as a catchall example of what can be done, but it really was a highly remarkable operation and also answers your second question. They basically infected all the vendors that had access to the airgapped machines for maintenance and got the software onto the machine through someone pluggin in their usb. I think it was said they actually ended up just planting/converting a mole in the vendors during access for more reliability but it's still quite extraordinary
imhoguy 7y ago
> if the system is air-gapped, how does the malicious software get there in the first place without being detected? USB pendrives, https://en.m.wikipedia.org/wiki/Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet

bob1029 7y ago

I would say they are impractical if you have perfect physical security. Assuming your initial condition is that the air-gapped system is 100% clean to start with, you would need physical access at least one time to kick off the show for all of these crazy schemes.

estebarb 7y ago
Unless you control each and every provider is difficult to achieve perfect physical security. Most companies just bought the fans from somebody else.

tams 7y ago

Air gapping only means lack of network interfaces, so sneakernet is used to transmit data. And sneakernet (floppies back then) was the primary delivery medium for computer viruses before it was common for personal computers to have internet access.

pseudoramble 7y ago

In regard to your 2nd question, there are a few ways I'm aware of: 1. USB devices. If you need to move software from outside the air gap to inside, it's pretty easy to imagine somebody copying malicious software unintentionally through that. You might think that typical AV could detect it, but that could either be worked around, disabled by the operators of those systems, or simply not up-to-date because they're in the air gap. 2. Sometimes, air-gapped systems still have some kind of tunnel that allows an exceptional connection between a system outside the air gap. If you knew how to access that tunnel, you could effectively compromise the air gapped network. I'm sure there are more ways too. But those are a few I know off-hand.

mettamage 7y ago

If stuxnet [1] is a possibility, then yes, these attacks are a thing in the real world. They may be rare, but I think nation states are very interested in research like this for precisely the reason that this could happen to them. [1] Stuxnet had compromised airgapped computers

galacticaactual 7y ago

Consider the threat model for a moment. You have an airgapped machine, users who use that airgapped machine, and data that must get loaded onto the airgapped machine through some means. You need to land your malware on the machine so you need to understand the security posture of it to tailor proper evasions and which also align to your goals. Can you run with a simple recompiled Mimikatz or do you need to craft a custom multi-stage post-exploitation toolkit? The malware needs to be deployed via existing trusted means of data transfer so you need to understand what that trust model is and search for weaknesses you may exploit. Is data transfer as simple as plugging in a USB stick or are there multiple gating functions like signature verification, etc on adjacent systems before you can move to the primary? The data transfer is usually executed by a human being who must plug in some media with your malware on it either wittingly or unwittingly. The former requires working that human as an asset over a long term blackmail or HUMINT campaign. The latter involves compromising the supply chain that ends with executables being copied to the media vector. These are concentric circles of controls between you and that airgap - but each has a weakness. There are entire agencies and organizations who live, breath, and execute targeted searches for those weaknesses. So yes, in my opinion these are real threats IF an adversary that has the capability, time, and funding to perform the above falls within your organization's threat model.

afrcnc 7y ago

Wasn't this like one of Snowden's jobs at the CIA. Also, check out the Vault7 leaks for tools like these.

hutzlibu 7y ago

https://www.bleepingcomputer.com/news/security/new-magneto-and-odini-techniques-steal-data-from-faraday-cage-protected-equipment/ https://www.bleepingcomputer.com/news/security/new-magneto-a... "Banks regularly use Faraday-shielded rooms to protect servers." But they do not seem to be air gapped, as then the use of the data would be very limited. I would assume, the main interest in air gapped systems are top secret, high value research projects, as well as many secret agencies, who must assume, that their IT equipment comes with a backdoor installed at hardware level. Other ways of getting the virus in: at some point, the computer needs software and data. When the data comes in, so can a virus and uae a unknown zero day exploit.

ackbar03 7y ago

Except for the ultra slow data extraction part, all other aspects are feasible to a highly motivated state actor. There's a habit of stuxnet being raised as a catchall example of what can be done, but it really was a highly remarkable operation and also answers your second question. They basically infected all the vendors that had access to the airgapped machines for maintenance and got the software onto the machine through someone pluggin in their usb. I think it was said they actually ended up just planting/converting a mole in the vendors during access for more reliability but it's still quite extraordinary

imhoguy 7y ago

> if the system is air-gapped, how does the malicious software get there in the first place without being detected? USB pendrives, https://en.m.wikipedia.org/wiki/Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet