6 ms·
> For our attacker model, we assume that an initial compromise has happened on the target device through the software supply-chain similar to the incidents at S
by Ansil849 5y ago
> For our attacker model, we assume that an initial compromise has happened on the target device through the software supply-chain similar to the incidents at SolarWinds [8] and CodeCov [7]. For example, a regular update of the device’s firmware might unnoticeably add the necessary code for sending and receiving data through a built-in LED.
I mean, sure, if you have the ability to compromise the airgapped device by running code on it then you could presumably be doing a lot of things besides just leveraging potential LED line of sight.
- londons_explore 5y agoLots of systems rely on air gaps heavily, and then aren't too worried what the software on the machines is up to. For example, if you are running a nuclear power plant and need a printer, you probably aren't going to be hiring a team of printer firmware developers. You're just going to buy an off-the-shelf non-wifi printer, and use it offline.
- Ansil849 5y ago> you probably aren't going to be hiring a team of printer firmware developers. You're just going to buy an off-the-shelf non-wifi printer, and use it offline. In such a scenario, you're also probably never, ever going to be manually updating the printer's firmware.
- londons_explore 5y agoBut there's a reasonable chance someone evil works for the printer company and every printer sold contains this backdoor. Or the FedEx driver who delivered it to the nuclear plant flashed a modded firmware with the same version number? How often have you disassembled your printer firmware and given it a decent audit?
- Ansil849 5y ago> But there's a reasonable chance someone evil works for the printer company and every printer sold contains this backdoor. If your threat model does legitimately consider this to be a "reasonable chance", then your facility will be printer-free.
- sam0x17 5y agoDon't forget toner has firmware in it these days ;)
- Ansil849 5y agoFacts! But seriously, if we're talking about the realistic risks printers pose in most environments, it is not having data exfiltrated via LED signaling or other vanity supply chain injection attacks; the number one risk is by having staff not dispose of sensitive documents properly, whether it's leaving them out on their desk or just chucking them in the bin, or taking them home with them, etcetera. Vanity attacks with branded names like this "Lasershark" sound sexy and appealing, because they invoke James Bond-style gadgetry and accompanying delusions of grandeur, but real life is decidedly more prosaic: someone is going to discover infinitely more intelligence while expanding exponentially less time and energy by just good old fashioned dumpster diving than by designing and successfully implementing a novel airgap exfiltration methodology.
- upsidesinclude 5y agoAgreed, this kind of thing always seems like a post-grad expirement to get grant money from the bureaucratic fear mongers. I had to sit through a symposium on quantum messaging with qubits via encrypted laser transmission. It was literally line-of-sight and required impossibly expensive field equipment....
- haimez 5y agoI don’t think you have a realistic appreciation for what kind of resources are available to interested parties. I would think that the classic “Mossad or not Mossad” threat model might be a good starting point. Air gapped networks and hardware are interesting to powerful organizations. Don’t underestimate the base for “impossibly expensive”
- WastingMyTime89 5y agoThe operating part of the network for safety critical installation is shielded from the rest of the network by a physical diode. This printer can receive data but can’t send anything back.
- upsidesinclude 5y agoSpeaking with respect to non-nuclear builds, this is exactly how the military operates. USS and USNS vessels utilize off the shelf hardware for airgapped systems routinely, though USB device usage is strictly prohibited. In practice however, many unofficial semi-airgapped networks exist Equipment may require specialized software that is not purchased, but licensed and can only be operated by a service technician. The tech brings a preloaded laptop of questionable provenance and initiates a firmware/software update and reboot. Every company is vetted to some degree and employs background investigation, to what effect is hard to determine.
- londons_explore 5y agoThese are the dangerous ones... Edward Snowdon was recently spied on by cameras installed by a fire extinguisher technician...
- bootwoot 5y agoThe air-gap is specifically to prevent exfiltration of data. The air-gapped systems I have worked on had literally zero checking on software added to the system. But all the USB and media ports had super glue in them. An exploit that can't talk to the outside world is not terribly useful in the general case, although it's become lucrative with the rise of ransomware.
- closeparen 5y agoOr sabotage, as in Stuxnet. Or privilege escalation, so that an insider threat can do more damage than otherwise possible. I don't think "it's airgapped so vulnerabilities don't matter" really holds water.
- Terry_Roll 5y agoStuxnet was reportedly a USB stick delivery, but this could be media speculation. I am however interested in the low volume high frequency range sound of "static" that appears over speakers _only_ if the volume is turned up to the max in an otherwise silent office. I've had this occur on one Netherlands based website so far in the last few days, but did it come from the Netherlands based website or was it already on my system waiting for activation when visiting websites without any obvious ties back to the US? If you didnt have your speakers on max in a silent environment, only your mobile phone would pick it up not you (if you have a mobile phone), so is this some sort of malware which can jump from one device to another like a self contained virus of sorts and is it bringing data back to base, a few bytes at a time over time? Its a clever exploit because most people have their mobile on their desk, and if they dont have speakers some will be listening to music on their headphones so will never be alerted to the communication taking place within smartphone sound frequency ranges. ts exploiting human behaviour and exploiting the abilities of smart phones, not your usual bit of malware. I have also noticed Windows with all its security measures on max is able to control the bridging settings for network adaptors in VMware, which can then prevent a WMware version of Kali and wireshark from working properly in promiscuous mode, making it harder to analyse network traffic on a machine.
- deleted 5y ago[deleted]