4 ms·

> They basically churn out a metric fuckload of the same thing, different bus. Notably, most of the attacks from Mordechai's lab describe low-bandwidth channel

> They basically churn out a metric fuckload of the same thing, different bus. Notably, most of the attacks from Mordechai's lab describe low-bandwidth channels for deliberate data exfiltration. These attacks would only apply in unusual situations where an attacker can run arbitrary code on a machine, but the machine is isolated from the outside world. (Scenarios like Iranian nuclear facilities come to mind.)

_8j50 4y ago
You say that but I am actively dealing with a chinese malware(public info) I won't name that does just that but with USB. It sideloads a dll when a shortcut opens a legit app on a USB (shortcut is tricky in that it looke like a folder and opens a folder also when you click on it) it then collecte all kinds of documents and exfils to the internet but if there is no internet it archives it back to the USB so next time it runs with internet access it will also exfil any docs on the USB from the airgapped machines, fortunately just a spillover infection for us but these tricks in the paper would enable to not wait for a USB or internet access, it would be more realtime. Like if it is an ICS system for nuclear centrifuges it will send back what ir found and accept destructive tasks.
- userbinator 4y ago
  You still need a receiver within range in order to do this.
  - rtev 4y ago
    Someone attacking a nuclear facility can get a receiver within range
    - toomanybeersies 4y ago
      Wouldn't there the small matter of a few meters of concrete attenuating any signals coming from a nuclear facility?
    - RF_Savage 4y ago
      Not only that. Due to the extremely low bandwidth in these channels and being one way, sendimg documents would be extremely slow. Likely on the order of hours or days for a text only word document. You cannot do any re-transmissions for broken bits. And the range is VERY low for normal PC's that have had to pass EMC tests. For an all glass gamer RGB PC the things will be different.
      - rtev 4y ago
        It’s true that there are many better ways to do it. If a nation state only had this option, I think they could pull it off though.
- happyopossum 4y ago
  > accept destructive tasks. Not with this - it’s a one way channel
woevdbz 4y ago
Well but that is exactly the point of air-gapping. It's meant to give the institution a guarantee that, no matter how badly the box might be owned, no matter if the user themselves is compromised, stuff won't get out. If a user with admin rights on the machine can get it to communicate with the external world, that's an air gap failure.
- duskwuff 4y ago
  Right, my point is that this is a class of attacks which are only relevant to a specific, small class of users. It's irrelevant to users who have intentionally enabled any kind of network communications on their computer, and it's also irrelevant to users who have robust controls on what code is executing on their system, or who run untrusted code in an environment which isolates it from hardware (like a virtual machine). So, in short, it only affects ineptly managed secure environments.
  - PeterCorless 4y ago
    Not that there are any of those...
  - woevdbz 4y ago
    > this is a class of attacks which are only relevant to a specific, small class of users Yes. > It's irrelevant to users who have intentionally enabled any kind of network communications on their computer No, there are lots of use-cases at least for LAN communications. > it's also irrelevant to users who have robust controls on what code is executing on their system, or who run untrusted code in an environment which isolates it from hardware (like a virtual machine). No, it's relevant in those cases too, as part of a defense in depth strategy.
    - duskwuff 4y ago
      > No, there are lots of use-cases at least for LAN communications. What I'm trying to get at here is that bizarre sidechannels like fan noise or SATA EMI are only relevant when the system administrator has thoroughly locked down all other possible channels of communication. If the system is connected to a wired network, it can communicate with other systems over that; if the network is connected to the Internet, even indirectly, there are probably ways to get data out through there. If the system has a WiFi card or Bluetooth adapter, that can be used to transmit data, even if there isn't an applicable network in range. Etc, etc.

_8j50 4y ago

You say that but I am actively dealing with a chinese malware(public info) I won't name that does just that but with USB. It sideloads a dll when a shortcut opens a legit app on a USB (shortcut is tricky in that it looke like a folder and opens a folder also when you click on it) it then collecte all kinds of documents and exfils to the internet but if there is no internet it archives it back to the USB so next time it runs with internet access it will also exfil any docs on the USB from the airgapped machines, fortunately just a spillover infection for us but these tricks in the paper would enable to not wait for a USB or internet access, it would be more realtime. Like if it is an ICS system for nuclear centrifuges it will send back what ir found and accept destructive tasks.

userbinator 4y ago
You still need a receiver within range in order to do this.
- rtev 4y ago
  Someone attacking a nuclear facility can get a receiver within range
  - toomanybeersies 4y ago
    Wouldn't there the small matter of a few meters of concrete attenuating any signals coming from a nuclear facility?
  - RF_Savage 4y ago
    Not only that. Due to the extremely low bandwidth in these channels and being one way, sendimg documents would be extremely slow. Likely on the order of hours or days for a text only word document. You cannot do any re-transmissions for broken bits. And the range is VERY low for normal PC's that have had to pass EMC tests. For an all glass gamer RGB PC the things will be different.
    - rtev 4y ago
      It’s true that there are many better ways to do it. If a nation state only had this option, I think they could pull it off though.
happyopossum 4y ago
> accept destructive tasks. Not with this - it’s a one way channel

woevdbz 4y ago

Well but that is exactly the point of air-gapping. It's meant to give the institution a guarantee that, no matter how badly the box might be owned, no matter if the user themselves is compromised, stuff won't get out. If a user with admin rights on the machine can get it to communicate with the external world, that's an air gap failure.

duskwuff 4y ago
Right, my point is that this is a class of attacks which are only relevant to a specific, small class of users. It's irrelevant to users who have intentionally enabled any kind of network communications on their computer, and it's also irrelevant to users who have robust controls on what code is executing on their system, or who run untrusted code in an environment which isolates it from hardware (like a virtual machine). So, in short, it only affects ineptly managed secure environments.
- PeterCorless 4y ago
  Not that there are any of those...
- woevdbz 4y ago
  > this is a class of attacks which are only relevant to a specific, small class of users Yes. > It's irrelevant to users who have intentionally enabled any kind of network communications on their computer No, there are lots of use-cases at least for LAN communications. > it's also irrelevant to users who have robust controls on what code is executing on their system, or who run untrusted code in an environment which isolates it from hardware (like a virtual machine). No, it's relevant in those cases too, as part of a defense in depth strategy.
  - duskwuff 4y ago
    > No, there are lots of use-cases at least for LAN communications. What I'm trying to get at here is that bizarre sidechannels like fan noise or SATA EMI are only relevant when the system administrator has thoroughly locked down all other possible channels of communication. If the system is connected to a wired network, it can communicate with other systems over that; if the network is connected to the Internet, even indirectly, there are probably ways to get data out through there. If the system has a WiFi card or Bluetooth adapter, that can be used to transmit data, even if there isn't an applicable network in range. Etc, etc.