3 ms·

What protocol would you have recommended?

Woodi 2y ago
I don't know, but maybe DO NOT USING systems with ShowSuperHidden features would help ? Such thing just MUST BE a helper for creating malwares, what else it could be ? Definitely for circumventing human users. Good job Microsoft ! Autoexec.bat is proud of you ! /s
- anthk 2y ago
  I woudn't use Windows at all. USB media? Authentificated and encrypted, with some system like NNCP and a little multiplaform Go based GUI (or heck, TCL/Tk) on top.
beAbU 2y ago
Based on other comments here, typically the USB key is destroyed after the data was copied into the network. No data is allowed to exit the airgapped network. Read-only media or destroying the media after use is a reasonable mechanism to protect against data exfiltration. I'm not sure how you protect against infiltration though. A computer system that cannot get data in is pretty useless methinks.
firesteelrain 2y ago
USB can be OK however you need like a staging machine and scan the files before entry plus use of a write block device on the USB hard drive. These are commonly used in forensics. https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-cftt/cftt-technical/hardware https://www.nist.gov/itl/ssd/software-quality-group/computer... This also tends to be a supply chain and insider threat.
- StrLght 2y ago
  Scan them with what exactly? If you're hinting at AVs — I honestly doubt they could be useful against novel state-sponsored malware.
  - firesteelrain 2y ago
    It would have caught it once Kapersky reported it and they are keeping their AV definitions up to date. Write block prevents transfer back to the USB which is the exfiltration mechanism.
aaronmdjones 2y ago
Using any kind of storage media to transfer data to a Windows machine is by default a disaster waiting to happen. Windows natively provides the ability for executables to embed icons (known as resources) for the file manager to render them as. This, combined with the default of hiding file extensions for known types (e.g. .exe), is a recipe for a user eventually executing the malware instead of opening the file or directory they wanted. This malware exploits that very fact by naming itself after the most-recently modified directory on the drive and embedding an icon that ensures that the file manager will render it as a directory. If you ensured by policy that file extensions were never hidden, that resources were not rendered (every exe got the default icon [1]), and that every user received regular training to properly distinguish files from each other (and files from directories), this risk could be somewhat managed. Good luck; I don't even know if you can disable resource rendering. [1] https://i.sstatic.net/vY5dQ.png https://i.sstatic.net/vY5dQ.png
fsflover 2y ago
How about Qubes OS with minimal templates? https://www.qubes-os.org/doc/templates/minimal/ https://www.qubes-os.org/doc/templates/minimal/ See also: https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-using-a-separate-physical-machine https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-u...

I don't know, but maybe DO NOT USING systems with ShowSuperHidden features would help ? Such thing just MUST BE a helper for creating malwares, what else it could be ? Definitely for circumventing human users. Good job Microsoft ! Autoexec.bat is proud of you ! /s

anthk 2y ago
I woudn't use Windows at all. USB media? Authentificated and encrypted, with some system like NNCP and a little multiplaform Go based GUI (or heck, TCL/Tk) on top.

beAbU 2y ago

Based on other comments here, typically the USB key is destroyed after the data was copied into the network. No data is allowed to exit the airgapped network. Read-only media or destroying the media after use is a reasonable mechanism to protect against data exfiltration. I'm not sure how you protect against infiltration though. A computer system that cannot get data in is pretty useless methinks.

firesteelrain 2y ago

USB can be OK however you need like a staging machine and scan the files before entry plus use of a write block device on the USB hard drive. These are commonly used in forensics. https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-cftt/cftt-technical/hardware https://www.nist.gov/itl/ssd/software-quality-group/computer... This also tends to be a supply chain and insider threat.

StrLght 2y ago
Scan them with what exactly? If you're hinting at AVs — I honestly doubt they could be useful against novel state-sponsored malware.
- firesteelrain 2y ago
  It would have caught it once Kapersky reported it and they are keeping their AV definitions up to date. Write block prevents transfer back to the USB which is the exfiltration mechanism.

aaronmdjones 2y ago

Using any kind of storage media to transfer data to a Windows machine is by default a disaster waiting to happen. Windows natively provides the ability for executables to embed icons (known as resources) for the file manager to render them as. This, combined with the default of hiding file extensions for known types (e.g. .exe), is a recipe for a user eventually executing the malware instead of opening the file or directory they wanted. This malware exploits that very fact by naming itself after the most-recently modified directory on the drive and embedding an icon that ensures that the file manager will render it as a directory. If you ensured by policy that file extensions were never hidden, that resources were not rendered (every exe got the default icon [1]), and that every user received regular training to properly distinguish files from each other (and files from directories), this risk could be somewhat managed. Good luck; I don't even know if you can disable resource rendering. [1] https://i.sstatic.net/vY5dQ.png https://i.sstatic.net/vY5dQ.png

fsflover 2y ago

How about Qubes OS with minimal templates? https://www.qubes-os.org/doc/templates/minimal/ https://www.qubes-os.org/doc/templates/minimal/ See also: https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-using-a-separate-physical-machine https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-u...