4 ms·

Given that air gapped American government machines would be vulnerable to similar techniques, why don’t common operating systems build mechanisms to make this s

Given that air gapped American government machines would be vulnerable to similar techniques, why don’t common operating systems build mechanisms to make this stuff more difficult? * force prompting executing anything off external media * disallow anything other than input devices for USB * disallow unsigned binaries from running * work to require usb peripherals to carry a unique cryptographic signature so that you can easily lock the set of allowed devices once the machine is set up Heck, a lot of this stuff could be valuable to help secure corporate IT machines too.

night862 2y ago
Well none of them are selling a security product. There is basically no security focused pc hardware, aside from maybe raptor systems which isn’t really the same ilk. Off the top of my head, a lot of these devices and hardware were scam traps by LEO. I’d go on a limb and say this isn’t a problem anyone actually wants to solve.
- loa_in_ 2y ago
  The complete opposite of the tragedy of the commons
  - NooneAtAll3 2y ago
    comedy of the extinct?
gnopgnip 2y ago
Since 2008 or so all US government computers on SIPR block USB storage devices are unless they are on an approved list. Autorun is disabled. Physical security is another big factor, there is a long checklist for a SCIF that at some level takes into account TEMPEST type threats that mitigate many attacks on air gapped systems. And none of these things are the default on commercial software because users want it to be frictionless. They want software to install right away when you plug in a usb drive, etc.
- mozman 2y ago
  Someone who gets it. I work in security and everyone hates me because I add friction and cost. On the flip side, I have a lot of PII to protect.
- Thorrez 2y ago
  I don't think that would have protected against this attack. I think it was the users' workflow to plug USB drives into non airgapped computers, then into the airgapped computers. So those USB drives would be put on the approved list, and also be used by the attackers.
  - sroussey 2y ago
    I guess people forget that SneakerNet is still a network.
- vlovich123 2y ago
  Would you agree that perhaps executables whose origin is a usb drive should be treated as equivalent to a browser download and unconditionally get a prompt to execute even if it was copied off the usb? I think it’s naive to think that our own security wouldn’t be helped by improving software measures even if it does risk our own offensive capabilities - we have very advanced and well funded adversaries ourselves
  - gnopgnip 2y ago
    Getting the balance between security and usability right is tricky. It doesn’t make sense to have to click yes to trust software when you run it a hundred times a week, pretty quickly you are just clicking and not actually considering the risk. At the same time, for an airgapped systems where updates are rarely installed and the impact is much higher it makes sense to only allow whitelisted software and prompt each time
    - vlovich123 2y ago
      It does prevent you accidentally running something that you didn't expect to be an executable in the first place as is the case here. I doubt you're running executables off of USB drives hundreds of times a week on air gapped machines.
pclmulqdq 2y ago
Most of your list is done inside ATMs and other full-custom secure hardware already.
anshargal 2y ago
About 20 years ago, I was setting up a shared PC at my university. I googled for a way in Windows XP (via registry or group policy) to only let specific programs run. I added stuff like explorer.exe, iexplore.exe, winword.exe, acroread.exe, and a few others. Fast forward a few years, and the computer was still running great. The desktop and downloads folders were full of messengers, "flash players" and other malware - but all binaries were throwing cryptic error. Since no one in IT was around or cared, nobody figured out how to edit the allow list. The computer was deemed half-broken. But when neighboring PCs were completely infested, this one could still open, edit, and print office docs flawlessly. It felt like a magic fix for shared Windows PC security.
- bubblesnort 2y ago
  I had to use one of those as a student. ACRORD32.EXE was actually cmd.exe WINWORD.EXE was actually Mozilla ...and so on Edit: one of those exes was regedit and every time I sat down I'd delete all the keys named Policies as a routine excersize. After that, restart explorer with one of the tricks. I don't remember the specific one but it wasn't officially documented iirc. https://superuser.com/questions/335917/how-can-you-do-a-clean-shutdown-of-windows-explorer https://superuser.com/questions/335917/how-can-you-do-a-clea...
Thorrez 2y ago
>* disallow anything other than input devices for USB I think that will greatly reduce the ability to get work done. It's my understanding that the workflow for using these specific airgapped computers involved moving USB thumb drives between computers.
- deleted 2y ago
  [deleted]
PrivateButts 2y ago
We recently started enforcing a policy of scanning external media before letting it be usable by the system and the time it takes for MBAM to scan a flash drive takes so long it's driven the most complaints of any IT policy change we've made. Some people are just so latched on to that floppy disk lifestyle that the only change to their workflow in decades has been what part of the computer they put their storage in.
lokimedes 2y ago
These are all standard security requirements for NATO accredited systems. The human drive for convenience and perhaps a bit darker, to rebel against rules, will always serve as pathways to compromise. And in the case of a powerful hostile actor, bribing someone.
ryukoposting 2y ago
> disallow anything other than input devices for USB Now you're making me wonder if keyboard firmware could be an attack vehicle.
zahlman 2y ago
To my understanding, none of that would have been relevant here. Users copied the executable (disguised as a folder) from the external media (which was one of their own devices, and would have been in the "set of allowed devices" under such a scheme) which was a perfectly normal input device (not some BadUSB hack). It probably wouldn't be hard to get a malware launcher appear "signed", either. Even if we disallow self-signing, the launcher only needs to be a wrapper to start Python (which can be supplied alongside). Such wrappers are provided by Python[1]. I don't know if these are signed normally, but it seems pretty easy to imagine. All the technical "hacking" happened on the non-air-gapped side, so that that computer would put malware onto the USB with a deceptive presentation (an .exe with an icon to look like a folder and with the same name as an expected folder, while the actual folder was hidden). The rest is social engineering (and Windows not showing the .exe extension). [1]: `pip3.exe` is an example; it's hard-coded to run the Pip module from `site-packages`, but `pip.py` could be replaced. More to the point, these wrappers are automatically created by Setuptools, to run an arbitrary script specified in the build process, from a "stub" included with Setuptools. (All of this is to work around the lack of support for shebangs, of course.) I don't know if Setuptools can or does sign these wrappers. Probably not.

night862 2y ago

Well none of them are selling a security product. There is basically no security focused pc hardware, aside from maybe raptor systems which isn’t really the same ilk. Off the top of my head, a lot of these devices and hardware were scam traps by LEO. I’d go on a limb and say this isn’t a problem anyone actually wants to solve.

loa_in_ 2y ago
The complete opposite of the tragedy of the commons
- NooneAtAll3 2y ago
  comedy of the extinct?

gnopgnip 2y ago

Since 2008 or so all US government computers on SIPR block USB storage devices are unless they are on an approved list. Autorun is disabled. Physical security is another big factor, there is a long checklist for a SCIF that at some level takes into account TEMPEST type threats that mitigate many attacks on air gapped systems. And none of these things are the default on commercial software because users want it to be frictionless. They want software to install right away when you plug in a usb drive, etc.

mozman 2y ago
Someone who gets it. I work in security and everyone hates me because I add friction and cost. On the flip side, I have a lot of PII to protect.
Thorrez 2y ago
I don't think that would have protected against this attack. I think it was the users' workflow to plug USB drives into non airgapped computers, then into the airgapped computers. So those USB drives would be put on the approved list, and also be used by the attackers.
- sroussey 2y ago
  I guess people forget that SneakerNet is still a network.
vlovich123 2y ago
Would you agree that perhaps executables whose origin is a usb drive should be treated as equivalent to a browser download and unconditionally get a prompt to execute even if it was copied off the usb? I think it’s naive to think that our own security wouldn’t be helped by improving software measures even if it does risk our own offensive capabilities - we have very advanced and well funded adversaries ourselves
- gnopgnip 2y ago
  Getting the balance between security and usability right is tricky. It doesn’t make sense to have to click yes to trust software when you run it a hundred times a week, pretty quickly you are just clicking and not actually considering the risk. At the same time, for an airgapped systems where updates are rarely installed and the impact is much higher it makes sense to only allow whitelisted software and prompt each time
  - vlovich123 2y ago
    It does prevent you accidentally running something that you didn't expect to be an executable in the first place as is the case here. I doubt you're running executables off of USB drives hundreds of times a week on air gapped machines.

pclmulqdq 2y ago

Most of your list is done inside ATMs and other full-custom secure hardware already.

anshargal 2y ago

About 20 years ago, I was setting up a shared PC at my university. I googled for a way in Windows XP (via registry or group policy) to only let specific programs run. I added stuff like explorer.exe, iexplore.exe, winword.exe, acroread.exe, and a few others. Fast forward a few years, and the computer was still running great. The desktop and downloads folders were full of messengers, "flash players" and other malware - but all binaries were throwing cryptic error. Since no one in IT was around or cared, nobody figured out how to edit the allow list. The computer was deemed half-broken. But when neighboring PCs were completely infested, this one could still open, edit, and print office docs flawlessly. It felt like a magic fix for shared Windows PC security.

bubblesnort 2y ago
I had to use one of those as a student. ACRORD32.EXE was actually cmd.exe WINWORD.EXE was actually Mozilla ...and so on Edit: one of those exes was regedit and every time I sat down I'd delete all the keys named Policies as a routine excersize. After that, restart explorer with one of the tricks. I don't remember the specific one but it wasn't officially documented iirc. https://superuser.com/questions/335917/how-can-you-do-a-clean-shutdown-of-windows-explorer https://superuser.com/questions/335917/how-can-you-do-a-clea...

Thorrez 2y ago

>* disallow anything other than input devices for USB I think that will greatly reduce the ability to get work done. It's my understanding that the workflow for using these specific airgapped computers involved moving USB thumb drives between computers.

deleted 2y ago
[deleted]

PrivateButts 2y ago

We recently started enforcing a policy of scanning external media before letting it be usable by the system and the time it takes for MBAM to scan a flash drive takes so long it's driven the most complaints of any IT policy change we've made. Some people are just so latched on to that floppy disk lifestyle that the only change to their workflow in decades has been what part of the computer they put their storage in.

lokimedes 2y ago

These are all standard security requirements for NATO accredited systems. The human drive for convenience and perhaps a bit darker, to rebel against rules, will always serve as pathways to compromise. And in the case of a powerful hostile actor, bribing someone.

ryukoposting 2y ago

> disallow anything other than input devices for USB Now you're making me wonder if keyboard firmware could be an attack vehicle.

zahlman 2y ago

To my understanding, none of that would have been relevant here. Users copied the executable (disguised as a folder) from the external media (which was one of their own devices, and would have been in the "set of allowed devices" under such a scheme) which was a perfectly normal input device (not some BadUSB hack). It probably wouldn't be hard to get a malware launcher appear "signed", either. Even if we disallow self-signing, the launcher only needs to be a wrapper to start Python (which can be supplied alongside). Such wrappers are provided by Python[1]. I don't know if these are signed normally, but it seems pretty easy to imagine. All the technical "hacking" happened on the non-air-gapped side, so that that computer would put malware onto the USB with a deceptive presentation (an .exe with an icon to look like a folder and with the same name as an expected folder, while the actual folder was hidden). The rest is social engineering (and Windows not showing the .exe extension). [1]: `pip3.exe` is an example; it's hard-coded to run the Pip module from `site-packages`, but `pip.py` could be replaced. More to the point, these wrappers are automatically created by Setuptools, to run an arbitrary script specified in the build process, from a "stub" included with Setuptools. (All of this is to work around the lack of support for shebangs, of course.) I don't know if Setuptools can or does sign these wrappers. Probably not.