3 ms·

I guess air-gapped Windows machines are the biggest targets for governments and in any case the biggest interest of malware researchers. Elsewhere in the malwar

by schoen 5y ago

I guess air-gapped Windows machines are the biggest targets for governments and in any case the biggest interest of malware researchers. Elsewhere in the malwareverse, most botnets are made up only of Windows machines, even though some are not, and even though non-Windows machines certainly need to be protected. So, these exploits are the ones that have come to light recently. I was a little surprised to read that air-gapped machines are so often used in conjunction with removable media. That just doesn't feel like a good idea because of all the attack surface. On the other hand, the article implicitly gives some interesting ideas for how one could reduce that attack surface by removing software, drivers, and other functionality from an airgapped device. For example, I think there are ways in Linux that we can say that a USB interface should only accept devices of a certain USB class (and perhaps it would be helpful in a different way to say "class and manufacturer ID"), and also that only one kind of filesystem should be mountable, and you can say that it shouldn't be possible to execute a binary directly from that filesystem. Combining these things, you could say that a machine should only accept FAT16 mounting of a mass storage device made by Kingston, and ignore anything else. I don't know if you can specify that kind of stuff in Windows, but it would be pretty valuable for this application!

hulitu 5y ago
> I was a little surprised to read that air-gapped machines are so often used in conjunction with removable media. That just doesn't feel like a good idea because of all the attack surface. Our IT is also surprised. Unless the "air gaped machine" will run only one program which will never change, you need a way to transfer SW to this machine. And like our IT: we do not need CDROMs, every computer has an USB port. And from a (deranged) security perspective a CDROM id equal with an USB stick.
detaro 5y ago
Windows also can limit the USB devices connected (nowadays natively, I believe before third-party solutions were available), you can do things like require specific signatures on executables, ... I'd expect the big problem usually is actually defining a useful but minimal set of things allowed, so people can actually do their work. Otherwise you'll quickly get to the point of an admin overriding stuff because they need (or "need") something else, or users finding workarounds. In many cases, providing users with multiple machines of different security levels would be a useful thing to do, but is cheapened out on. E.g. I've seen companies with blanket policies of "all machines that connect to business-network X need to be locked down". And then they made an application on that network mandatory for everybody (even if its something dumb like employee time tracking), so now there are (annoying) procedures for employees that can't actually work with fully restricted machines (e.g. developers, who need to be able to install software because their job is making and testing installed software...) to circumvent the security policy, instead of giving such employees a second cheap machine to do their timesheet entry. Another example I've heard about was putting less restricted PCs with their own internet connection into control rooms. Not "needed", but it was an effective way of keeping employees who were bored out of their minds during night shifts etc from putting whatever stuff they were going to use to keep themselves entertained (movies, games, ...) on the actual control network PCs through any way they could find. Of course they weren't supposed to plug their USB drives with movies into any work PC, but it was easier to give them a safe place to do it anyways than trying to police it perfectly.

by schoen 5y ago

hulitu 5y ago

> I was a little surprised to read that air-gapped machines are so often used in conjunction with removable media. That just doesn't feel like a good idea because of all the attack surface. Our IT is also surprised. Unless the "air gaped machine" will run only one program which will never change, you need a way to transfer SW to this machine. And like our IT: we do not need CDROMs, every computer has an USB port. And from a (deranged) security perspective a CDROM id equal with an USB stick.

detaro 5y ago

Windows also can limit the USB devices connected (nowadays natively, I believe before third-party solutions were available), you can do things like require specific signatures on executables, ... I'd expect the big problem usually is actually defining a useful but minimal set of things allowed, so people can actually do their work. Otherwise you'll quickly get to the point of an admin overriding stuff because they need (or "need") something else, or users finding workarounds. In many cases, providing users with multiple machines of different security levels would be a useful thing to do, but is cheapened out on. E.g. I've seen companies with blanket policies of "all machines that connect to business-network X need to be locked down". And then they made an application on that network mandatory for everybody (even if its something dumb like employee time tracking), so now there are (annoying) procedures for employees that can't actually work with fully restricted machines (e.g. developers, who need to be able to install software because their job is making and testing installed software...) to circumvent the security policy, instead of giving such employees a second cheap machine to do their timesheet entry. Another example I've heard about was putting less restricted PCs with their own internet connection into control rooms. Not "needed", but it was an effective way of keeping employees who were bored out of their minds during night shifts etc from putting whatever stuff they were going to use to keep themselves entertained (movies, games, ...) on the actual control network PCs through any way they could find. Of course they weren't supposed to plug their USB drives with movies into any work PC, but it was easier to give them a safe place to do it anyways than trying to police it perfectly.