5 ms·

> RSA executives told me that the part of their network responsible for manufacturing the SecurID hardware tokens was protected by an “air gap”—a total disconne

> RSA executives told me that the part of their network responsible for manufacturing the SecurID hardware tokens was protected by an “air gap”—a total disconnection of computers from any machine that touches the internet. But in fact, Leetham says, one server on RSA’s internet-connected network was linked, through a firewall that allowed no other connections, to the seed warehouse on the manufacturing side. That's not really an air gap, isn't it?

amackera 5y ago
Seems more like an attempted air gap :facepalm:
jaywalk 5y ago
"A firewall that only allows connections from one Internet-connected server" is quite literally not an air gap. It's one of those things that you look back on and wonder how in the world that decision was made.
- sterlind 5y ago
  seems totally unjustifiable to me. if they truly needed to keep backups of their customers' seeds, then send them through a data diode to an actually-airgapped tape deck. there's no reason to keep seeds on the machines where they were generated. ...also, since they detected the breach before the attackers got to the "seed warehouse," why did they try to tail them in real time? just pull power to the whole DC.
  - jaywalk 5y ago
    The only thing I can think of with the "tailing in real time" is that there was some journalistic license taken to spice up the story. Otherwise, you don't even need to pull power to the whole DC. Just cut off all Internet access.
jarym 5y ago
They must have meant the executives had an air gap between their ears.
dredmorbius 5y ago
That configuration is more typically referred to as a bastion server (or bastion host, per Wikipedia). Access between network segments, or to a protected host, is through a single specifically-hardened host. Through network traffic (natting or bridging) is typically disabled or at least not provided by default, though in practice, it's challenging to entirely prevent tunelling. But no, it is not an air-gapped system. Likely a journalistic compromise as "bastion host" is a less familiar term to the public. https://en.wikipedia.org/wiki/Bastion_host https://en.wikipedia.org/wiki/Bastion_host
- dredmorbius 5y ago
  ... and from the article, the description of "airgapped" apparently came from RSA management. That may have been their understanding. Todd Leetham pretty clearly understood otherwise.
PeterWhittaker 5y ago
As others have noted, no, it is not. But that doesn't boggle my mind... What boggles my mind is that the seed machine and the intervening network and the firewall did not appear to have "scream loudly then shutdown when this threshold is exceeded" mitigations in place. They were wise enough to have a single connection from the seed host to the seed requester. They were wise enough to limit the requester to one request every 15 minutes. They only discovered that threshold was being exceeded when they logged in to that machine. The firewall itself should have had detection and response capabilities to notice when calls were being made faster than that, and it should have had a third, dedicated warning connection to alert humans to the fact. The seed host should have had detection and response capabilities. And, given the value of the asset, it would have been entirely reasonable to have a transparent bit of network gear doing the same, like a custom switch invisible to the request host. Since the article didn't mention any of these things, and since it said that the high request rate was detected only by humans on the box, I'm going to assume they didn't have these, for reasons mysterious. EDIT: Come to think of it, since that machine was being used to burn CDs, there should also have been strict limits with appropriate detection mitigations on what that machine could do outbound.

amackera 5y ago

Seems more like an attempted air gap :facepalm:

jaywalk 5y ago

"A firewall that only allows connections from one Internet-connected server" is quite literally not an air gap. It's one of those things that you look back on and wonder how in the world that decision was made.

sterlind 5y ago
seems totally unjustifiable to me. if they truly needed to keep backups of their customers' seeds, then send them through a data diode to an actually-airgapped tape deck. there's no reason to keep seeds on the machines where they were generated. ...also, since they detected the breach before the attackers got to the "seed warehouse," why did they try to tail them in real time? just pull power to the whole DC.
- jaywalk 5y ago
  The only thing I can think of with the "tailing in real time" is that there was some journalistic license taken to spice up the story. Otherwise, you don't even need to pull power to the whole DC. Just cut off all Internet access.

jarym 5y ago

They must have meant the executives had an air gap between their ears.

dredmorbius 5y ago

That configuration is more typically referred to as a bastion server (or bastion host, per Wikipedia). Access between network segments, or to a protected host, is through a single specifically-hardened host. Through network traffic (natting or bridging) is typically disabled or at least not provided by default, though in practice, it's challenging to entirely prevent tunelling. But no, it is not an air-gapped system. Likely a journalistic compromise as "bastion host" is a less familiar term to the public. https://en.wikipedia.org/wiki/Bastion_host https://en.wikipedia.org/wiki/Bastion_host

dredmorbius 5y ago
... and from the article, the description of "airgapped" apparently came from RSA management. That may have been their understanding. Todd Leetham pretty clearly understood otherwise.

PeterWhittaker 5y ago

As others have noted, no, it is not. But that doesn't boggle my mind... What boggles my mind is that the seed machine and the intervening network and the firewall did not appear to have "scream loudly then shutdown when this threshold is exceeded" mitigations in place. They were wise enough to have a single connection from the seed host to the seed requester. They were wise enough to limit the requester to one request every 15 minutes. They only discovered that threshold was being exceeded when they logged in to that machine. The firewall itself should have had detection and response capabilities to notice when calls were being made faster than that, and it should have had a third, dedicated warning connection to alert humans to the fact. The seed host should have had detection and response capabilities. And, given the value of the asset, it would have been entirely reasonable to have a transparent bit of network gear doing the same, like a custom switch invisible to the request host. Since the article didn't mention any of these things, and since it said that the high request rate was detected only by humans on the box, I'm going to assume they didn't have these, for reasons mysterious. EDIT: Come to think of it, since that machine was being used to burn CDs, there should also have been strict limits with appropriate detection mitigations on what that machine could do outbound.