3 ms·

Well but that is exactly the point of air-gapping. It's meant to give the institution a guarantee that, no matter how badly the box might be owned, no matter if

Well but that is exactly the point of air-gapping. It's meant to give the institution a guarantee that, no matter how badly the box might be owned, no matter if the user themselves is compromised, stuff won't get out. If a user with admin rights on the machine can get it to communicate with the external world, that's an air gap failure.

duskwuff 4y ago
Right, my point is that this is a class of attacks which are only relevant to a specific, small class of users. It's irrelevant to users who have intentionally enabled any kind of network communications on their computer, and it's also irrelevant to users who have robust controls on what code is executing on their system, or who run untrusted code in an environment which isolates it from hardware (like a virtual machine). So, in short, it only affects ineptly managed secure environments.
- PeterCorless 4y ago
  Not that there are any of those...
- woevdbz 4y ago
  > this is a class of attacks which are only relevant to a specific, small class of users Yes. > It's irrelevant to users who have intentionally enabled any kind of network communications on their computer No, there are lots of use-cases at least for LAN communications. > it's also irrelevant to users who have robust controls on what code is executing on their system, or who run untrusted code in an environment which isolates it from hardware (like a virtual machine). No, it's relevant in those cases too, as part of a defense in depth strategy.
  - duskwuff 4y ago
    > No, there are lots of use-cases at least for LAN communications. What I'm trying to get at here is that bizarre sidechannels like fan noise or SATA EMI are only relevant when the system administrator has thoroughly locked down all other possible channels of communication. If the system is connected to a wired network, it can communicate with other systems over that; if the network is connected to the Internet, even indirectly, there are probably ways to get data out through there. If the system has a WiFi card or Bluetooth adapter, that can be used to transmit data, even if there isn't an applicable network in range. Etc, etc.

duskwuff 4y ago

Right, my point is that this is a class of attacks which are only relevant to a specific, small class of users. It's irrelevant to users who have intentionally enabled any kind of network communications on their computer, and it's also irrelevant to users who have robust controls on what code is executing on their system, or who run untrusted code in an environment which isolates it from hardware (like a virtual machine). So, in short, it only affects ineptly managed secure environments.

PeterCorless 4y ago
Not that there are any of those...
woevdbz 4y ago
> this is a class of attacks which are only relevant to a specific, small class of users Yes. > It's irrelevant to users who have intentionally enabled any kind of network communications on their computer No, there are lots of use-cases at least for LAN communications. > it's also irrelevant to users who have robust controls on what code is executing on their system, or who run untrusted code in an environment which isolates it from hardware (like a virtual machine). No, it's relevant in those cases too, as part of a defense in depth strategy.
- duskwuff 4y ago
  > No, there are lots of use-cases at least for LAN communications. What I'm trying to get at here is that bizarre sidechannels like fan noise or SATA EMI are only relevant when the system administrator has thoroughly locked down all other possible channels of communication. If the system is connected to a wired network, it can communicate with other systems over that; if the network is connected to the Internet, even indirectly, there are probably ways to get data out through there. If the system has a WiFi card or Bluetooth adapter, that can be used to transmit data, even if there isn't an applicable network in range. Etc, etc.