14 ms·

Just disconnect the internet

402 points by bathtub365 2y ago

einpoklum 2y ago
> Here's the thing: virtually the entire software landscape has been designed with the assumption of internet connectivity. The thing the drives me nuts is not even that, which is bad enough, but with the assumption that the Internet connection is always stable and it is legitimate to say "wait until some connections are up" again, as though there are no such things as power outages, network-level errors, cable tears, physical socket failures and such.
asynchronous 2y ago
Great write up on the issues and challenges with airgapped and entirely internet avoidant systems in the modern software world.
- gala8y 2y ago
  I will piggyback on your comment. Absolutely stellar example of fine grain thinking which accidentally shows huge expertise and real life experience of the author. Regardless of type of a problem, the amount of thinking put into solving it makes the difference. It is thinking in systems, building complex mental models and finding edge cases which pays off, regardless of the domain / problem at hand. People tend to halt too soon in building mental models. When you are responsible for any given area, you better build a fine grained model. Obviously this is costly in terms of time, money, lost opportunity,... and there is of course a blurry line where you should stop building complexity of a model and just implement a solution. Life will come knocking on your door anyways, Aunt Entropy shows up sooner or later. This is also why almost all news is non-sense for an expert in given domain. Basically... "It's not that simple."
jongjong 2y ago
'Disconnect from the internet' is a kind of 'Security through obscurity'; which isn't very good security. It's basically an admission that the software may be full of vulnerabilities and the only way to protect it is to limit its exposure to the outside world. The root of the problem is that almost all software is poorly designed and full of unnecessary complexity which leaves room for exploitation. Companies don't have a good model for quality software and don't aim for it as a goal. They just pile on layer upon layer of complexity. Quality software tends to be minimalistic. The code should be so easy to read that an average hacker could hack it in under an hour if there was an issue with it... But if the code is both simple and there is no vulnerability within it, then you can rest assured that there exist no hackers on the face of the earth who can exploit it in unexpected ways. The attack surface should be crystal clear. You don't want to play a game of cat and mouse with hackers because it's only a matter of time before you come across a hacker who can surpass your expectations. Also, it's orders of magnitude more work to create complex secure software than it is to create simple secure software. The mindset to adopt is that bad code deserves to be hacked. Difficulty involved in pulling off the hack is not a factor. It's a matter of time before hackers can disentangle the complexity.
- sureIy 2y ago
  > 'Security through obscurity'; which isn't very good security. I never understood this. You never have absolute security, that’s why you must apply the Swiss cheese model. Obscurity is definitely a worthy slice to have. Few people can attack you if you can only be attacked in person.
  - Animats 2y ago
    The "Swiss cheese model" worked against amateur attackers. It doesn't hold up against well-funded or patient ones who can work through the holes in each layer. The extreme demo of this was Stuxnet.
    - Pavilion2095 2y ago
      What is better than the Swiss cheese model or its derivatives? Planes still crash from time to time, but nobody is saying that the model is wrong as the reliability is insane.
    - DaSHacka 2y ago
      Hence the purpose behind threat modelling? All security is really just the swiss-cheese model. Some entities just invest in more slices than others to keep more sophisticated/determined attackers out (such as nation states). What other practical model is there for security then defense in depth? "Just make 100% bulletproof computers with no faults?"
      - Animats 2y ago
        Alternative models: - Systems that store the code in read-only memory. Example: slot machines. - Systems with backup systems completely different from the main system, implemented by a different group, and thoroughly tested. Example: Airbus aircraft. - Systems continuously sanity-checked by hard-wired checkers. Example: Traffic lights. - Systems where the important computational functions are totally stateless and hardware reset to a ground state for each transaction. Example: #5 Crossbar.
    - 2y ago
anticristi 2y ago
In Sweden, there is a private network (Sjunet) which is isolated from the Internet. It is used by healthcare providers. Its purpose is to make computers valuable communication devices (I love how the article points this out), but without exposing your hospital IT to the whole Internet. Members of Sjunet are expected to know their networks and keep tight controls on IT. I guess Sjunet can be seen as an industry-wide air-gapped environment. I'd say it improves security, but at a smaller cost than each organization having its own air-gapped network with a huge allowlist.
- einpoklum 2y ago
  As others suggest: Sjunet is not really "private", in the sense that you can bet that there are unsupervised machines connected to it via some of the legit machines (or via some of the comm. equipment), which are also connected to the rest of the Internet via another Ethernet or WiFi connection. These can in principle expose open ports for interested parties to act as they wish on the "private" network. And they do so despite the reassuring contract which Sjunet members sign.
- kreddor 2y ago
  Denmark has something quite similar (Sundhedsdatanettet).
  - jmnicolas 2y ago
    > Sundhedsdatanettet What a tongue twister for non danish speaking people :D
    - Symbiote 2y ago
      In English we would put spaces between parts of a "compound" word. > Sundheds data nettet Sund-hed is "sound-ness" (or even "sound-hood"), i.e. health. > The health data network
      - ithkuil 2y ago
        Yep. not putting spaces on compound words doesn't twist the tongue but twist the eyes! Eyetwister
RF_Savage 2y ago
There is also hamnet, which is partly internet routable and partly not on the 44Net IP block. https://hamnetdb.net/map.cgi https://hamnetdb.net/map.cgi It has interesting limitations due to the amateur radio spectrum used. Including total ban commercial use. As that is the social contract of the spectrum, you get cheap access to loads of spectrum between 136kHz and 241GHz, but can't make money with it.
- wkat4242 2y ago
  Yeah it's really hard to get an uplink to it though. Even in a big city. Only in the Netherlands and Germany is it really widespread: https://hamnetdb.net/map.cgi https://hamnetdb.net/map.cgi . Here in Spain it's not available anywhere near me.
  - withinboredom 2y ago
    With hamm radio, it doesn't need to be near IIRC. It's been a long af time since I've messed about with radio, but pretty sure you'd be able to use the ionosphere as an antenna.
    - wkat4242 2y ago
      For this it does need to be near. These are all high-speed connections that need line of sight. Basically those microwave dishes that you see everywhere. Or at least a grid reflector or yagi or something. With HF yes you can use the various atmospheric layers to reflect depending on band but in those bands the available bandwidth is extremely low (the entire HF range itself is only 30mhz and the amateurs only have a few small slices of that). The only practical digital operations there are Morse, RTTY (basically telex) and some obscure extremely-slow GPS synced data modes like WISPR and FT8 that are basically for distance bragging rights but don't transmit useful payload. So in effect, no. In this case line of sight or at least short distances (VHF/UHF) are required. Also, I don't have space for huge antennas that HF requires as I'm in a small apartment in the middle of a built-up city.
tjoff 2y ago
Good article, though I really thought it would be about the other end. You know hacking movies in the 90s(?) where the good guys face a hacker-attack, frantically typing at the keyboard trying to keep the hackers away. It is a losing battle though, but just at the nick of time (the progress bar is at 97%) the hero unplugs the power cord or internet cable. Or, in the case of crowdstrike. I can imagine support starts to get some calls, at some time you realize that something has gone horribly wrong. An update, maybe not obvious which, is wreaking havoc. How do you stop it? Have you foreseen this scenario and have a simple switch to stop sending updates? Or, do you cut the internet? Unlike the movies there isn't a single cord to pull, maybe the servers are in a different building or some cloud somewhere. They probably have a CDN, can you pull the files efficiently? Now maybe by the time they discovered this it was mostly too late, all online systems might already have gotten the latest updates (but even if that is the case, do they know that is the case?).
- JKCalhoun 2y ago
  I have resisted "auto updates" for the OS's of my personal machines. Instead the OS nags me when there is a software update and I just ignore it for a week or so. I assume that any accidentally buggy software update will be found by others (or Apple) first and I can have dodged that particular bullet. Not air-gap, temporal gap.
andrewstuart 2y ago
I don't think systems should not be connected to the Internet. I did find it surprising however that so many systems shown on TV run Windows. Digital signage screens, shopping registers all sorts of stuff that I assumed would be running Linux. It is surprising to me that systems with functions like a cash register would be doing automatic updates at all.
- willi59549879 2y ago
  It surprised me too. Maybe it is because people are just more used to windows. Or it might be because of more software geared to roll out software updates.
- cqqxo4zV46cp 2y ago
  Because desktop Linux is an absolute bloody mess and most IT departments are completely justified in not wanting to deal with it? I’m not saying that Windows is great. I haven’t willingly used it in 15 years. But you can’t keep your head in the sand about the sad state of Linux and anything graphical, especially on esoteric hardware. POS systems are often effectively Internet-connected, because they need to report stock levels, connect to financial networks, process BNPL applications, etc. it’s completely warranted to treat them like ‘endpoints’, because they are.
  - andrewstuart 2y ago
    I have alot of experience with Linux running Custom builds with chrome. I can say it’s not easy to configure but once done it’s very stable and simple.
  - bregma 2y ago
    POS terminals and electronic billboards are not desktops, though, so arguments about desktop software is irrelevant. These are all dedicated application appliances with known, controlled hardware and software constraints. Using a general-purpose desktop designed for corporate executives running Excel and PowerPoint is just the wrong technology choice for such an application. Some kind of specialized Linux-based system, on the other hand, is an excellent choice.
renegat0x0 2y ago
Connection between clownstrike and cybersecurity is flimsy. This was not an attack. This was a resource management problem, a process problem. Meaning: if your process are invalid, you can also fail in off-line scenario. If you do not treat quality control, or tests correctly you gonna have a bad time.
- owl57 2y ago
  > if your process are invalid, you can also fail in off-line scenario Online amplifies failure at least as well as it amplifies success. Offline maintenance is quite unlikely to bluescreen 8 million devices before anyone has time to figure out something's going wrong.
Imagesegmetanto 2y ago
[dead]
creesch 2y ago
A bit of a tangent to the subject of the blog, but something that has been bugging for a while. What's up with all these blogs that choose fonts that are just not that good for readability? In this case, monospace. It's not code, it is not formatted as code, making it a bad choice for comfortable reading. Are these people not writing blogs to be read? And just to be ahead of it, just because you are able to read it doesn't mean it wouldn't be easier and more comfortable to read in a more suitable font.
- 0898 2y ago
  It’s a retro nod to newsletters like NTK and Popbitch, I believe.
  - creesch 2y ago
    I get that it is an aesthetic choice. One I can't really understand given the main purpose of a blog, I think anyway, is to be read.
- williamdclt 2y ago
  I always think that if I prefer to enable Firefox's reader view on a blog, they _really_ messed up: a bland, basic, generic syling is preferrable to their custom one. It's what happens with most blogs, sadly
  - creesch 2y ago
    It is indeed what prompted me to go on this tangent. I see so many blog posts being posted here that are just unnecessarily uncomfortable to read. It's just baffling how a person can spend time and effort to publish something on the internet, clearly wanting people to read it, and then not consider the bare basics.
- inetknght 2y ago
  > What's up with all these blogs that choose fonts that are just not that good for readability? In this case, monospace. It's not code, it is not formatted as code, making it a bad choice for comfortable reading. That's a subjective opinion. I vastly prefer monospaced fonts. They're easier to read!
lokimedes 2y ago
That pretty well summed up my time delivering state of the art AI solutions to military customers. 80% of the effort was getting internet-native tooling to work seamlessly in an air-gapped environment.
gizmo 2y ago
> But that just, you know, scratches the surface. You probably develop and deploy software using a half dozen different package managers with varying degrees of accommodation for operating against private, internal repositories. That's non-ironically the problem. Current software culture creates "secure software" with a 200 million line of code attack surface and then act surprised when it blows up spectacularly. We do this because there is effectively no liability for software vendors or for their customers. What software security vendors sell is regulatory compliance, not security.
rowbin 2y ago
>> The stronger versions, things from List 1 and List 2, are mostly only seen in defense and intelligence And I don't think that is enough. I agree that it easier and sufficient for most systems to just be connected over the internet. But health, aviation and critical infrastructure in general should try to be offline as much as possible. Many of the issues described with being offline stem from having many third party dependencies (which typically assume internet access). In general but for critical infrastructure especially you want as little third party dependencies as possible. Sure it's not as easy as saying "we don't want third party dependencies" and all is well. You'll have to make a lot of sacrifices. But you also have a lot to gain when dramatically decreasing complexity, not only from a security standpoint. I really do believe there are many cases where it would be better to use a severely limited tech stack (hardware and software) and use a data diode like approach where necessary. One of the key headaches mentioned when going offline is TLS. I agree and I think the solution is to not use TLS at all. Using a VPN inside the air-gapped network should be slightly better. It's still a huge headache and you have to get this right, but being connected to the internet at all times is also a HUGE headache.
fifteen1506 2y ago
The author is failing to see a potential solution. Whitelist all needed IPs for business functionality, enable the whole Internet once every 3 hours for an hour. Bonus points if you can do it by network segment. It would be enough to spare half your computers from the CrowdStrike issue, since I believe the update was pulled after an hour. Will any-one do this? Probably not. But it is worth entertaining as a possibility between the fully on connectivity and the fully disconnected.
- vel0city 2y ago
  > Whitelist all needed IPs for business functionality I really don't like this mentality. The IP I'm serving some service might change. DNS is a useful thing.
  - deathanatos 2y ago
    Security types love it. But from a infra eng viewpoint, it's an utter pain in the ass, and the thought of "what if IP changes?" — which inevitably happens — has no process, no plan, and ends up as "manually update O(n) different configurations, of which there does not exist a list of, so you'll never know if you got them all."
    - fifteen1506 2y ago
      You're of course right. My proposal would fall flat on its face the moment that ocurred. Doesn't mean it couldn't work. See for example, Microsoft's ZeroTrust DNS.
- deathanatos 2y ago
  > It would be enough That depends on the phase of your "every 3 hours for an hour" signal, and the phase of "the update was pulled after an hour.". That's a 33% overlap. Feelin' lucky?
eqqn 2y ago
"Don't worry, the software in question seems to have fallen out of favor and cannot hurt you." It may not be the software in question, but proprietary snowflake entitlement management software that has a lot of black box and proprietary voodoo, that does not have any disaster recovery capacity and would be considered tech debt a decade ago... Disgracefully came into life in the year 2021. It did not gracefully recover from clownstrike to say the least.
flumpcakes 2y ago
I work in security/systems/ops/etc. and fundamentally disagree with this premise. I understand the author is saying "it's not that easy" and I agree completely with that, but I don't agree that it means you're doing your job well. Unfortunately the vast majority of people do their jobs poorly. The entire industry is set-up to support people doing their job poorly and to make doing your job well hard. If I deploy digital signage the only network access it should have is whitelisted to my servers' IP addresses and it should only accept updates that are signed and connections that have been established with certificate pinning. This makes it nearly impossible for a remote attacker to mess with it. Look at the security industry that has exploded from the rise of IoT. There's signage out there (replace with any other IoT/SCADA/deployed device) with open ports and default passwords, I guarantee it. IoT is just a computer, but it's also a computer that you neglect even more than the servers/virtual machines you're already running poorly. People don't want to accept this, or even might be affronted by this. There are some places doing things well - but it's the vast minorities of companies out there, because you are not incentivised to do things well. "Best practises" or following instructions from vendors does not mean you are doing things well. It means you are doing just enough that a vendor can be bothered to support. Which in a lot of cases is unfettered network access.
- hypeatei 2y ago
  For IoT in particular, you hit a crossroads where the embedded devs haven't really dealt with advanced security concepts so you kinda have to micromange the implementation. And, in small teams it's hard to justify the overhead of managing x509 certs and all the processes that come along with it. Just my personal experience.
  - szundi 2y ago
    Yeah you know, just roll out our MVP, let's see where the business goes with it, and then we'll fix it. Whaat? Budget of fixing it is 2x of the product itself? Hm. Let's have meetings over meetings to postpone the decision until the next one, indefinitely - we cannot really make the decision not to do it of course.
  - throw0101a 2y ago
NoboruWataya 2y ago
It seems fairly obvious that an airline reservation system needs to be connected to a network at least, I haven't heard many people claim they should have been all offline. But for example I heard stories of lathe machines in workshops that were disabled by this. You gotta wonder whether they really needed to be online. (I'm sure there are reasons, but they are reasons that should be weighed against the risks.) Beyond that there are plenty of even more ridiculous examples of things that are now connected to the internet, like refrigerators, kettles, garage doors etc. (I don't know if many, or any, of these things were affected by the CrowdStrike incident, but if not, it's only a matter of time until the next one.) As for the claim that non-connected systems are "very, very annoying", my experience as a user is that all security is "very, very annoying". 2FA, mandatory password changing, locked down devices, malware scanners, link sanitisers - some of it is necessary, some of it is bullshit (and I'm not qualified to tell the difference), but all of it is friction.
- kwhitefoot 2y ago
  > a network Of course. But not the Internet.
tormeh 2y ago
I remain unconvinced that you shouldn't air-gap systems because that means you can't use internet-centric development practices. I find this argument absurd. The systems that should have their ethernet ports epoxyed also should never have been programmed using internet-centric development practices in the first place. Your MRI machine fetches JS dependencies from NPM on boot? Straight to jail. Not metaphorically.
- redundantly 2y ago
  > Your MRI machine fetches JS dependencies from NPM on boot? Straight to jail. Not metaphorically. Damned right. That would be a special type of malfeasance that should earn criminal punishment, if healthcare equipment worked that way.
forinti 2y ago
After watching a video of a person playing with a MacDonald's kiosk, I started to do the same with equipment I found at different places. One food court had kiosks with Windows and complete access to the Internet. Somebody could download malware and steal credit card data. Every time I used one, I turned it off or left a message on the screen. Eventually they started running it in kiosk mode. Another was a parking kiosk. It was never hardened. I guess criminals haven't caught on to this yet. The third was an interactive display for a brand of beer. This one wasn't going to cause any harm, but I liked to leave Notepad open with "Drink water" on it. Eventually they turned it off. That's one way to fix it, I guess.
- remus 2y ago
  > Another was a parking kiosk. It was never hardened. I guess criminals haven't caught on to this yet. I don't know the details of how the parking kiosks near me are setup, but I can only assume they're put together really poorly because once, after mashing buttons in frustration, it started refunding me for tickets that I'd not purchased. You'd have thought "Don't give money to random passers by" would have been fairly high on the list of requirements, but there we are.
- golergka 2y ago
  If you open a browser with porn on it, they will get fixed very, very fast.
gz5 2y ago
we can use the Internet without being used by the Internet. an open source example: https://blog.openziti.io/no-listening-ports https://blog.openziti.io/no-listening-ports
djha-skin 2y ago
> If you are operating a private network, your internal services probably don't have TLS certificates signed by a popular CA that is in root programs. You will spend many valuable hours of your life trying to remember the default password for the JRE's special private trust store and discovering all of the other things that have special private trust stores, even though your operating system provides a perfectly reasonable trust store that is relatively easy to manage, because of Reasons. You will discover that in some tech stacks this is consistent but in others it depends on what libraries you use. Oof, I feel this one. I tried to get IntelliJ's JRE trust store to understand that there was a new certificate for zscaler that it had to use and there were two or three different JDKs to choose from, and all of their trust stores were given the new certificate and it still didn't work and we didn't know why.
llm_trw 2y ago
The description of updates is painfully true. A long time ago I worked at a broker trader where all communications, including servers communications, had to go through zscaler as a man in the middle. What had been routine all of a sudden became impossible. Turns out that git, apt, pip, cabal and ctan all had different ideas about how easy they should make this. After a month of fighting each of them I gave up. I just downloaded everything from their public ftp repos and build from source over a week. I wish good luck to whoever had to maintain it.
RajT88 2y ago
My big take-away is not that "all these systems shouldn't be connected to the internet", it's a few other things: 1. These systems shouldn't allow outbound network flows. That will stop all auto-updates, which you can then manage via internal distribution channels. 2. Even without that, you can disable auto-updates on many enterprise software products - Windows notably, but also Crowdstrike itself. I heard about CS customers disabling auto-update and doing manual rollouts who were saved by this practice. 3. Tacking on to number 2 - gradual rollout of updates which you've done some smoke testing on. Just in case. Again - I heard of CS customers who did a gradual rollout, and managed to only have a fraction of their machines impacted.
LeifCarrotson 2y ago
I'm a controls engineer. I've built hundreds of machines, they do have Ethernet cables for fieldbus networks but should never be connected to the Internet. Every tool and die shop in your neighborhood industrial park contains CNC machines with Ethernet ports that cannot be put on the Internet. Every manufacturing plant with custom equipment, conveyor lines and presses and robots and CNCs and pump stations and on and on, use PLC and HMI systems that speak Ethernet but are not suitable for exposure to the Internet. The article says: > In other words, the modern business computer is almost primarily a communications device. > There are not that many practical line-of-business computer systems that produce value without interconnection with other line-of-business computer systems. which ignores the entirety of the manufacturing sector as well as the electronic devices produced by that sector. Millions of embedded systems and PLCs produce value all day long by checking once every millisecond whether one or more physical or logical digital inputs have changed state, and if so, changing the state of one or more physical or logical digital outputs. There's no need for the resistance welder whose castings were built more than a century ago, and whose last update was to receive a PLC and black-and-white screen for recipe configurations in 2003 to be updated with 2024 security systems. You just take your clipboard to it, punch in the targets, and precisely melt some steel. Typically, you only connect to machines like this by literally picking up your laptop and walking out to the machine with an Ethernet patch cable. If anything beyond that, I expect my customers to put them on a firewalled OT network, or bridge between information technology (IT) and operations technology (OT) with a Tosibox, Ixon, or other SCADA/VPN appliance.
- bo1024 2y ago
  It's reassuring that such things still exist. My mental model of consumer hardware is that they take devices like the ones you describe, and just add wifi, bluetooth, telemetry, ads, and an app.
- MerManMaid 2y ago
  PLCs are explicitly considered high value targets as they control large swaths of a nation-states critical infrastructure as well as connect to high value end-points in air-gapped networks. Now perhaps you're not working on anything someone might want to exploit, but PLCs are often found in critical infrastructure as well as high-end manufacturing facilities, which make them attractive targets for malicious actors. Whether because they're attempting to exploit critical infrastructure or infect a poorly secured device that high value end-points (such as engineering laptops) might eventually connect to directly. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... - Water Infra https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey https://claroty.com/team82/research/evil-plc-attack-using-a-...
readyplayernull 2y ago
And I just got this from big bro Google: [...] With the new Find My Device network, you’ll be able to locate your devices even if they’re offline. [...] Devices in the network use Bluetooth to scan for nearby items. Full email content: Find My Device network is coming soon You can use Find My Device today to locate devices when they’re connected to the internet. With the new Find My Device network, you’ll be able to locate your devices even if they’re offline. You can also find any compatible Fast Pair accessories when they’re disconnected from your device. This includes compatible earbuds and headphones, and trackers that you can attach to your wallet, keys, or bike. To help you find your items when they’re offline, Find My Device will use the network of over a billion devices in the Android community and store your devices’ recent locations. How it works Devices in the network use Bluetooth to scan for nearby items. If other devices detect your items, they’ll securely send the locations where the items were detected to Find My Device. Your Android devices will do the same to help others find their offline items when detected nearby. Your devices’ locations will be encrypted using the PIN, pattern, or password for your Android devices. They can only be seen by you and those you share your devices with in Find My Device. They will not be visible to Google or used for other purposes. You’ll get a confirmation email in 3 days when this feature is turned on for your Android devices. Until then, you can opt out of the network through Find My Device on the web. Your choice will apply to all Android devices linked to [email]. After the feature is on, you can manage device participation anytime through Find My Device settings on the device. Learn more
gwern 2y ago
Marvin Minsky in 1970 (54 years ago) on how you can't just "turn off the X" when it is a powerful economically-valuable pervasive computer system: "Many computer scientists believe that people who talk about computer autonomy are indulging in a lot of cybernetic hoopla. Most of these skeptics are engineers who work mainly with technical problems in computer hardware and who are preoccupied with the mechanical operations of these machines. Other computer experts seriously doubt that the finer psychic processes of the human mind will ever be brought within the scope of circuitry, but they see autonomy as a prospect and are persuaded that the social impact will be immense. Up to a point, says Minsky, the impact will be positive. “The machine dehumanized man, but it could rehumanize him.” By automating all routine work and even tedious low-grade thinking, computers could free billions of people to spend most of their time doing pretty much as they d—n please. But such progress could also produce quite different results. “It might happen”, says Herbert Simon, “that the Puritan work ethic would crumble to dust and masses of people would succumb to the diseases of leisure.” An even greater danger may be in man’s increasing and by now irreversible dependency upon the computer The electronic circuit has already replaced the dynamo at the center of technological civilization. Many US industries and businesses, the telephone and power grids, the airlines and the mail service, the systems for distributing food and, not least, the big government bureaucracies would be instantly disrupted and threatened with complete breakdown if the computers they depend on were disconnected. The disorder in Western Europe and the Soviet Union would be almost as severe. What’s more, our dependency on computers seems certain to increase at a rapid rate. Doctors are already beginning to rely on computer diagnosis and computer-administered postoperative care. Artificial Intelligence experts believe that fiscal planners in both industry and government, caught up in deepening economic complexities, will gradually delegate to computers nearly complete control of the national (and even the global) economy. In the interests of efficiency, cost-cutting and speed of reaction, the Department of Defense may well be forced more and more to surrender human direction of military policies to machines that plan strategy and tactics. In time, say the scientist, diplomats will abdicate judgment to computers that predict, say, Russian policy by analyzing their own simulations of the entire Soviet state and of the personalities—or the computers—in power there. Man, in short, is coming to depend on thinking machines to make decisions that involve his vital interests and even his survival as a species. What guarantee do we base that in making these decisions the machines will always consider our best interests? There is no guarantee unless we provide it, says Minsky, and it will not be easy to provide—after all, man has not been able to guarantee that his own decisions are made in his own best interests. Any supercomputer could be programmed to test important decisions for their value to human beings, but such a computer, being autonomous, could also presumably write a program that countermanded these “ethical” instructions. There need be no question of computer malice here, merely a matter of computer creativity overcoming external restraints."
1970-01-01 2y ago
One way to see how she is right is by asking how many layers of 'disconnect from the Internet' do you need? Are you expecting a firewall rule of deny all? Closing all ports on the hosts? Ripping away the TCP/IP stack? Where are you expecting the line of success? Remember, all traffic is routable.
halfcat 2y ago
There are many fundamental assumptions that ought to be challenged like this. Does a computer that can access your accounting system need to access the internet? Or email? A user could run two computers, one that’s for internet stuff, and one that does important internal stuff. But that’s a silly idea because it’s costly. However, we can achieve the same thing with virtualization, where a user’s web browser is running in a container/VM somewhere and if compromised, goes away. Stuff like this exists throughout society in general. When should a city employee carry a gun? On one end of the spectrum, the SWAT team probably needs guns. On the other end, the guy who put a note on my door that my fence was leaning into the neighbor’s property didn’t have a gun. So the question is, is a a traffic stop closer to the SWAT team or the guy kindly letting me know I’ve violated a city ordinance? I don’t know why these things don’t get reassessed. Is it that infrastructure is slower to iterate on? Reworking the company’s network infrastructure, or retraining law enforcement departments, is a big, costly undertaking.
justin_oaks 2y ago
> Use the system trust store. Please. I am begging you. I'm looking at you, Node.js and Firefox. Node at least supports an environment variable to add certificates to the list of trusted certs, but it's not as simple as an option to use the system store.

402 points by bathtub365 2y ago

> Here's the thing: virtually the entire software landscape has been designed with the assumption of internet connectivity. The thing the drives me nuts is not even that, which is bad enough, but with the assumption that the Internet connection is always stable and it is legitimate to say "wait until some connections are up" again, as though there are no such things as power outages, network-level errors, cable tears, physical socket failures and such.

asynchronous 2y ago

Great write up on the issues and challenges with airgapped and entirely internet avoidant systems in the modern software world.

gala8y 2y ago
I will piggyback on your comment. Absolutely stellar example of fine grain thinking which accidentally shows huge expertise and real life experience of the author. Regardless of type of a problem, the amount of thinking put into solving it makes the difference. It is thinking in systems, building complex mental models and finding edge cases which pays off, regardless of the domain / problem at hand. People tend to halt too soon in building mental models. When you are responsible for any given area, you better build a fine grained model. Obviously this is costly in terms of time, money, lost opportunity,... and there is of course a blurry line where you should stop building complexity of a model and just implement a solution. Life will come knocking on your door anyways, Aunt Entropy shows up sooner or later. This is also why almost all news is non-sense for an expert in given domain. Basically... "It's not that simple."

jongjong 2y ago

'Disconnect from the internet' is a kind of 'Security through obscurity'; which isn't very good security. It's basically an admission that the software may be full of vulnerabilities and the only way to protect it is to limit its exposure to the outside world. The root of the problem is that almost all software is poorly designed and full of unnecessary complexity which leaves room for exploitation. Companies don't have a good model for quality software and don't aim for it as a goal. They just pile on layer upon layer of complexity. Quality software tends to be minimalistic. The code should be so easy to read that an average hacker could hack it in under an hour if there was an issue with it... But if the code is both simple and there is no vulnerability within it, then you can rest assured that there exist no hackers on the face of the earth who can exploit it in unexpected ways. The attack surface should be crystal clear. You don't want to play a game of cat and mouse with hackers because it's only a matter of time before you come across a hacker who can surpass your expectations. Also, it's orders of magnitude more work to create complex secure software than it is to create simple secure software. The mindset to adopt is that bad code deserves to be hacked. Difficulty involved in pulling off the hack is not a factor. It's a matter of time before hackers can disentangle the complexity.

sureIy 2y ago
> 'Security through obscurity'; which isn't very good security. I never understood this. You never have absolute security, that’s why you must apply the Swiss cheese model. Obscurity is definitely a worthy slice to have. Few people can attack you if you can only be attacked in person.
- Animats 2y ago
  The "Swiss cheese model" worked against amateur attackers. It doesn't hold up against well-funded or patient ones who can work through the holes in each layer. The extreme demo of this was Stuxnet.
  - Pavilion2095 2y ago
    What is better than the Swiss cheese model or its derivatives? Planes still crash from time to time, but nobody is saying that the model is wrong as the reliability is insane.
  - DaSHacka 2y ago
    Hence the purpose behind threat modelling? All security is really just the swiss-cheese model. Some entities just invest in more slices than others to keep more sophisticated/determined attackers out (such as nation states). What other practical model is there for security then defense in depth? "Just make 100% bulletproof computers with no faults?"
    - Animats 2y ago
      Alternative models: - Systems that store the code in read-only memory. Example: slot machines. - Systems with backup systems completely different from the main system, implemented by a different group, and thoroughly tested. Example: Airbus aircraft. - Systems continuously sanity-checked by hard-wired checkers. Example: Traffic lights. - Systems where the important computational functions are totally stateless and hardware reset to a ground state for each transaction. Example: #5 Crossbar.
  - 2y ago

anticristi 2y ago

In Sweden, there is a private network (Sjunet) which is isolated from the Internet. It is used by healthcare providers. Its purpose is to make computers valuable communication devices (I love how the article points this out), but without exposing your hospital IT to the whole Internet. Members of Sjunet are expected to know their networks and keep tight controls on IT. I guess Sjunet can be seen as an industry-wide air-gapped environment. I'd say it improves security, but at a smaller cost than each organization having its own air-gapped network with a huge allowlist.

einpoklum 2y ago
As others suggest: Sjunet is not really "private", in the sense that you can bet that there are unsupervised machines connected to it via some of the legit machines (or via some of the comm. equipment), which are also connected to the rest of the Internet via another Ethernet or WiFi connection. These can in principle expose open ports for interested parties to act as they wish on the "private" network. And they do so despite the reassuring contract which Sjunet members sign.
kreddor 2y ago
Denmark has something quite similar (Sundhedsdatanettet).
- jmnicolas 2y ago
  > Sundhedsdatanettet What a tongue twister for non danish speaking people :D
  - Symbiote 2y ago
    In English we would put spaces between parts of a "compound" word. > Sundheds data nettet Sund-hed is "sound-ness" (or even "sound-hood"), i.e. health. > The health data network
    - ithkuil 2y ago
      Yep. not putting spaces on compound words doesn't twist the tongue but twist the eyes! Eyetwister

RF_Savage 2y ago

There is also hamnet, which is partly internet routable and partly not on the 44Net IP block. https://hamnetdb.net/map.cgi https://hamnetdb.net/map.cgi It has interesting limitations due to the amateur radio spectrum used. Including total ban commercial use. As that is the social contract of the spectrum, you get cheap access to loads of spectrum between 136kHz and 241GHz, but can't make money with it.

wkat4242 2y ago
Yeah it's really hard to get an uplink to it though. Even in a big city. Only in the Netherlands and Germany is it really widespread: https://hamnetdb.net/map.cgi https://hamnetdb.net/map.cgi . Here in Spain it's not available anywhere near me.
- withinboredom 2y ago
  With hamm radio, it doesn't need to be near IIRC. It's been a long af time since I've messed about with radio, but pretty sure you'd be able to use the ionosphere as an antenna.
  - wkat4242 2y ago
    For this it does need to be near. These are all high-speed connections that need line of sight. Basically those microwave dishes that you see everywhere. Or at least a grid reflector or yagi or something. With HF yes you can use the various atmospheric layers to reflect depending on band but in those bands the available bandwidth is extremely low (the entire HF range itself is only 30mhz and the amateurs only have a few small slices of that). The only practical digital operations there are Morse, RTTY (basically telex) and some obscure extremely-slow GPS synced data modes like WISPR and FT8 that are basically for distance bragging rights but don't transmit useful payload. So in effect, no. In this case line of sight or at least short distances (VHF/UHF) are required. Also, I don't have space for huge antennas that HF requires as I'm in a small apartment in the middle of a built-up city.

tjoff 2y ago

Good article, though I really thought it would be about the other end. You know hacking movies in the 90s(?) where the good guys face a hacker-attack, frantically typing at the keyboard trying to keep the hackers away. It is a losing battle though, but just at the nick of time (the progress bar is at 97%) the hero unplugs the power cord or internet cable. Or, in the case of crowdstrike. I can imagine support starts to get some calls, at some time you realize that something has gone horribly wrong. An update, maybe not obvious which, is wreaking havoc. How do you stop it? Have you foreseen this scenario and have a simple switch to stop sending updates? Or, do you cut the internet? Unlike the movies there isn't a single cord to pull, maybe the servers are in a different building or some cloud somewhere. They probably have a CDN, can you pull the files efficiently? Now maybe by the time they discovered this it was mostly too late, all online systems might already have gotten the latest updates (but even if that is the case, do they know that is the case?).

JKCalhoun 2y ago
I have resisted "auto updates" for the OS's of my personal machines. Instead the OS nags me when there is a software update and I just ignore it for a week or so. I assume that any accidentally buggy software update will be found by others (or Apple) first and I can have dodged that particular bullet. Not air-gap, temporal gap.

andrewstuart 2y ago

I don't think systems should not be connected to the Internet. I did find it surprising however that so many systems shown on TV run Windows. Digital signage screens, shopping registers all sorts of stuff that I assumed would be running Linux. It is surprising to me that systems with functions like a cash register would be doing automatic updates at all.

willi59549879 2y ago
It surprised me too. Maybe it is because people are just more used to windows. Or it might be because of more software geared to roll out software updates.
cqqxo4zV46cp 2y ago
Because desktop Linux is an absolute bloody mess and most IT departments are completely justified in not wanting to deal with it? I’m not saying that Windows is great. I haven’t willingly used it in 15 years. But you can’t keep your head in the sand about the sad state of Linux and anything graphical, especially on esoteric hardware. POS systems are often effectively Internet-connected, because they need to report stock levels, connect to financial networks, process BNPL applications, etc. it’s completely warranted to treat them like ‘endpoints’, because they are.
- andrewstuart 2y ago
  I have alot of experience with Linux running Custom builds with chrome. I can say it’s not easy to configure but once done it’s very stable and simple.
- bregma 2y ago
  POS terminals and electronic billboards are not desktops, though, so arguments about desktop software is irrelevant. These are all dedicated application appliances with known, controlled hardware and software constraints. Using a general-purpose desktop designed for corporate executives running Excel and PowerPoint is just the wrong technology choice for such an application. Some kind of specialized Linux-based system, on the other hand, is an excellent choice.

renegat0x0 2y ago

Connection between clownstrike and cybersecurity is flimsy. This was not an attack. This was a resource management problem, a process problem. Meaning: if your process are invalid, you can also fail in off-line scenario. If you do not treat quality control, or tests correctly you gonna have a bad time.

owl57 2y ago
> if your process are invalid, you can also fail in off-line scenario Online amplifies failure at least as well as it amplifies success. Offline maintenance is quite unlikely to bluescreen 8 million devices before anyone has time to figure out something's going wrong.

Imagesegmetanto 2y ago

[dead]

creesch 2y ago

A bit of a tangent to the subject of the blog, but something that has been bugging for a while. What's up with all these blogs that choose fonts that are just not that good for readability? In this case, monospace. It's not code, it is not formatted as code, making it a bad choice for comfortable reading. Are these people not writing blogs to be read? And just to be ahead of it, just because you are able to read it doesn't mean it wouldn't be easier and more comfortable to read in a more suitable font.

0898 2y ago
It’s a retro nod to newsletters like NTK and Popbitch, I believe.
- creesch 2y ago
  I get that it is an aesthetic choice. One I can't really understand given the main purpose of a blog, I think anyway, is to be read.
williamdclt 2y ago
I always think that if I prefer to enable Firefox's reader view on a blog, they _really_ messed up: a bland, basic, generic syling is preferrable to their custom one. It's what happens with most blogs, sadly
- creesch 2y ago
  It is indeed what prompted me to go on this tangent. I see so many blog posts being posted here that are just unnecessarily uncomfortable to read. It's just baffling how a person can spend time and effort to publish something on the internet, clearly wanting people to read it, and then not consider the bare basics.
inetknght 2y ago
> What's up with all these blogs that choose fonts that are just not that good for readability? In this case, monospace. It's not code, it is not formatted as code, making it a bad choice for comfortable reading. That's a subjective opinion. I vastly prefer monospaced fonts. They're easier to read!

lokimedes 2y ago

That pretty well summed up my time delivering state of the art AI solutions to military customers. 80% of the effort was getting internet-native tooling to work seamlessly in an air-gapped environment.

gizmo 2y ago

> But that just, you know, scratches the surface. You probably develop and deploy software using a half dozen different package managers with varying degrees of accommodation for operating against private, internal repositories. That's non-ironically the problem. Current software culture creates "secure software" with a 200 million line of code attack surface and then act surprised when it blows up spectacularly. We do this because there is effectively no liability for software vendors or for their customers. What software security vendors sell is regulatory compliance, not security.

rowbin 2y ago

>> The stronger versions, things from List 1 and List 2, are mostly only seen in defense and intelligence And I don't think that is enough. I agree that it easier and sufficient for most systems to just be connected over the internet. But health, aviation and critical infrastructure in general should try to be offline as much as possible. Many of the issues described with being offline stem from having many third party dependencies (which typically assume internet access). In general but for critical infrastructure especially you want as little third party dependencies as possible. Sure it's not as easy as saying "we don't want third party dependencies" and all is well. You'll have to make a lot of sacrifices. But you also have a lot to gain when dramatically decreasing complexity, not only from a security standpoint. I really do believe there are many cases where it would be better to use a severely limited tech stack (hardware and software) and use a data diode like approach where necessary. One of the key headaches mentioned when going offline is TLS. I agree and I think the solution is to not use TLS at all. Using a VPN inside the air-gapped network should be slightly better. It's still a huge headache and you have to get this right, but being connected to the internet at all times is also a HUGE headache.

fifteen1506 2y ago

The author is failing to see a potential solution. Whitelist all needed IPs for business functionality, enable the whole Internet once every 3 hours for an hour. Bonus points if you can do it by network segment. It would be enough to spare half your computers from the CrowdStrike issue, since I believe the update was pulled after an hour. Will any-one do this? Probably not. But it is worth entertaining as a possibility between the fully on connectivity and the fully disconnected.

vel0city 2y ago
> Whitelist all needed IPs for business functionality I really don't like this mentality. The IP I'm serving some service might change. DNS is a useful thing.
- deathanatos 2y ago
  Security types love it. But from a infra eng viewpoint, it's an utter pain in the ass, and the thought of "what if IP changes?" — which inevitably happens — has no process, no plan, and ends up as "manually update O(n) different configurations, of which there does not exist a list of, so you'll never know if you got them all."
  - fifteen1506 2y ago
    You're of course right. My proposal would fall flat on its face the moment that ocurred. Doesn't mean it couldn't work. See for example, Microsoft's ZeroTrust DNS.
deathanatos 2y ago
> It would be enough That depends on the phase of your "every 3 hours for an hour" signal, and the phase of "the update was pulled after an hour.". That's a 33% overlap. Feelin' lucky?

eqqn 2y ago

"Don't worry, the software in question seems to have fallen out of favor and cannot hurt you." It may not be the software in question, but proprietary snowflake entitlement management software that has a lot of black box and proprietary voodoo, that does not have any disaster recovery capacity and would be considered tech debt a decade ago... Disgracefully came into life in the year 2021. It did not gracefully recover from clownstrike to say the least.

flumpcakes 2y ago

I work in security/systems/ops/etc. and fundamentally disagree with this premise. I understand the author is saying "it's not that easy" and I agree completely with that, but I don't agree that it means you're doing your job well. Unfortunately the vast majority of people do their jobs poorly. The entire industry is set-up to support people doing their job poorly and to make doing your job well hard. If I deploy digital signage the only network access it should have is whitelisted to my servers' IP addresses and it should only accept updates that are signed and connections that have been established with certificate pinning. This makes it nearly impossible for a remote attacker to mess with it. Look at the security industry that has exploded from the rise of IoT. There's signage out there (replace with any other IoT/SCADA/deployed device) with open ports and default passwords, I guarantee it. IoT is just a computer, but it's also a computer that you neglect even more than the servers/virtual machines you're already running poorly. People don't want to accept this, or even might be affronted by this. There are some places doing things well - but it's the vast minorities of companies out there, because you are not incentivised to do things well. "Best practises" or following instructions from vendors does not mean you are doing things well. It means you are doing just enough that a vendor can be bothered to support. Which in a lot of cases is unfettered network access.

hypeatei 2y ago
For IoT in particular, you hit a crossroads where the embedded devs haven't really dealt with advanced security concepts so you kinda have to micromange the implementation. And, in small teams it's hard to justify the overhead of managing x509 certs and all the processes that come along with it. Just my personal experience.
- szundi 2y ago
  Yeah you know, just roll out our MVP, let's see where the business goes with it, and then we'll fix it. Whaat? Budget of fixing it is 2x of the product itself? Hm. Let's have meetings over meetings to postpone the decision until the next one, indefinitely - we cannot really make the decision not to do it of course.
- throw0101a 2y ago

NoboruWataya 2y ago

It seems fairly obvious that an airline reservation system needs to be connected to a network at least, I haven't heard many people claim they should have been all offline. But for example I heard stories of lathe machines in workshops that were disabled by this. You gotta wonder whether they really needed to be online. (I'm sure there are reasons, but they are reasons that should be weighed against the risks.) Beyond that there are plenty of even more ridiculous examples of things that are now connected to the internet, like refrigerators, kettles, garage doors etc. (I don't know if many, or any, of these things were affected by the CrowdStrike incident, but if not, it's only a matter of time until the next one.) As for the claim that non-connected systems are "very, very annoying", my experience as a user is that all security is "very, very annoying". 2FA, mandatory password changing, locked down devices, malware scanners, link sanitisers - some of it is necessary, some of it is bullshit (and I'm not qualified to tell the difference), but all of it is friction.

kwhitefoot 2y ago
> a network Of course. But not the Internet.

tormeh 2y ago

I remain unconvinced that you shouldn't air-gap systems because that means you can't use internet-centric development practices. I find this argument absurd. The systems that should have their ethernet ports epoxyed also should never have been programmed using internet-centric development practices in the first place. Your MRI machine fetches JS dependencies from NPM on boot? Straight to jail. Not metaphorically.

redundantly 2y ago
> Your MRI machine fetches JS dependencies from NPM on boot? Straight to jail. Not metaphorically. Damned right. That would be a special type of malfeasance that should earn criminal punishment, if healthcare equipment worked that way.

forinti 2y ago

After watching a video of a person playing with a MacDonald's kiosk, I started to do the same with equipment I found at different places. One food court had kiosks with Windows and complete access to the Internet. Somebody could download malware and steal credit card data. Every time I used one, I turned it off or left a message on the screen. Eventually they started running it in kiosk mode. Another was a parking kiosk. It was never hardened. I guess criminals haven't caught on to this yet. The third was an interactive display for a brand of beer. This one wasn't going to cause any harm, but I liked to leave Notepad open with "Drink water" on it. Eventually they turned it off. That's one way to fix it, I guess.

remus 2y ago
> Another was a parking kiosk. It was never hardened. I guess criminals haven't caught on to this yet. I don't know the details of how the parking kiosks near me are setup, but I can only assume they're put together really poorly because once, after mashing buttons in frustration, it started refunding me for tickets that I'd not purchased. You'd have thought "Don't give money to random passers by" would have been fairly high on the list of requirements, but there we are.
golergka 2y ago
If you open a browser with porn on it, they will get fixed very, very fast.

gz5 2y ago

we can use the Internet without being used by the Internet. an open source example: https://blog.openziti.io/no-listening-ports https://blog.openziti.io/no-listening-ports

djha-skin 2y ago

> If you are operating a private network, your internal services probably don't have TLS certificates signed by a popular CA that is in root programs. You will spend many valuable hours of your life trying to remember the default password for the JRE's special private trust store and discovering all of the other things that have special private trust stores, even though your operating system provides a perfectly reasonable trust store that is relatively easy to manage, because of Reasons. You will discover that in some tech stacks this is consistent but in others it depends on what libraries you use. Oof, I feel this one. I tried to get IntelliJ's JRE trust store to understand that there was a new certificate for zscaler that it had to use and there were two or three different JDKs to choose from, and all of their trust stores were given the new certificate and it still didn't work and we didn't know why.

llm_trw 2y ago

The description of updates is painfully true. A long time ago I worked at a broker trader where all communications, including servers communications, had to go through zscaler as a man in the middle. What had been routine all of a sudden became impossible. Turns out that git, apt, pip, cabal and ctan all had different ideas about how easy they should make this. After a month of fighting each of them I gave up. I just downloaded everything from their public ftp repos and build from source over a week. I wish good luck to whoever had to maintain it.

RajT88 2y ago

My big take-away is not that "all these systems shouldn't be connected to the internet", it's a few other things: 1. These systems shouldn't allow outbound network flows. That will stop all auto-updates, which you can then manage via internal distribution channels. 2. Even without that, you can disable auto-updates on many enterprise software products - Windows notably, but also Crowdstrike itself. I heard about CS customers disabling auto-update and doing manual rollouts who were saved by this practice. 3. Tacking on to number 2 - gradual rollout of updates which you've done some smoke testing on. Just in case. Again - I heard of CS customers who did a gradual rollout, and managed to only have a fraction of their machines impacted.

LeifCarrotson 2y ago

I'm a controls engineer. I've built hundreds of machines, they do have Ethernet cables for fieldbus networks but should never be connected to the Internet. Every tool and die shop in your neighborhood industrial park contains CNC machines with Ethernet ports that cannot be put on the Internet. Every manufacturing plant with custom equipment, conveyor lines and presses and robots and CNCs and pump stations and on and on, use PLC and HMI systems that speak Ethernet but are not suitable for exposure to the Internet. The article says: > In other words, the modern business computer is almost primarily a communications device. > There are not that many practical line-of-business computer systems that produce value without interconnection with other line-of-business computer systems. which ignores the entirety of the manufacturing sector as well as the electronic devices produced by that sector. Millions of embedded systems and PLCs produce value all day long by checking once every millisecond whether one or more physical or logical digital inputs have changed state, and if so, changing the state of one or more physical or logical digital outputs. There's no need for the resistance welder whose castings were built more than a century ago, and whose last update was to receive a PLC and black-and-white screen for recipe configurations in 2003 to be updated with 2024 security systems. You just take your clipboard to it, punch in the targets, and precisely melt some steel. Typically, you only connect to machines like this by literally picking up your laptop and walking out to the machine with an Ethernet patch cable. If anything beyond that, I expect my customers to put them on a firewalled OT network, or bridge between information technology (IT) and operations technology (OT) with a Tosibox, Ixon, or other SCADA/VPN appliance.

bo1024 2y ago
It's reassuring that such things still exist. My mental model of consumer hardware is that they take devices like the ones you describe, and just add wifi, bluetooth, telemetry, ads, and an app.
MerManMaid 2y ago
PLCs are explicitly considered high value targets as they control large swaths of a nation-states critical infrastructure as well as connect to high value end-points in air-gapped networks. Now perhaps you're not working on anything someone might want to exploit, but PLCs are often found in critical infrastructure as well as high-end manufacturing facilities, which make them attractive targets for malicious actors. Whether because they're attempting to exploit critical infrastructure or infect a poorly secured device that high value end-points (such as engineering laptops) might eventually connect to directly. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a https://www.cisa.gov/news-events/cybersecurity-advisories/aa... - Water Infra https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey https://claroty.com/team82/research/evil-plc-attack-using-a-...

readyplayernull 2y ago

And I just got this from big bro Google: [...] With the new Find My Device network, you’ll be able to locate your devices even if they’re offline. [...] Devices in the network use Bluetooth to scan for nearby items. Full email content: Find My Device network is coming soon You can use Find My Device today to locate devices when they’re connected to the internet. With the new Find My Device network, you’ll be able to locate your devices even if they’re offline. You can also find any compatible Fast Pair accessories when they’re disconnected from your device. This includes compatible earbuds and headphones, and trackers that you can attach to your wallet, keys, or bike. To help you find your items when they’re offline, Find My Device will use the network of over a billion devices in the Android community and store your devices’ recent locations. How it works Devices in the network use Bluetooth to scan for nearby items. If other devices detect your items, they’ll securely send the locations where the items were detected to Find My Device. Your Android devices will do the same to help others find their offline items when detected nearby. Your devices’ locations will be encrypted using the PIN, pattern, or password for your Android devices. They can only be seen by you and those you share your devices with in Find My Device. They will not be visible to Google or used for other purposes. You’ll get a confirmation email in 3 days when this feature is turned on for your Android devices. Until then, you can opt out of the network through Find My Device on the web. Your choice will apply to all Android devices linked to [email]. After the feature is on, you can manage device participation anytime through Find My Device settings on the device. Learn more

gwern 2y ago

Marvin Minsky in 1970 (54 years ago) on how you can't just "turn off the X" when it is a powerful economically-valuable pervasive computer system: "Many computer scientists believe that people who talk about computer autonomy are indulging in a lot of cybernetic hoopla. Most of these skeptics are engineers who work mainly with technical problems in computer hardware and who are preoccupied with the mechanical operations of these machines. Other computer experts seriously doubt that the finer psychic processes of the human mind will ever be brought within the scope of circuitry, but they see autonomy as a prospect and are persuaded that the social impact will be immense. Up to a point, says Minsky, the impact will be positive. “The machine dehumanized man, but it could rehumanize him.” By automating all routine work and even tedious low-grade thinking, computers could free billions of people to spend most of their time doing pretty much as they d—n please. But such progress could also produce quite different results. “It might happen”, says Herbert Simon, “that the Puritan work ethic would crumble to dust and masses of people would succumb to the diseases of leisure.” An even greater danger may be in man’s increasing and by now irreversible dependency upon the computer The electronic circuit has already replaced the dynamo at the center of technological civilization. Many US industries and businesses, the telephone and power grids, the airlines and the mail service, the systems for distributing food and, not least, the big government bureaucracies would be instantly disrupted and threatened with complete breakdown if the computers they depend on were disconnected. The disorder in Western Europe and the Soviet Union would be almost as severe. What’s more, our dependency on computers seems certain to increase at a rapid rate. Doctors are already beginning to rely on computer diagnosis and computer-administered postoperative care. Artificial Intelligence experts believe that fiscal planners in both industry and government, caught up in deepening economic complexities, will gradually delegate to computers nearly complete control of the national (and even the global) economy. In the interests of efficiency, cost-cutting and speed of reaction, the Department of Defense may well be forced more and more to surrender human direction of military policies to machines that plan strategy and tactics. In time, say the scientist, diplomats will abdicate judgment to computers that predict, say, Russian policy by analyzing their own simulations of the entire Soviet state and of the personalities—or the computers—in power there. Man, in short, is coming to depend on thinking machines to make decisions that involve his vital interests and even his survival as a species. What guarantee do we base that in making these decisions the machines will always consider our best interests? There is no guarantee unless we provide it, says Minsky, and it will not be easy to provide—after all, man has not been able to guarantee that his own decisions are made in his own best interests. Any supercomputer could be programmed to test important decisions for their value to human beings, but such a computer, being autonomous, could also presumably write a program that countermanded these “ethical” instructions. There need be no question of computer malice here, merely a matter of computer creativity overcoming external restraints."

1970-01-01 2y ago

One way to see how she is right is by asking how many layers of 'disconnect from the Internet' do you need? Are you expecting a firewall rule of deny all? Closing all ports on the hosts? Ripping away the TCP/IP stack? Where are you expecting the line of success? Remember, all traffic is routable.

halfcat 2y ago

There are many fundamental assumptions that ought to be challenged like this. Does a computer that can access your accounting system need to access the internet? Or email? A user could run two computers, one that’s for internet stuff, and one that does important internal stuff. But that’s a silly idea because it’s costly. However, we can achieve the same thing with virtualization, where a user’s web browser is running in a container/VM somewhere and if compromised, goes away. Stuff like this exists throughout society in general. When should a city employee carry a gun? On one end of the spectrum, the SWAT team probably needs guns. On the other end, the guy who put a note on my door that my fence was leaning into the neighbor’s property didn’t have a gun. So the question is, is a a traffic stop closer to the SWAT team or the guy kindly letting me know I’ve violated a city ordinance? I don’t know why these things don’t get reassessed. Is it that infrastructure is slower to iterate on? Reworking the company’s network infrastructure, or retraining law enforcement departments, is a big, costly undertaking.

justin_oaks 2y ago

> Use the system trust store. Please. I am begging you. I'm looking at you, Node.js and Firefox. Node at least supports an environment variable to add certificates to the list of trusted certs, but it's not as simple as an option to use the system store.