5 ms·
Only by a physical person. Otherwise it's not an airgapped network.
by ratg13 3y ago
Only by a physical person. Otherwise it's not an airgapped network.
- j-bos 3y agoI mean the Iranian centerfuges smashed by stuxnet were also airgapped.
- belter 3y agoNot at all. I can turn on your airgapped computer from the street without getting into your building... Intel Management Engine - https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine "Several weaknesses have been found in the ME. On May 1, 2017, Intel confirmed a Remote Elevation of Privilege bug (SA-00075) in its Management Technology.[36] Every Intel platform with provisioned Intel Standard Manageability, Active Management Technology, or Small Business Technology, from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME" https://www.intel.com/content/www/us/en/developer/tools/in-band-manageability/overview.html https://www.intel.com/content/www/us/en/developer/tools/in-b...
- simbolit 3y agoIf you don't add an antenna to your airgapped computer, you need physical access to some copper. If you do add an antenna to your 'airgapped' computer, well, just don't. Is there a third way?
- bitcharmer 3y agoI don't think you understand what "air-gapped" actually means
- yorwba 3y agoAnd how do you establish the connection to deploy your remote privilege escalation exploit against the Intel Management Engine?
- belter 3y agoHey I am not ChatGPT :-) But the answer has three parts: 1- "...The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off..." 2- The Intel Management Engine is the remote privilege escalation.(Read on the known and unpublished vulnerabilities). 3- Over-the-Air Firmware Updates... If I say more we both will end on a secure facility.
- FirmwareBurner 3y ago>3- Over-the-Air Firmware Updates... Mate I feel like you're getting your security know-how from watching Mission Impossible. "Over-the-Air" doesn't actually mean you can magically beam SW updates wirelessly through the air to the Intel chip like in the hacker/spy movies, as airgapped networks, as per name, don't have wireless cards. Intel ME still requires a network connection to the internet/network from which you want to apply the update. If you're on an airgapped network this becomes impossible to do without first breaching the airgapped network physicality, but this is not what happened according to the article, they just compromised some employee Microsoft/O365 account which is on the less secure network anyway and probably stole whatever IP they could find shared through the e-mail accounts and on Sharepoint.
- belter 3y agoMaybe an official source will be good enough for you: https://www.intel.com/content/www/us/en/business/enterprise-computers/resources/remote-management.html https://www.intel.com/content/www/us/en/business/enterprise-...
- FirmwareBurner 3y agoDon't know what you saw in there but all that material disproves your claims.
- soganess 3y agoWait, I swear I'm not being intentionally daft, but in this scenario my air-gapped system has a (intel) wireless card? And we are certain the ME can manage this wireless card? And is actively listening for a wireless update while 'off'? From an unauthenticated connection?
- sdflhasjd 3y agoThe IME vulnerability referenced on Wikipedia still uses the computer's network. And to the IoT reference - such a computer wouldn't be (or rather shouldn't be) regarded as airgapped.