5 ms·

I think that you are too harsh. I don't know their other papers but the fact that they demonstrate such a cheap way to break the airgap has real world implicati

by yholio 6y ago

I think that you are too harsh. I don't know their other papers but the fact that they demonstrate such a cheap way to break the airgap has real world implications. You don't have to be an international spy agency with custom hardware listening to side channel noise, anybody with a WiFi card and the right know how can do it. This is significant, killing the WiFi card on your device is not enough to deter exfiltration even by the least sophisticated attackers. Yes, the attack is unidirectional, but that is not without value. Time and time again, the airgap has been breached from the outside, from stuxnet to various cryptocurrency heists. Security is about layers and there are many applications where the gap must me breached bidirectionally - this is an example of breaching one of those layers, indeed, the weaker inside-to-outside layer. You might also intentionally run untrusted code on an airgap, that could report back information about the environment or tests you perform on it. So, yes, predictable and not a danger by itself, but not without value and possibly a key component of an elaborated real world attack.

marcan_42 6y ago
You're mixing up two scenarios. The "international spy agency" scenario is using custom hardware listening to side channel noise from an untouched computer. That's stuff like decoding screen images from EMI from VGA/HDMI cables, or getting crypto keys from EMI from a CPU running standard code. That's what the whole TEMPEST thing was about decades ago. Those demos are interesting. We also use them in device security research, e.g. power or EMI analysis to extract crypto keys from a secure SoC. This guy just puts malware on the airgapped computer to force it to broadcast its secrets in the slowest, simplest, easiest to pick up way through some channel. That is not hard. His entire clickbait operation is basically predicated on the fact that people confuse these two scenarios, while they are two completely different things.
- giantg2 6y ago
  Exactly. It's impressive when the computer is untouched and air gapped. If you can load malware on the PC, you might as well just extract/copy the data while you're in there.
  - giantg2 6y ago
    Why is this downvoted?
  - ceejayoz 6y ago
    > If you can load malware on the PC, you might as well just extract/copy the data while you're in there. Not necessarily. There might be scenarios where you're permitted to bring software in, but not take anything out.
    - giantg2 6y ago
      Fair enough. You have to add taking in hardware too to read the signal.
      - ceejayoz 6y ago
        That hardware could be in the presumed-safe next room, though.
        giantg2 6y ago
        Assuming it's a strong/clean enough RF signal and they aren't using any countermeasures, sure.
        ceejayoz 6y ago
        The point is not "this will work in every scenario". The point is "this will work in some scenarios".
        giantg2 6y ago
        I'm not saying it can't work. My point is that it's unimpressive because it won't work very well for the types of targets that they are intending it for (air gapped systems usually have a lot of other countermeasures as part of their system, especially targeting unknown RF sources).
- deleted 6y ago
  [deleted]
studius 6y ago
> killing your WiFi device on your device is not enough to deter exfiltration even by the least sophisticated attackers. It may deter the least sophisticated attackers, assuming they are reliant on networking and the only way it's connected to the network is via WiFi. If the least sophisticated hackers just go in physically and steal the PC, then you're correct, though. > possibly a key component of an elaborated real world attack Yes, in the sense of key as "required", but the key to Stuxnet was being spread by USB stick, iirc, which could be the same here. The infection would need to start via some sort of direct access, unless it got to it earlier when it was connected, if ever. Note that this use of an integrated circuit to transmit isn't that innovative either. Oliver Mattos and Oskar Weigl wrote something similar in 2012 called PiFm, though that was a different radio band: https://web.archive.org/web/20121215032057/http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspberry_Pi_Into_an_FM_Transmitter https://web.archive.org/web/20121215032057/http://www.icrobo...
macksd 6y ago
It's definitely interesting if the concept is new to you, but there's quite a lot of work on this done already, decades ago, which should be known to those who care about securing airgapped machines. Here's a good place to start: https://en.m.wikipedia.org/wiki/Tempest_(codename) https://en.m.wikipedia.org/wiki/Tempest_(codename). I did a demo as an undergrad ~10 years ago playing music on the radio via leaked emissions from my netbook. Didn't have to write a line of code because a complete solution had already been freely available for quite some time. It's not without value, no, but they've definitely found a formula and are just cranking out variations of that formula as papers. I'd say calling it a paper mill isn't too harsh.
- jorangreef 6y ago
  "just cranking out variations of that formula as papers." You'd be surprised how often variations on a formula are all it takes to destroy security. Security is enumeration at the end of the day. If it takes a paper mill to "count all the ways" then I'm grateful.

by yholio 6y ago

marcan_42 6y ago

You're mixing up two scenarios. The "international spy agency" scenario is using custom hardware listening to side channel noise from an untouched computer. That's stuff like decoding screen images from EMI from VGA/HDMI cables, or getting crypto keys from EMI from a CPU running standard code. That's what the whole TEMPEST thing was about decades ago. Those demos are interesting. We also use them in device security research, e.g. power or EMI analysis to extract crypto keys from a secure SoC. This guy just puts malware on the airgapped computer to force it to broadcast its secrets in the slowest, simplest, easiest to pick up way through some channel. That is not hard. His entire clickbait operation is basically predicated on the fact that people confuse these two scenarios, while they are two completely different things.

giantg2 6y ago
Exactly. It's impressive when the computer is untouched and air gapped. If you can load malware on the PC, you might as well just extract/copy the data while you're in there.
- giantg2 6y ago
  Why is this downvoted?
- ceejayoz 6y ago
  > If you can load malware on the PC, you might as well just extract/copy the data while you're in there. Not necessarily. There might be scenarios where you're permitted to bring software in, but not take anything out.
  - giantg2 6y ago
    Fair enough. You have to add taking in hardware too to read the signal.
    - ceejayoz 6y ago
      That hardware could be in the presumed-safe next room, though.
      - giantg2 6y ago
        Assuming it's a strong/clean enough RF signal and they aren't using any countermeasures, sure.
        ceejayoz 6y ago
        The point is not "this will work in every scenario". The point is "this will work in some scenarios".
        giantg2 6y ago
        I'm not saying it can't work. My point is that it's unimpressive because it won't work very well for the types of targets that they are intending it for (air gapped systems usually have a lot of other countermeasures as part of their system, especially targeting unknown RF sources).
deleted 6y ago
[deleted]

studius 6y ago

> killing your WiFi device on your device is not enough to deter exfiltration even by the least sophisticated attackers. It may deter the least sophisticated attackers, assuming they are reliant on networking and the only way it's connected to the network is via WiFi. If the least sophisticated hackers just go in physically and steal the PC, then you're correct, though. > possibly a key component of an elaborated real world attack Yes, in the sense of key as "required", but the key to Stuxnet was being spread by USB stick, iirc, which could be the same here. The infection would need to start via some sort of direct access, unless it got to it earlier when it was connected, if ever. Note that this use of an integrated circuit to transmit isn't that innovative either. Oliver Mattos and Oskar Weigl wrote something similar in 2012 called PiFm, though that was a different radio band: https://web.archive.org/web/20121215032057/http://www.icrobotics.co.uk/wiki/index.php/Turning_the_Raspberry_Pi_Into_an_FM_Transmitter https://web.archive.org/web/20121215032057/http://www.icrobo...

macksd 6y ago

It's definitely interesting if the concept is new to you, but there's quite a lot of work on this done already, decades ago, which should be known to those who care about securing airgapped machines. Here's a good place to start: https://en.m.wikipedia.org/wiki/Tempest_(codename) https://en.m.wikipedia.org/wiki/Tempest_(codename). I did a demo as an undergrad ~10 years ago playing music on the radio via leaked emissions from my netbook. Didn't have to write a line of code because a complete solution had already been freely available for quite some time. It's not without value, no, but they've definitely found a formula and are just cranking out variations of that formula as papers. I'd say calling it a paper mill isn't too harsh.

jorangreef 6y ago
"just cranking out variations of that formula as papers." You'd be surprised how often variations on a formula are all it takes to destroy security. Security is enumeration at the end of the day. If it takes a paper mill to "count all the ways" then I'm grateful.