30 ms·
European govt air-gapped systems breached using custom malware
- binary_slinger 2y agoI’m a bit disappointed the mechanism to exfiltrate data is based on sharing the USB between an internet-connected and air gapped devices. It would have been cool if it used some other side channel like acoustic signals.
- ChocolateGod 2y agoJust wait till neuralink gets hacked and people themselves become the side channel.
- A4ET8a8uTh0 2y agoI am not sure why you are being downvoted. Just like fridges, cars, ovens gained internet access, enhanced humans will be extremely likely to be, eventually -- and possibly with interesting consequences -- hacked.
- dingnuts 2y agoif Neuralink became pervasive like smartphones I'd join the Amish
- MOARDONGZPLZ 2y agoLike the January 6 question, I’m assuming that anyone who had a neuralink would likely be ineligible for any sort of clearance to access information like this.
- A4ET8a8uTh0 2y agoI am not as certain. Sure, Musk and his product are no longer 'cool' given his move to US political right faction, but tech is tech. Some tried banning cell phones and whatnot and the old guard there had to adjust their expectations. In short, I am not sure you are right about it. If anything, and I personally see it as a worst case scenario, use of that contraption will be effectively mandatory the way having cell phone is now ( edit: if you work for any bigger corp that and and want to log from your home ).
- MOARDONGZPLZ 2y agoAs far as I am aware, no electronic devices from outside, and no devices that transmit anything, are allowed in these high security areas. That’s inclusive of cell phones, for example. That is: the point I am making is more nuanced than whether something is popular (like cell phones or other tech).
- A4ET8a8uTh0 2y agoOh, I am sure there are restrictions for the rank and file, but the higher ups with such access can ( and apparently do ) get exceptions[1] and while this is one of the more visible examples, I sincerely doubt he is the only one. [1]https://www.wired.com/2017/01/trump-android-phone-security-threat/ https://www.wired.com/2017/01/trump-android-phone-security-t...
- renewiltord 2y agoYou can already hack people by just telling them things. Many of them will do dumb shit if you just use the right words.
- A4ET8a8uTh0 2y agoI like the analogy. Lets explore it a little. << You can already hack people by just telling them things. True, but language fluctuates, zeitgeist changes and while underlying techniques remain largely the same, what nationstate would not dream of being able to simply have people obey when it tells them to do behave in a particular way. Yes, you can regimen people through propaganda, but what if it you could do it more easily this way?
- renewiltord 2y agoCertainly people would like an API for others without needing to reverse engineer them. Agreed that there is a threshold of simplicity past which it becomes easier to organize than having to give speeches and run propaganda.
- willy_k 2y ago> True, but language fluctuates, zeitgeist changes and while underlying techniques remain largely the same This applies to software as well > Yes, you can regimen people through propaganda, but what if it you could do it more easily this way? Widespread use of BCIs would help with this for sure, but don’t be under the impression that individual and population level manipulation techniques haven’t progressed well past simple propaganda.
- A4ET8a8uTh0 2y ago<< don’t be under the impression that individual and population level manipulation techniques haven’t progressed well past simple propaganda. I absolutely buy it based merely on the glimpse of the document from various whistleblowers over the years. At this point, I can only imagine how well oiled a machine it must be.
- 2y ago
- rad_gruchalski 2y ago> I am not sure why you are being downvoted. Trigger-happy emotional non-intelligence.
- ruthmarx 2y agoThat's not really true, in that context security will largely be a solved problem. Using chips with a secure architecture, safe languages and safe protocols is going to result in secure implants. Not to say there might not be some new vulnerability, but I disagree with this idea people love to repeat that security is impossible.
- bigiain 2y agoSecurity will never be a "largely solved problem", when there are humans involved (and probably even when humans are not involved). There is no technical solution to people uploading high res photos with location metadata to social network de jour. Or the CEO who wants access to all his email on his shiny new gadget. Or the three letter agency who think ubiquitous surveillance is a great way to do their job. Or the politician who can be easily convinced the backdoors that can only be used by "the good guys" exist. Or the team who does all their internal chat including production secrets in a 3rd party chat app, only to have them popped and their prod credentials leaked on some TOR site. Or the sweatshop IT outsourcing firm that browbeats underpaid devs into meeting pointless Jira ticket closure targets. Or the "move fast and break things" startup culture that's desperately cutting corners to be first-to-market. None of the people involved in bringing "enhanced human" tech to market will be immune to any of those pressures. (I mean, FFS, in the short term we're really talking about a product that _Elon_ is applying his massive billionaire brain to, right? I wonder what the media friendly equivalent term to "Rapid Unscheduled Disassembly" for when Nerualink starts blowing up people's brains is going to be?)
- ruthmarx 2y ago> Security will never be a "largely solved problem", when there are humans involved (and probably even when humans are not involved). It absolutely will. I didn't say completely solved, I said largely solved. > There is no technical solution to people uploading high res photos with location metadata to social network de jour. Bad example honestly, since most social media sites strip out exif data by default these days. Not sure there are any that don't. > Or the CEO who wants access to all his email on his shiny new gadget. Or the three letter agency who think ubiquitous surveillance is a great way to do their job. Or the politician who can be easily convinced the backdoors that can only be used by "the good guys" exist. Or the team who does all their internal chat including production secrets in a 3rd party chat app, only to have them popped and their prod credentials leaked on some TOR site. Or the sweatshop IT outsourcing firm that browbeats underpaid devs into meeting pointless Jira ticket closure targets. Or the "move fast and break things" startup culture that's desperately cutting corners to be first-to-market. Yes yes, humans can be selfish and take risks and be bribed and negligent and blah blah blah. The context of the comment was in neuralink implants getting hacked the way an out of date smart tv might. As when it comes to the actual tech, security will be a solved problem, because most of the problems we see today are due to everything being built on top of insecure foundations on top of insecure foundations.
- m463 2y agothe-computer-wears-sneakers-net
- dexwiz 2y agoThis is the plot of most of Ghost in the Shell. That series looks more and more prescient as time goes on. Another big plot point is that most of the internet is just AIs talking to each other. 10 years ago that sounded ridiculous, now not so much.
- Terr_ 2y agoAlso how super-sensitive may be kept on physical books and papers, albeit in a form scannable by optic implants.
- bigiain 2y ago"Ralfi was sitting at his usual table. Owing me a lot of money. I had hundreds of megabytes stashed in my head on an idiot savant basis, information I had no conscious access to. Ralfi had left it there. He hadn't, however, came back for it." -- Johnny Mnemonic, William Gibson, 1981
- 4ggr0 2y agoIf you're a gamer, you should try Cyberpunk2077 :D Currently playing it, at over 200 hours, and it really feels like a scarily accurate, techno-dystopian version of our world.
- getwiththeprog 2y agoIt is my view that television and other propaganda can hack persons.
- olalonde 2y agoYou might like the movie Videodrome[0]. [0] https://en.wikipedia.org/wiki/Videodrome https://en.wikipedia.org/wiki/Videodrome
- LargoLasskhyfv 2y agohttps://en.wikipedia.org/wiki/Snow_Crash https://en.wikipedia.org/wiki/Snow_Crash , or much of https://en.wikipedia.org/wiki/Philip_K._Dick https://en.wikipedia.org/wiki/Philip_K._Dick , especially https://en.wikipedia.org/wiki/The_Man_in_the_High_Castle https://en.wikipedia.org/wiki/The_Man_in_the_High_Castle or https://en.wikipedia.org/wiki/The_Man_in_the_High_Castle_(TV_series) https://en.wikipedia.org/wiki/The_Man_in_the_High_Castle_(TV... Or https://en.wikipedia.org/wiki/The_Giver https://en.wikipedia.org/wiki/The_Giver / https://en.wikipedia.org/wiki/The_Giver_(film) https://en.wikipedia.org/wiki/The_Giver_(film) Or https://en.wikipedia.org/wiki/The_Congress_(2013_film) https://en.wikipedia.org/wiki/The_Congress_(2013_film) Or Nineteeneightyfour and so much more...(yawn)... Or
- nullc 2y agoyou don't need that, just make the airgapped system give odd error messages that people will google across the gap.
- zahlman 2y agoI felt like the article spent way too many words to explain the idea of "the agency shared data across the air gap using USB drives, and a vulnerability was used to surreptitiously copy the malware onto the USB and then onto the target machine", and AFAICT none on explaining what that vulnerability is or why it exists (or existed). Then the rest is standard malware-reversing stuff that doesn't say anything interesting except to other malware reverse engineers. The inner workings of the tools aren't interesting from a security perspective; the compromise of the air gap is. (As for acoustic etc. side-channel attacks: these would require a level of physical access at which point the air gap is moot. E.g. if you can get a physical listening device into the room to listen to fan noise etc. and deduce something about the computation currently being performed, and then eventually turn that into espionage... you could far more easily just directly use the listening device for espionage in the form of listening to the humans operating the computers.)
- ghostly_s 2y agoThere was no novel vulnerability. The pwned machine just replaced a recently-accessed folder on the stick with an exe to trick the user into executing it on the target machine.
- authorfly 2y agoYeah it is very bloated. I am suspicious that the article was bloated with AI rather than a human, though. I wonder if they either made the first section as a summary or extended sections necessarily. For example, early on it says: " collect interesting information, process the information, exfiltrate files, and distribute files, configurations and commands to other systems." and later on: " they were used, among other things, to collect and process interesting information, to distribute files, configurations, and commands to other systems, and to exfiltrate files." It also mentions several times that the attack on a South Asian countries embassy was the first time this software was seen. Repeating info like this was kind of a sign of part-applied AI edits with RAG a while ago, might still be true today.
- aenis 2y agoYup, no respect for the people who published the article. It was one paragraph of content impossibly diluted. TLDR: some idiots allowed USB sicks to be plugged into the supposedly air-gapped system. Hilarity ensued.
- RicoElectrico 2y agoSuch side channel attacks are academic. In fact someone on HN pointed out there's a researcher that invents new ones by the dozen and media run with it whenever he presents another one.
- bawolff 2y agoI mean, someone who researches security of airgap computers continually coming up with new ways to break them, seems like the expected outcome. Its their job after all.
- 6510 2y agoI would start by asking what they need computers for. You don't really need one to read text from a screen. Of that most would be old documents that for the most part should be public. What remains besides reading is most likely 95% stuff they shouldn't be doing. The most secure part is the stuff we wish they were doing.
- baseballdork 2y agoI’m having a real hard time understanding what this comment is saying. Are you asking what high side computers are used for besides reading classified information?
- 6510 2y agoMaybe, I could also be asking why you would use a computer if all you want is to read documents. If you have an operator send a telegram for you that person is capable of doing a lot more with your text than you want. On the other end is another telegram operator to further increase the risk. You might want to send a letter in stead. It's slower but more secure. If you want to read text from a monitor a computer is super convenient but like the operator it can do other things you don't want. You don't need a computer to put text on a screen. Alternatives might be slow and expensive but in this case you don't have to send things to the other side of the world. That would be the thing you specifically don't want.
- whartung 2y agoOne of my favorite hacks of yore was somehow some folks managed to compromise the iPod to that point that they could run some of their code, and make a beep. They compressed the ROM, and "beeped" it out, wrapping the iPod in an acoustic box, recording it, and then decoding it to decode the ROM.
- Scoundreller 2y agoI think it was more of a “click” Back in the ?ps/2? days, I had a joke equalizer plugin for Winamp that used the 3 LEDs on your keyboard. Another output device!
- benoau 2y agoThe weak-point is the shared USB device that copies from one machine to another which seems to defeat the whole purpose of being air-gapped - you could have printed-and-OCR'd data three decades ago so the air-gapped machine is never reading anything from outside at all, these days a video stream and AI could probably automate that?
- kibwen 2y agoSurely some government has come up with physically-unidirectional data transmission mechanisms for getting data onto airgapped networks. There has to be something more sophisticated than single-use CD-ROMs, even if it's just a blinking LED on one end and a photosensor on the other end.
- neonz80 2y agohttps://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
- maxerickson 2y agoWhich ironically describes them evolving into software driven gateways.
- wannacboatmovie 2y ago> There has to be something more sophisticated than single-use CD-ROMs But why, when a DVD-R handles most use cases at a cost of < $0.25 each, are reliable and ubiquitous, the hardware is likely already there (unless you are using Apple - caveat emptor) and they close the threat vector posed by read/write USB devices. Sometimes the simplest solution is the best solution.
- rhcom2 2y agoI would guess having a CD/DVD drive opens another attack surface. Similar to why people gluing their USB ports closed.
- GianFabien 2y agotldr: The breach relied on careless human(s) using USB key to and from the air-gapped systems. All the clever technology would have been for naught had the staff used robust physical security procedures.
- ungreased0675 2y agoWhat protocol would you have recommended?
- Woodi 2y agoI don't know, but maybe DO NOT USING systems with ShowSuperHidden features would help ? Such thing just MUST BE a helper for creating malwares, what else it could be ? Definitely for circumventing human users. Good job Microsoft ! Autoexec.bat is proud of you ! /s
- anthk 2y agoI woudn't use Windows at all. USB media? Authentificated and encrypted, with some system like NNCP and a little multiplaform Go based GUI (or heck, TCL/Tk) on top.
- beAbU 2y agoBased on other comments here, typically the USB key is destroyed after the data was copied into the network. No data is allowed to exit the airgapped network. Read-only media or destroying the media after use is a reasonable mechanism to protect against data exfiltration. I'm not sure how you protect against infiltration though. A computer system that cannot get data in is pretty useless methinks.
- firesteelrain 2y agoUSB can be OK however you need like a staging machine and scan the files before entry plus use of a write block device on the USB hard drive. These are commonly used in forensics. https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-cftt/cftt-technical/hardware https://www.nist.gov/itl/ssd/software-quality-group/computer... This also tends to be a supply chain and insider threat.
- lolc 2y agoReminds me of the time I was looking after a SECURE system: One of the tasks was the daily update of the antivirus. So I would grab the blessed stick, insert it into the Internet-PC, and using FTP would download the latest antivirus update. Then I'd walk over to the SECURE system, insert the stick, and run the exe from the stick. There, system SECURED for today! Norton, trust no other!
- elcritch 2y agoThat sounds like an ideal attack vector! Norton and other AV have elevated privileges with an opaque data format ready to be exploited.
- matrix2003 2y agoI’m of the opinion that 3rd party security software is malware. If it isn’t today, a future acquisition or enshittification ensures that it will be.
- b112 2y agoWhile true, the future is the future, and not entirely relevant. Or do you eschew using a fork, because in 12 weeks in will fall on the floor? Certainly, the problem is secret falls on the floor. The ones we can see can be handled. This problem even happens with brand names, with hardware. You buy a fridge, and a decade later go to buy another. Meanwhile, megacorp has been bought by a conglomerate, and brand name is purposefully crap.
- im3w1l 2y agoImagine, if you will a bed of gold embroidered and wrought with the most excuisite works. Above the bed however is a sharp sword suspended on a single hair of a horse's tail. Would you avoid relaxing on the the bed because the sword may fall and kill you at some point in the future?
- matrix2003 2y ago
- daguava 2y ago[dead]
- userbinator 2y agoUnless I'm missing something, this doesn't rely on something really advanced and low-level like USB drive firmware, but a classic flaw that's existed in Windows for almost 30 years: It is probable that this unknown component finds the last modified directory on the USB drive, hides it, and renames itself with the name of this directory, which is done by JackalWorm. We also believe that the component uses a folder icon, to entice the user to run it when the USB drive is inserted in an air-gapped system, which again is done by JackalWorm. It's just another variant of the classic .jpg.exe scam. Stop hiding files and file extensions and this hole can be easily closed.
- upofadown 2y agoAn air gapped system should not allow regular users to run random executables under any circumstances, much less directly off a USB drive. Windows probably is not suitable for such use.
- no-reply 2y agoIsn't this how the stuxnet got into Iranian facilities?
- 1oooqooq 2y agoi think for that one they bribed/coherced one insider to explicitly insert a bad USB on the system.
- EvanAnderson 2y agoGiven the discipline surrounding most "air gapped" machines I've seen I always find this quote appropriate: "At best, an air gap is a high-latency connection" -Ed Skoudis - DerbyCon 3.0
- nonrandomstring 2y agoSome organisatios increase this latency by filling the USB ports with hot glue.
- guenthert 2y agoFor the old SunRay thin clients one could disable the USB ports by policy (and enable for certain users, iirc). That was an important feature there, as one intended application was as public kiosk systems, e.g. in a library. The same is possible in Windows 10 and 11, but the users will revolt, if a sysadmin were to enforce such (the same users who insist on using Windows instead of a more secure system).
- formerly_proven 2y ago> the same users who insist on using Windows People don’t like windows let alone corporate deployments of windows.
- londons_explore 2y agoPlenty of organisations enforce "no USB devices" on all their users. Not even super secure places, but just many regular admin-type office workers get their USB ports disabled in software. Partly it's to prevent leaking of company secrets, unauthorized use of corporate devices for home use, harder to track the location of data, as well as the possibility of malware.
- barbazoo 2y agoInteresting. So no USB camera, headset, etc either?
- notorandit 2y agoI would bet that those air-gapped systems are running some version of MS windows.
- 3np 2y ago> As was the case in the Kaspersky report, we can’t attribute GoldenJackal’s activities to any specific nation-state. There is, however, one clue that might point towards the origin of the attacks: in the GoldenHowl malware, the C&C protocol is referred to as transport_http, which is an expression typically used by Turla (see our ComRat v4 report) and MoustachedBouncer. This may indicate that the developers of GoldenHowl are Russian speakers. This is quite a stretch. So we have nothing so far.
- OgsyedIE 2y agoAny malware production outfits that aren't using adversarial stylometry in this market are leaving money on the table. Just plain bad business sense.
- deleted 2y ago[deleted]
- blueredmodern 2y agoYou generally want to avoid getting malware into your network, but it is even more important to avoid allowing for exfiltration of data. So the "copy via USB-stick" serves a purpose and makes it MUCH harder to exfiltrate data.
- razakel 2y agoUse a DVD-R with a read-only drive on the air-gapped machine. Much easier to audit than an evil USB.
- firesteelrain 2y agoThis is an old attack vector. No one is learning from history. The organizations being hit have poor cybersecurity. https://en.wikipedia.org/wiki/2008_malware_infection_of_the_United_States_Department_of_Defense https://en.wikipedia.org/wiki/2008_malware_infection_of_the_...
- convivialdingo 2y agoSuper old… my first experience with a “virus” was an Amiga boot sector attack from 1986! At the time the morris worm had inspired some folks to see if they could spread binaries by infecting every disk inserted. That’s all it did….. spread. I think the virus lives off an interrupt generated by disk insertions. Fortunately it was harmless (except for a few extra crashes) and I had my original OS disks that could be booted from to clean up the disks.
- edanm 2y agoJust in case anyone isn't aware of this history - the "Morris worm" being referred to here is named after Robert Morris who wrote it. He's also one of the co-founders of YC, which built HN.
- amatecha 2y agoAs soon as the article started describing malware being installed upon insertion of a USB thumb drive, I had to Ctrl-F for "Windows", and indeed, of course that's the OS these machines are running. I'd be really curious to hear of stories like this where the attacked OS is something a little less predicable/common.
- Aachen 2y agoAs a Linux user, I'll defend Microsoft here and say that I'd rather suspect it's a sign of Windows' prevalence than Windows' (un)safety. Around the Snowden leaks I had a different opinion but nowadays I feel like those calling the shots at Microsoft realised it's no longer an optional component or that security is merely a marketing story
- fsflover 2y agoActually, if security is the goal, I expected that they would use a security-oriented OS (e.g., Qubes OS).
- diggan 2y ago> I feel like those calling the shots at Microsoft realised it's no longer an optional component or that security is merely a marketing story I dunno, if a company has for more than two decades (2002: https://www.cnet.com/tech/tech-industry/gates-security-is-top-priority/ https://www.cnet.com/tech/tech-industry/gates-security-is-to...) said that security is the top priority, and they keep re-iterating that every now and then (2024: https://blogs.microsoft.com/blog/2024/05/03/prioritizing-security-above-all-else/ https://blogs.microsoft.com/blog/2024/05/03/prioritizing-sec...), yet they still don't actually seem to act like it, I'm pretty sure they still see it as an optional component/marketing story.
- Aachen 2y ago> I dunno, if [they've been saying it for 25 years], yet they still don't actually seem to act like it That's what I'm saying though: from my point of view, they've started to act like it in the last ~20 years. If you've got evidence to the contrary, feel free to share it. From my pov, they're about as perfect as the average other for-profit, which is not very security-in-depth at all but it's not just a marketing sham anymore either the way that it used to be. From Bitlocker to Defender to their security patching and presumably secure coding practices, it's not the same company that it was when they launched XP. A lot of the market seems to have grown up and, at least among our customers, we're finding fewer trivial issues At any rate, this subthread started by saying this standard Windows setup shouldn't be used in the first place. I'm all for not using closed software, but then the question rather becomes: who do you think is deserving of your trust in this scenario?
- dackdel 2y agolove it
- deleted 2y ago[deleted]
- sandworm101 2y agoI'm actually seeing some organizations deliberately forbidding air-gapped systems. The upsides no longer outweigh the downsides. While the speed at which attacks can be implemented is lower, they are more difficult to detect. An air-gapped system still needs to be updated and policed. So someone has to move data into it, for software updates at least. But the air-gap makes such systems very difficult to monitor remotely. Therefore, once an attack is ongoing it is harder to detect, mitigate and stop.
- lionkor 2y ago> This may indicate that the developers of GoldenHowl are Russian speakers. Journalists need to check their biases and ensure that everything they write is balanced. When mentioning that they might be Russian speakers, a good balancing sentence would be to point out countries which use the Russian language. Just throwing in "Russian speaker" after explicitly stating they're not sure which nation state did this is extremely unprofessional. Sure, mention all the facts. Don't try to interpret them as "clues". If you have to, make sure you're not building a narrative without being absolutely sure. Its not good journalism to go from `transport_http` to indicating that this is an attack by the Russian federation. That's not how you do good journalism. How many people will retain the fact that the author does NOT know which, if any, nation state did this?
- MediumOwl 2y agoIt also doesn't seem like a good assumption: https://sourcegraph.com/search?q=context:global+transport_http&patternType=keyword&case=yes&sm=0 https://sourcegraph.com/search?q=context:global+transport_ht...
- knallfrosch 2y agoThe most likely nation state is the one with the most Russian speakers: Russia.
- lionkor 2y agoYou don't arrest the most likely guy, you arrest the guy you have evidence on.
- _hl_ 2y agoWhy would you go through all the hassle of setting up an air-gapped system, only to stop at enforcing strict code signing for any executable delivered via USB?
- knallfrosch 2y agoAir gaps are easily enforced and require absolutely zero technical knowledge. You just need a PC and then have a CD delivered through a trusted source – embassies should already have a way of ensuring physical integrity of their mail. The technical knowledge needed for code signing, especially now with trusted hardware modules, is orders of magnitute more complicated than that.
- acdha 2y agoNot just knowledge: code signing is going to be a lot of whack-a-mole work dealing with every tool you use. I’d expect that to cost more than you expect and get political blowback from whoever needs tools which get broken.
- mistercheph 2y agoWhy worry about the blowback? That's the corpse talking, if I hear, "This disrupts our workflow," I'm even more confident that I should rip the band-aid. Offices that don't follow security practices uncovered because they never called for help, another chance for drifters on autopilot to walk away from the job because it just got too hectic, stop paying licenses for a bunch of tools you didn't realize you were paying for and don't need, find replacements for all the tools that are not actively maintained, or don't have cooperative maintainers. It's a healthy shake-up and our society at large should be less scared of making decisions like these
- acdha 2y agoYou’re assuming that everyone shares the IT security department’s priorities. If you tell someone senior that they can’t use a tool they need, you might learn that they have political clout as well – and the context here makes that especially plausible.
- Roark66 2y agoAm I the only one that finds it incredible an air gapped device has enabled USB ports? You want to bring data to it, use a freaking cd/dvd-rom. You may bring all sorts of crap in, but if let's say the air gapped machine is reimaged from cd/dvd every day and nothing ever leaves it, who cares?
- 1970-01-01 2y agoThe keyboard and mouse were probably USB.
- BlueTemplar 2y agoAren't there locks to deal with that ? Because you could also say then that anyone can add an USB drive by plugging it directly on the motherboard...
- 1970-01-01 2y agoI don't think anyone in the EU govt sat down and thought about security beyond the air gapping.
- pas 2y agowe don't know if it's EU, likely it's one member state.
- amelius 2y agoLet me guess. Someone installed a TCP-over-airgap utility.
- gman83 2y agoI don't know anything about security, but why does an airgapped system even have a USB drive? Seems obvious to me that you want to disable all IO systems, not just internet? OK, sure people can still take photos of the screen or something, but that would require a willing collaborator.
- some_random 2y agoIt's pretty normal for airgapped systems to have USB drives, typically you're trying to keep data from getting out more than coming in. The problem here was that they were letting drives go from the classified side to the unclassified side.
- ThinkBeat 2y agoThis does really not deserve a huge writeup. Employees (unknowingly(?)) using infected USB drives caused security problems. Well imagine that. As several others pointed out the USB ports on the secure serfver should all be fullly disabled In addition I would suggest leaving one rewired seemingly availble USB port that will cause a giant alarm to blare if someone inserted anything into it. Further all informatin being somehow fed into the secure machines should be based on simple text based files with no binary components. To be read by a bastion host with a drive and driver that will only read those specific files, that it is able to parse succefully and write it out to the destination target, that I would suggest be an optical worm device that can then be used to feed the airgapped system.
- snvzz 2y agoWouldn't have happened had they used seL4. I'd hope there's some EU investment on it now.
- anthk 2y ago>Ctrl-f, Windows. Ahem, "air-gapped'. Any decent Unix system has either udev or hotplug based systems to disable every USB device not related to non-storage purposes. Any decent secure system woudln't allow to exec any software to the user beside of what's in their $PATH. Any decent system woudn't alllow the user to mount external storage at all, much less executing any software on it. For air-gapped systems, NNCP under a secure Unix (OpenBSD with home mounted as noexec, sysctl security tweaks enforcing rules, and such) it's godsend. Securelevel https://man.openbsd.org/securelevel.7 https://man.openbsd.org/securelevel.7 NNCP http://www.nncpgo.org/ http://www.nncpgo.org/ http://www.nncpgo.org/ http://www.nncpgo.org/