10 ms·

Jumping the Air Gap: 15 Years of Nation-State Effort [pdf]

70 points by shishy 5y ago

chrisseaton 5y ago
I feel like the first person in security who used the term 'nation-state' read it somewhere but didn't know what it meant and now it's meaningless.
- deleted 5y ago
  [deleted]
- whatshisface 5y ago
  It's a joke. Nation-State Adversary... get it?
  - chrisseaton 5y ago
    Not sure that adds up as a theory - they don't use that phrase, the US isn't a nation-state, and Vault 7 wasn't the NSA anyway was it?
    - whatshisface 5y ago
      It's an old joke.
- jcrawfordor 5y ago
  From my experience in the industry my guess is that the term originated in the US to resolve the ambiguity of the term "state" here. "State actor" is really what's meant, but to many US listeners would not necessarily imply a "top level" sovereign. Yes, that probably came out of a misunderstanding of the meaning of the term "nation-state," but I think the number of people who know the correct definition of the term is really pretty small.
- perl4ever 5y ago
  I feel like I see people being pedantic about "nation-state" and how the US isn't one quite frequently in the last few years and while it's not something that can be proven in an airtight manner, it's bordering on some sort of political statement to insist. It seems that the UK, Israel, and Pakistan are considered nation-states. Is the US more like them, or more like the Ottoman Empire? Saying that the US is obviously not a nation-state, seems like denying that there is an American identity the way that there is an Israeli one.
  - chrisseaton 5y ago
    The UK is a typical example of something that isn’t a nation-state - it explicitly has ‘the nations’ within it. The US also formally recognises multiple nations within it such as the Navajo Nation. But for example a country like Japan doesn’t formally recognise nations within it (as far as I know?) and is a typical example of a nation-state.
    - perl4ever 5y ago
      My point is just that rampant pedantry implies anyone who isn't one of the "ignorant masses" agrees on the consensus classification method. In reality, there is no consensus, as you prove here by confidently categorizing countries differently from others. “We demand rigidly defined areas of doubt and uncertainty!”
      - chrisseaton 5y ago
        It's like saying '2013 blue Ford Fusion' and then when someone points out it's actually a green Dodge complaining that they're being pedantic. Why be so bizarrely overly specific? Would have been less work to be more generic.
  - seoaeu 5y ago
    Pedantically, the word "nation" in nation-state refers to a specific grouping of people. One which has a single shared history, ethnicity, culture, etc. The US is multicultural with citizens from a diverse range of ethnic backgrounds, so under that definition it doesn't qualify
- odiroot 5y ago
  It's a diplomatic way to say rogue/hostile state. An attempt to make the statement less political.
- helsinkiandrew 5y ago
  In this context doesn't it mean "have one or more organisations that are scoped with gaining this kind of access for military, economic, or prestige both online and in the physical world, and have almost unlimited resources". Nothing to do with national identity or how the people in that nation feel about their country, government, each other or themselves.
sounds 5y ago
The executive summary is worth the 1-minute read. Interesting that all the malicious frameworks known (by ESET) that target air-gapped networks were for some form of espionage.
- SQueeeeeL 5y ago
  "Air-gapping is used to protect the most sensitive of networks. In the first half of 2020 alone, four previously unknown malicious frameworks designed to breach air-gapped networks were publicly documented. ESET Research decided to revisit each framework known to date and to put them in perspective, side by side. Here are the key findings stemming from this exhaustive study: • All the frameworks are designed to perform some form of espionage. • All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks. • We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals. • Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network. • More than 10—critical severity—LNK-related remote code execution vulnerabilities in Windows have been discovered, then patched by Microsoft, in the last 10 years. • All the frameworks were built to attack Windows systems. We have not found any evidence of actual or suspected malware components built to target other operating systems. In this white paper, we will describe how malware frameworks targeting air-gapped networks operate, and provide a side-by-side comparison of their most important TTPs. We also propose a series of detection and mitigation techniques to protect air-gapped networks from the main techniques used by all the mali- cious frameworks publicly known to date."
  - lucb1e 5y ago
    Bullet points require a blank line to be separated on HN (this happens to a lot of people): --- Air-gapping is used to protect the most sensitive of networks. In the first half of 2020 alone, four previously unknown malicious frameworks designed to breach air-gapped networks were publicly documented. ESET Research decided to revisit each framework known to date and to put them in perspective, side by side. Here are the key findings stemming from this exhaustive study: • All the frameworks are designed to perform some form of espionage. • All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks. • We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals. • Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network. • More than 10—critical severity—LNK-related remote code execution vulnerabilities in Windows have been discovered, then patched by Microsoft, in the last 10 years. • All the frameworks were built to attack Windows systems. We have not found any evidence of actual or suspected malware components built to target other operating systems. In this white paper, we will describe how malware frameworks targeting air-gapped networks operate, and provide a side-by-side comparison of their most important TTPs. We also propose a series of detection and mitigation techniques to protect air-gapped networks from the main techniques used by all the malicious frameworks publicly known to date.
jonathankoren 5y ago
>Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network. I don't get why autorun was created. It's an obvious security issue.
- catlikesshrimp 5y ago
  Convenience. Security is bothersome, anyways /s.
- chrisseaton 5y ago
  > It's an obvious security issue. Probably legitimately wasn't at the time! The general landscape and security issues and reasonable concerns just weren't the same. Of course it's as clearly insane as giving pregnant women beer in maternity wards now, but wasn't at the time.
  - phaedrus 5y ago
    We already had viruses on DOS before CDs existed. The fact CDs supported autorun and Microsoft programmed Windows to have that feature on by default was mind-blowingly stupid and an obvious vector for viruses even at the time Windows 95 was new.
    - chrisseaton 5y ago
      > We already had viruses on DOS before CDs existed. But they weren't a credible threat that was significant enough to be worth worrying about. We already have guns, but I don't do anything to protect myself against gun attack. It wouldn't be worth the time or effort or inconvenience for the level of threat. Maybe in thirty years we'll live in a dystopia and it'll be laughable that I went around unprotected against guns? But for today it's reasonable to ignore.
- KZerda 5y ago
  When Autorun, and Windows 95, were being developed, CD-Rs were multi-thousand dollar machines with media that cost $15+/disc, and USB was still being hashed out in the research labs. As such, the only real removable media that would have been used under Autorun would have been professionally mastered CDs, which had a $450+ minimum outlay for a master, and usually a minimum lot size atop of that, which was more than most people up to no good would have been willing to spend. Yes, as Autorun became a more viable attack vector, more protections should have been put in place, but in 1995, it was pretty low-risk.
pstuart 5y ago
> All the frameworks were built to attack Windows systems. Well there you go. Perhaps using an OpenBSD USB bastion is the way to go.
- hulitu 5y ago
  It will certainly make it harder for the attacker.
ur-whale 5y ago
TL;DR: - only targets windows - only uses USB drives The rest of the article dives into windows highly specific exploits and therefore lacks in generality.
- schoen 5y ago
  I guess air-gapped Windows machines are the biggest targets for governments and in any case the biggest interest of malware researchers. Elsewhere in the malwareverse, most botnets are made up only of Windows machines, even though some are not, and even though non-Windows machines certainly need to be protected. So, these exploits are the ones that have come to light recently. I was a little surprised to read that air-gapped machines are so often used in conjunction with removable media. That just doesn't feel like a good idea because of all the attack surface. On the other hand, the article implicitly gives some interesting ideas for how one could reduce that attack surface by removing software, drivers, and other functionality from an airgapped device. For example, I think there are ways in Linux that we can say that a USB interface should only accept devices of a certain USB class (and perhaps it would be helpful in a different way to say "class and manufacturer ID"), and also that only one kind of filesystem should be mountable, and you can say that it shouldn't be possible to execute a binary directly from that filesystem. Combining these things, you could say that a machine should only accept FAT16 mounting of a mass storage device made by Kingston, and ignore anything else. I don't know if you can specify that kind of stuff in Windows, but it would be pretty valuable for this application!
  - hulitu 5y ago
    > I was a little surprised to read that air-gapped machines are so often used in conjunction with removable media. That just doesn't feel like a good idea because of all the attack surface. Our IT is also surprised. Unless the "air gaped machine" will run only one program which will never change, you need a way to transfer SW to this machine. And like our IT: we do not need CDROMs, every computer has an USB port. And from a (deranged) security perspective a CDROM id equal with an USB stick.
  - detaro 5y ago
    Windows also can limit the USB devices connected (nowadays natively, I believe before third-party solutions were available), you can do things like require specific signatures on executables, ... I'd expect the big problem usually is actually defining a useful but minimal set of things allowed, so people can actually do their work. Otherwise you'll quickly get to the point of an admin overriding stuff because they need (or "need") something else, or users finding workarounds. In many cases, providing users with multiple machines of different security levels would be a useful thing to do, but is cheapened out on. E.g. I've seen companies with blanket policies of "all machines that connect to business-network X need to be locked down". And then they made an application on that network mandatory for everybody (even if its something dumb like employee time tracking), so now there are (annoying) procedures for employees that can't actually work with fully restricted machines (e.g. developers, who need to be able to install software because their job is making and testing installed software...) to circumvent the security policy, instead of giving such employees a second cheap machine to do their timesheet entry. Another example I've heard about was putting less restricted PCs with their own internet connection into control rooms. Not "needed", but it was an effective way of keeping employees who were bored out of their minds during night shifts etc from putting whatever stuff they were going to use to keep themselves entertained (movies, games, ...) on the actual control network PCs through any way they could find. Of course they weren't supposed to plug their USB drives with movies into any work PC, but it was easier to give them a safe place to do it anyways than trying to police it perfectly.
liketochill 5y ago
They didn’t detail any espionage activity other than stealing files, even though their study included stuxnet which we know altered centrifuge control parameters. I wanted to know what types of facilities and platforms are being targeted.

70 points by shishy 5y ago

I feel like the first person in security who used the term 'nation-state' read it somewhere but didn't know what it meant and now it's meaningless.

deleted 5y ago
[deleted]
whatshisface 5y ago
It's a joke. Nation-State Adversary... get it?
- chrisseaton 5y ago
  Not sure that adds up as a theory - they don't use that phrase, the US isn't a nation-state, and Vault 7 wasn't the NSA anyway was it?
  - whatshisface 5y ago
    It's an old joke.
jcrawfordor 5y ago
From my experience in the industry my guess is that the term originated in the US to resolve the ambiguity of the term "state" here. "State actor" is really what's meant, but to many US listeners would not necessarily imply a "top level" sovereign. Yes, that probably came out of a misunderstanding of the meaning of the term "nation-state," but I think the number of people who know the correct definition of the term is really pretty small.
perl4ever 5y ago
I feel like I see people being pedantic about "nation-state" and how the US isn't one quite frequently in the last few years and while it's not something that can be proven in an airtight manner, it's bordering on some sort of political statement to insist. It seems that the UK, Israel, and Pakistan are considered nation-states. Is the US more like them, or more like the Ottoman Empire? Saying that the US is obviously not a nation-state, seems like denying that there is an American identity the way that there is an Israeli one.
- chrisseaton 5y ago
  The UK is a typical example of something that isn’t a nation-state - it explicitly has ‘the nations’ within it. The US also formally recognises multiple nations within it such as the Navajo Nation. But for example a country like Japan doesn’t formally recognise nations within it (as far as I know?) and is a typical example of a nation-state.
  - perl4ever 5y ago
    My point is just that rampant pedantry implies anyone who isn't one of the "ignorant masses" agrees on the consensus classification method. In reality, there is no consensus, as you prove here by confidently categorizing countries differently from others. “We demand rigidly defined areas of doubt and uncertainty!”
    - chrisseaton 5y ago
      It's like saying '2013 blue Ford Fusion' and then when someone points out it's actually a green Dodge complaining that they're being pedantic. Why be so bizarrely overly specific? Would have been less work to be more generic.
- seoaeu 5y ago
  Pedantically, the word "nation" in nation-state refers to a specific grouping of people. One which has a single shared history, ethnicity, culture, etc. The US is multicultural with citizens from a diverse range of ethnic backgrounds, so under that definition it doesn't qualify
odiroot 5y ago
It's a diplomatic way to say rogue/hostile state. An attempt to make the statement less political.
helsinkiandrew 5y ago
In this context doesn't it mean "have one or more organisations that are scoped with gaining this kind of access for military, economic, or prestige both online and in the physical world, and have almost unlimited resources". Nothing to do with national identity or how the people in that nation feel about their country, government, each other or themselves.

sounds 5y ago

The executive summary is worth the 1-minute read. Interesting that all the malicious frameworks known (by ESET) that target air-gapped networks were for some form of espionage.

SQueeeeeL 5y ago
"Air-gapping is used to protect the most sensitive of networks. In the first half of 2020 alone, four previously unknown malicious frameworks designed to breach air-gapped networks were publicly documented. ESET Research decided to revisit each framework known to date and to put them in perspective, side by side. Here are the key findings stemming from this exhaustive study: • All the frameworks are designed to perform some form of espionage. • All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks. • We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals. • Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network. • More than 10—critical severity—LNK-related remote code execution vulnerabilities in Windows have been discovered, then patched by Microsoft, in the last 10 years. • All the frameworks were built to attack Windows systems. We have not found any evidence of actual or suspected malware components built to target other operating systems. In this white paper, we will describe how malware frameworks targeting air-gapped networks operate, and provide a side-by-side comparison of their most important TTPs. We also propose a series of detection and mitigation techniques to protect air-gapped networks from the main techniques used by all the mali- cious frameworks publicly known to date."
- lucb1e 5y ago
  Bullet points require a blank line to be separated on HN (this happens to a lot of people): --- Air-gapping is used to protect the most sensitive of networks. In the first half of 2020 alone, four previously unknown malicious frameworks designed to breach air-gapped networks were publicly documented. ESET Research decided to revisit each framework known to date and to put them in perspective, side by side. Here are the key findings stemming from this exhaustive study: • All the frameworks are designed to perform some form of espionage. • All the frameworks used USB drives as the physical transmission medium to transfer data in and out of the targeted air-gapped networks. • We have not found any case of actual or suspected use of covert physical transmission mediums, such as acoustic or electromagnetic signals. • Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network. • More than 10—critical severity—LNK-related remote code execution vulnerabilities in Windows have been discovered, then patched by Microsoft, in the last 10 years. • All the frameworks were built to attack Windows systems. We have not found any evidence of actual or suspected malware components built to target other operating systems. In this white paper, we will describe how malware frameworks targeting air-gapped networks operate, and provide a side-by-side comparison of their most important TTPs. We also propose a series of detection and mitigation techniques to protect air-gapped networks from the main techniques used by all the malicious frameworks publicly known to date.

jonathankoren 5y ago

>Over 75% of all the frameworks used malicious LNK or autorun files on USB drives to either perform the initial air-gapped system compromise or to move laterally within the air-gapped network. I don't get why autorun was created. It's an obvious security issue.

catlikesshrimp 5y ago
Convenience. Security is bothersome, anyways /s.
chrisseaton 5y ago
> It's an obvious security issue. Probably legitimately wasn't at the time! The general landscape and security issues and reasonable concerns just weren't the same. Of course it's as clearly insane as giving pregnant women beer in maternity wards now, but wasn't at the time.
- phaedrus 5y ago
  We already had viruses on DOS before CDs existed. The fact CDs supported autorun and Microsoft programmed Windows to have that feature on by default was mind-blowingly stupid and an obvious vector for viruses even at the time Windows 95 was new.
  - chrisseaton 5y ago
    > We already had viruses on DOS before CDs existed. But they weren't a credible threat that was significant enough to be worth worrying about. We already have guns, but I don't do anything to protect myself against gun attack. It wouldn't be worth the time or effort or inconvenience for the level of threat. Maybe in thirty years we'll live in a dystopia and it'll be laughable that I went around unprotected against guns? But for today it's reasonable to ignore.
KZerda 5y ago
When Autorun, and Windows 95, were being developed, CD-Rs were multi-thousand dollar machines with media that cost $15+/disc, and USB was still being hashed out in the research labs. As such, the only real removable media that would have been used under Autorun would have been professionally mastered CDs, which had a $450+ minimum outlay for a master, and usually a minimum lot size atop of that, which was more than most people up to no good would have been willing to spend. Yes, as Autorun became a more viable attack vector, more protections should have been put in place, but in 1995, it was pretty low-risk.

pstuart 5y ago

> All the frameworks were built to attack Windows systems. Well there you go. Perhaps using an OpenBSD USB bastion is the way to go.

hulitu 5y ago
It will certainly make it harder for the attacker.

ur-whale 5y ago

TL;DR: - only targets windows - only uses USB drives The rest of the article dives into windows highly specific exploits and therefore lacks in generality.

schoen 5y ago
I guess air-gapped Windows machines are the biggest targets for governments and in any case the biggest interest of malware researchers. Elsewhere in the malwareverse, most botnets are made up only of Windows machines, even though some are not, and even though non-Windows machines certainly need to be protected. So, these exploits are the ones that have come to light recently. I was a little surprised to read that air-gapped machines are so often used in conjunction with removable media. That just doesn't feel like a good idea because of all the attack surface. On the other hand, the article implicitly gives some interesting ideas for how one could reduce that attack surface by removing software, drivers, and other functionality from an airgapped device. For example, I think there are ways in Linux that we can say that a USB interface should only accept devices of a certain USB class (and perhaps it would be helpful in a different way to say "class and manufacturer ID"), and also that only one kind of filesystem should be mountable, and you can say that it shouldn't be possible to execute a binary directly from that filesystem. Combining these things, you could say that a machine should only accept FAT16 mounting of a mass storage device made by Kingston, and ignore anything else. I don't know if you can specify that kind of stuff in Windows, but it would be pretty valuable for this application!
- hulitu 5y ago
  > I was a little surprised to read that air-gapped machines are so often used in conjunction with removable media. That just doesn't feel like a good idea because of all the attack surface. Our IT is also surprised. Unless the "air gaped machine" will run only one program which will never change, you need a way to transfer SW to this machine. And like our IT: we do not need CDROMs, every computer has an USB port. And from a (deranged) security perspective a CDROM id equal with an USB stick.
- detaro 5y ago
  Windows also can limit the USB devices connected (nowadays natively, I believe before third-party solutions were available), you can do things like require specific signatures on executables, ... I'd expect the big problem usually is actually defining a useful but minimal set of things allowed, so people can actually do their work. Otherwise you'll quickly get to the point of an admin overriding stuff because they need (or "need") something else, or users finding workarounds. In many cases, providing users with multiple machines of different security levels would be a useful thing to do, but is cheapened out on. E.g. I've seen companies with blanket policies of "all machines that connect to business-network X need to be locked down". And then they made an application on that network mandatory for everybody (even if its something dumb like employee time tracking), so now there are (annoying) procedures for employees that can't actually work with fully restricted machines (e.g. developers, who need to be able to install software because their job is making and testing installed software...) to circumvent the security policy, instead of giving such employees a second cheap machine to do their timesheet entry. Another example I've heard about was putting less restricted PCs with their own internet connection into control rooms. Not "needed", but it was an effective way of keeping employees who were bored out of their minds during night shifts etc from putting whatever stuff they were going to use to keep themselves entertained (movies, games, ...) on the actual control network PCs through any way they could find. Of course they weren't supposed to plug their USB drives with movies into any work PC, but it was easier to give them a safe place to do it anyways than trying to police it perfectly.

liketochill 5y ago

They didn’t detail any espionage activity other than stealing files, even though their study included stuxnet which we know altered centrifuge control parameters. I wanted to know what types of facilities and platforms are being targeted.