3 ms·
Surely some government has come up with physically-unidirectional data transmission mechanisms for getting data onto airgapped networks. There has to be somethi
by kibwen 2y ago
Surely some government has come up with physically-unidirectional data transmission mechanisms for getting data onto airgapped networks. There has to be something more sophisticated than single-use CD-ROMs, even if it's just a blinking LED on one end and a photosensor on the other end.
- neonz80 2y agohttps://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
- maxerickson 2y agoWhich ironically describes them evolving into software driven gateways.
- wannacboatmovie 2y ago> There has to be something more sophisticated than single-use CD-ROMs But why, when a DVD-R handles most use cases at a cost of < $0.25 each, are reliable and ubiquitous, the hardware is likely already there (unless you are using Apple - caveat emptor) and they close the threat vector posed by read/write USB devices. Sometimes the simplest solution is the best solution.
- rhcom2 2y agoI would guess having a CD/DVD drive opens another attack surface. Similar to why people gluing their USB ports closed.
- zmgsabst 2y agoRight — but the question isn’t CD/DVD versus nothing. It’s CD/DVD versus USB; and which has a smaller attack surface. I’d argue that read-only CD/DVD has a smaller attack surface than USB, so of the two, it’s preferable. I’d further argue that a CD/DVD (ie, the actual object moved between systems) is easier to inspect than USB devices, to validate the behavior.
- RF_Savage 2y agoThe CD/DVD discs used can also be retained and later audited to verify what was moved to and from the systems.
- sneak 2y agoDVD-R is read/write unless you are very careful to have read-only hardware on the destination device.
- roywiggins 2y agoYou can always shred the DVD afterwards I guess!
- alwa 2y agoEven if the destination device were to write something to said discs, the optical media are cheap enough that it makes sense to destroy them (or archive them in case they become useful for forensic purposes) rather than reusing them. Plus, compared to a USB form factor, one imagines it’s harder to sneak in circuitry that could retransmit data by unexpected means.
- BlueTemplar 2y agoWhy "very" ? Also, if you think that the seller is lying to you, can't the drive be opened up and inspected to check for that kind of capability ?
- ahartmetz 2y agoI have heard (on HN) of... 100 MBit ethernet with the transmit wires cut. Probably in the context of in-flight infotainment: plane data to infotainment yes, infotainment anything to plane control anything no. If it's stupid but it works...
- nullc 2y agogigabit fiber works fine, amazon sells splitters, split tx and loop back to rx on the tx side. Rx side just works. you need to use a file transfer tool intended for unidirectional transfer (e.g. multicast) otherwise you will have failure from lost packets. If you don't require high speed just use RS232.
- guenthert 2y agoIt was used to connect network monitors (packet capturing devices) to ensure that ARP or a bug or misconfiguration wouldn't reveal the existence of that device on the network.
- SAI_Peregrinus 2y agoGood old UART without the RX connected on one side.
- aenis 2y agoAlas, this can be reconfigured without anyone noticing, assuming compromise on both sides. A diode / photosensor can't.
- nl 2y agoData diodes are commonly used: https://csrc.nist.gov/glossary/term/data_diode https://csrc.nist.gov/glossary/term/data_diode I don't know if people class something connected using a data diode as airgapped or not.
- fuzzfactor 2y agoRegular two-way IR diodes and sensors were standard on 90's business laptops for ordinary RS-232 file transfer between machines wirelessly. Before wifi or even ethernet was everywhere, and before USB and Bluetooth came along. The first smartphones had it too so you could dial up the internet on the road in the years before phones had a browser and stuff like that.
- matco11 2y agoYes. …and, indeed, that used to be a vector for hacking “air gapped” systems back in the day
- firesteelrain 2y agoAirgapped from the Internet —- yes.
- coopreme 2y agohttps://docs.aws.amazon.com/whitepapers/latest/cross-domain-solutions/connecting-cloud-to-cloud-infrastructure.html https://docs.aws.amazon.com/whitepapers/latest/cross-domain-...
- khaki54 2y agoYeah they exist. Data diodes or data guards. They operate at currently available line speeds and there are 100s of thousands in operation. Data diodes are favored by OT companies. For government, Data Guards as they tend to have more robust inspection
- mitjam 2y agoSD cards can also have a switch to make them read only.
- gnabgib 2y agoThey have a switch that requests the host doesn't try and write, but it's not read only: It is the responsibility of the host to protect the card. The position [i.e., setting] of the write protect switch is unknown to the internal circuitry of the card https://en.wikipedia.org/wiki/SD_card#Write-protect_notch https://en.wikipedia.org/wiki/SD_card#Write-protect_notch
- dwattttt 2y agoAh, security via the honour system. Unbeatable
- deleted 2y ago[deleted]