17 ms·

Air Gaps

343 points by bostik 13y ago

gluejar 13y ago
"the first company to market a USB stick with a light that indicates a write operation -- not read or write; I've got one of those -- wins a prize". Get to work, people!
- chiph 13y ago
  There are sticks out there that have hardware write-enable switches (I keep my medical records on one), so that you can at least control when writes occur.
  - podperson 13y ago
    Including all SD cards.
    - FedRegister 13y ago
      Most SD card "write prevent" tabs are suggestions only. From Wikipedia: The presence of a notch, and the presence and position of a tab, have no effect on the SD card's operation. A host device that supports write protection should refuse to write to an SD card that is designated read-only in this way. Some host devices do not support write protection, which is an optional feature of the SD specification. Drivers and devices that do obey a read-only indication may give the user a way to override it. In most cases the switch is just software detectable. Some prosumer cameras use this switch to indicate there is a firmware update on the card and that the camera should try to apply it when it is powered up.
      - emillon 13y ago
        Interestingly enough, the switches are not electric ones. It's just something that can be physically (maybe even optically) detected by the device.
  - nimble 13y ago
    Why do you write 'at least'? Isn't this strictly superior to Schneier's light idea?
    - hyperpape 13y ago
      Probably better on balance, but not strictly better. On the one hand, it gives you greater security when used perfectly. On the other hand, it has a cognitive overhead, and a worse failure mode (you forget that you've left it writeable, and won't have the light to give you feedback). So even better would be a hardware lock for writes and a light indicating when writes happen.
  - sneak 13y ago
    Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. They aren't appliances.
    - jessaustin 13y ago
      What you propose is probably possible for many USB sticks, but I don't think it's possible in general. Flashing a microcontroller often requires access to a serial interface like SPI, I2C, or JTAG. That's typically on different pins than USB (which pins can be buried in potting or otherwise inaccessible to compromised hosts). In addition some models can have particular pins connected to disable flashing.
      - fest 13y ago
        Some microcontrollers I've been working with, that had USB capability also supported DFU- flashing new firmware via USB. I have also resurrected a write-broken flash drive, by re-flashing it's firmware (a tool for which was provided by microcontroller vendor, which I found out by looking at VID/PID values and googling them).
        jessaustin 13y ago
        Oh definitely it's possible for many microcontrollers. DFU is very handy during development. I was just reacting to this statement: Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. Nothing, that is, except possibly a complete absence of such a facility! It depends on the microcontroller and how it has been wired into the USB device.
        deleted 13y ago
        [deleted]
- unwind 13y ago
  How about an inline protocol analyzer that knows the USB mass storage device class protocol, and can detect when a write request is being sent? That would perhaps also make it possible to optionally prevent such requests from ever reaching the USB stick, thus adding write-protection to legacy sticks. Probably not 100% trivial given the signalling speed and general complexity of USB, but perhaps solvable using an FPGA? There is a software-only USB stack for 8-bit AVR:s, so it doesn't seem totally impossible, either. No, I don't have a startup manufacturing such a device. :) UPDATE: Ah, I just reinvented the WriteBlocker: http://www.wiebetech.com/products/USB-WriteBlocker.php http://www.wiebetech.com/products/USB-WriteBlocker.php. Sigh.
  - deleted 13y ago
    [deleted]
  - zokier 13y ago
    No reason to involve FPGAs (beyond performance concerns). Eg FTDI makes Arduino-like boards with host+device USB connections, seem to cost $35 at their store. With this specific device you are limited to full-speed USB which is slight inconvenience for storage use. But it's also the first product I happened to stumble upon, there probably are better alternatives out there. http://www.ftdichip.com/Products/Modules/DevelopmentModules.htm#Vinco http://www.ftdichip.com/Products/Modules/DevelopmentModules....
- jonnycowboy 13y ago
  www.youtube.com/watch?v=LZXaYLVFdcQ‎
wikiburner 13y ago
Is there an effective way to "mostly" airgap, if you need Internet connectivity for your work? This is a comment I posted on a similar thread a few weeks ago. ========================================= Just curious, how would airgapping be practical if you need Internet connectivity for your "real work"? For example, let's say you run a quant trading firm and the algorithms you're concerned about being stolen need connectivity to download live trading info, and then after processing that info they need to communicate buy/sell orders to the outside world. Are there any methods that could be used that would prevent all communication with a secure system (with an airgap level of certainty) besides the strictly defined data you need to do your "real work"? ----- gaius 19 days ago | link Sure, you would just use Radianz, and that is in fact what everyone does. This is a very solved problem! Bloomberg also operates a private network, and there are others too. These systems can operate perfectly well without access to the public Internet. A couple of jobs ago I worked at a financial services firm with 2 networks and 2 PCs on everyone's desk. Rednet for outside connectivity, and an internal network for real work, and never the twain shall meet. NO-ONE needs the Internet for real work, let's be honest, just for goofing off. Time we all started to prioritize security over mere convenience. ----- * wikiburner 19 days ago | link Yep, maybe trading wasn't the best example, although they are still effectively at the mercy of the security of their data providers network - which admittedly is probably quite good. Let's say you're a P.I., journalist, researcher, law enforcement, or intel agency, and need to automate news or people searches for some reason. If you were able to very strictly define the data you're expecting to receive, isn't there any way you could automatically pass this data on to a secure system without opening yourself up to exploits?
- deleted 13y ago
  [deleted]
- Retric 13y ago
  What you want is a firewall that uses deep packet inspection so that only data meeting your specifications get's through aka it's an XML file with the correct schema. Unfortunately, you can't exactly trust of the shelf Software for this stuff, however a firewall can be far simpler than a modern OS so they tend to be much more secure so you are reasonably safe just updating the inspection code. Though if you have a sufficient budget or are overly paranoid you can build your firewall from scratch. Also, what you do at the endpoint matters, opening websites in IE is going to be far less secure than say doing day trading using custom software. That said, the usual rules of defense in depth still apply, ensure that your machine can only talk to a white-list of IP address, etc etc.
kbart 13y ago
This article misses the most important security tip: do not use any proprietary software, especially the ones starting with "W" made by MS.
- skrebbel 13y ago
  Are you sure? How much more difficult would it be for an intelligence agency to get an open source hacker to "accidentally" inject a vulnerability disguised as a bug, than to pressure MS to write a backdoor? (or to get MS to hire a mole)
  - kbart 13y ago
    Yes I'm sure. It would be much more difficult, because that vulnerability could be possibly detected by many people reviewing the code, so it must be more sophisticated and hidden than the one buried in the precompiled binary. Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet, contrary to the countless examples of products by big names. Not saying that open source is 100% secure, but it's still much safer than proprietary programs. [EDIT] Thanks for pointing out Debian SSL example, I wasn't aware of that. But it still doesn't deny the key point I mentioned - that there are more discovered backdoors and vulnerabilities in proprietary software than the open one.
    - claudius 13y ago
      > Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet. One could argue that the Debian SSL issue[0] would qualify as such a backdoor/vulnerability, although I don’t want to argue that it was introduced maliciously, merely that it could have been introduce with such intentions. [0] http://www.debian.org/security/2008/dsa-1571 http://www.debian.org/security/2008/dsa-1571
    - DanBC 13y ago
      All those people reviewing the code took two years to discover the Debian SSL bug. https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number... https://wiki.debian.org/SSLkeys https://wiki.debian.org/SSLkeys
jeanjq 13y ago
Surprised that he decided to use Windows.
- podperson 13y ago
  Indeed. If he picked Linux or a Mac he'd have the advantage of being able to read most MS proprietary formats without the disadvantage of embedded code executing.
  - jeanjq 13y ago
    Seems to me the only reason to choose Windows for this would be to use Microsoft Office to read the NSA documents and he's stated that he's using OpenOffice, so...
- Zigurd 13y ago
  If you assume your connected machine is going to get p0wnd, and you rely on the air gap to prevent your secure machine from being penetrated, you could run any OS you like, no matter your opinion of how much the vendor cooperates with the NSA.
  - jeanjq 13y ago
    I don't think this is right. You should reduce the entire attack surface. Since Bruce is worried about malware getting in via a removable device and cites examples that attacked Windows he should not use Windows.
  - vacri 13y ago
    Given that he's going to the level of preferring a store-bought USB stick over one found in a parking lot, it shows he's concerned about transferring malware. Not using the OS for which the most malware exists seems like a sensible choice. After all, if you're going to all this trouble and inconveniencing yourself in the name of security, what's a touch more inconvenience with using an operating system that you're less user-friendly with?
    - 13y ago
nlh 13y ago
I find it somewhat amazing that a few months ago, I'd have read an article like this and thought "Man, talk about paranoid." But today, after all that I've read and learned recently, it makes perfect sense.
- easytiger 13y ago
  I read a comment just like this a couple of months ago. Someone saying that until this point they thought Richard Stallman was a complete paranoid nutjob but it turns out he was completely correct. I guess that's why he will be seen as a visionary in so many areas. And speaking of stallman and airgaps: http://stallman.org/stallman-computing.html http://stallman.org/stallman-computing.html > I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I fetch web pages from other sites by sending mail to a program (see git://git.gnu.org/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it.
  - xanderstrike 13y ago
    While I admire his dedication to free software and security, I find it sad that he who has done so much for the internet and modern computing eschews most of it.
    - ygra 13y ago
      You could have said something similar about Dijkstra, who most of his life didn't even use a computer.
      - easytiger 13y ago
        Ihad a formal methods lecturer who insists that no computer scientist should be allowed to use a computer until they are 40
      - xanderstrike 13y ago
kephra 13y ago
Windows is a bad choice for an air gapped system. A much better would be Slackware, where its even simple to maintain an air gapped system. Maintaining a Linux with a package manager, e.g. Debian without internet is much more trouble. I had scripts to maintain an air gapped Debian 10 years ago, but can no longer recommend them, as Debian now has signed archives, and the script breaks the sign.
- jlouis 13y ago
  OpenBSD on some older hardware is probably even better!
- claudius 13y ago
  You can still use optical media (CD/DVD) or USB keys to install packages with APT, so I don’t see how Slackware would have any advantage over Debian there. There’s even a apt-offline[0] to create a list of ‘needed’ packages on one system, then download these packages on another one and transport them to the air-gapped system. Of course, you will still have to decide whether to trust these downloaded packages, and unless you trust at least some Debian Developers to do the right thing, this will be hard to do even with GPG signatures on all packages. [0] http://packages.debian.org/wheezy/apt-offline http://packages.debian.org/wheezy/apt-offline
  - vezzy-fnord 13y ago
    Slackware is generally more secure by default, such as explicitly requiring root (not sudo) for package management and at least sudo for utilities that prompt the kernel. This is much in the vein of the *BSDs. Also its conservative nature, constant security advisories and eschewing of bleeding edge are a bonus.
    - claudius 13y ago
      $ dpkg-query -W -f '${Status}\n' sudo unknown ok not-installed IOW, it is perfectly possible not to use (or even install sudo) on Debian. I don’t want to argue whether Debian or Slackware have a more ‘conservative nature’ nor whether that’s an advantage, but there are of course also security advisories for Debian (e.g. today for the systemd packages…). > at least sudo for utilities that prompt the kernel Basically everything ‘prompts the kernel’ in one way or another, could you expand on how exactly Slackware manages to run when every syscall needs sudo? (Or what you mean by ‘prompt the kernel’.) I guess at the end of the day, you can configure a Debian installation to be more secure than any given Slackware installation and you can configure a Slackware installation to be more secure than any given Debian installation – this, of course, depends on your skills and experience with any of the two, so you should use with whatever you’re more comfortable :)
zactral 13y ago
It is completely possible that mentioning Windows in the article was meant to be only a smokescreen. I'm sure a person in his position would absolutely not want to publicly declare the exact solution he is using. In reality, it might as well be something completely else, like Slackware or some USB-bootable distro. Yes, this might be security through obscurity but considering that he admitted that he isn't familiar with the inner workings of Truecrypt etc, it is the safest bet. Not disclosing what exactly you are using doesn't allow an adversary with unlimited resources to adapt and optimize to break this specific scheme.
- hyperpape 13y ago
  That doesn't seem plausible. He could non-specifically say "don't use Windows. Ideally use [some stock linux distro] or investigate other unix operating systems that can be configured for safety." That wouldn't really give away anything.
  - aliakbarkhan 13y ago
    It's not about giving things away -- it's about delaying your adversary. If the NSA takes Schneier at his word and targets him accordingly, then (assuming this is a diversionary tactic) any 0days or other attacks they attempt to send his way will fail. Now obviously that's not a long-term strategy, but it does provide an extra layer of protection against naïve attacks based on his public statements. To be clear, I'm not sure I buy the smokescreen idea, either, but your reason for disbelieving is flawed.
    - hyperpape 13y ago
      It's fair that this would make some difference. But it's not as "he's not on Windows, but we have no clue what he is on?" is a recipe for quick success. He doesn't have to say what linux distro he uses, just give a placeholder for a decent one, and he doesn't even have to use Linux. In any case, is it worth potentially misleading a lot of people for the sake of such a marginal increase in his own security? He could have an even more secure setup if he didn't talk about instituting an air gap. He's already giving away information.
beagle3 13y ago
I've been setting up networks since 2002 the following way: Internal network, NOT connected to the internet. External (small network) is connected to the internet, and has "terminal server" (Windows Terminal Server if I must, Xrdp if I can let the external servers be Linux). Firewall between outside world and external network, configured to allow reasonable work on that network. Firewall between external network and internal network only allows internal network initiated connections to the RDP port (3389) on the external network. Also, an rsync setup that allows some controlled transfer of files between inner and outer networks (preferable to USB drives - the USB ports should be disabled logically and physically, although I didn't always get to do that). This rsync setup goes through a different port, with a cable that is usually not connected (the air in "airgap"). When files need to go in or out, I plug the cable for a few minutes, and unplug when not needed. From experience, this lets you keep a network reasonably secure, without having to put two PCs on everyone's desk. Of course, there's risk: There might be a way to root the inside machines through a bug in RDP, after rooting the outside machines. However, it will work well, against "standard" attacks and malware that assume internet connectivity. Even if they get in (through a USB drive, as schneier says was done in the Iranian and US army facilities), they can't just call out to the internet.
- j_s 13y ago
  RDP makes it easy to access drives, devices, etc. from the the client... do you do any additional configuration to disable these features? http://geekswithblogs.net/DesigningCode/archive/2010/04/19/file-transfer-using-rdp.aspx http://geekswithblogs.net/DesigningCode/archive/2010/04/19/f...
  - beagle3 13y ago
    Yes, drive sharing was disabled server side (though, if the external RDP server is compromised, one could turn this back on). On the client side, we set up the connection not to try to share anything.
spindritf 13y ago
> if you're using optical media, those disks will be impossible to erase I pop the old optical disks I'm tossing away into a microwave oven for 10 seconds at 1000 watts. How recoverable is the data stored on them? (And how cancerogenus the stench?)
- emillon 13y ago
  When microwaving a CD, the induction stops when the track is cut. There are usually big chunks of surface (~2cm²) unaffected. You can't read it with your drive but it's reasonable to think that some data can be retrieved from it, with enough work and money.
  - crb3 13y ago
    A belt sander with rough grit should take care of that without damage to device or surroundings. Sand from the top -- that's where the data is, or used to be. For paranoid satisfaction, sand it all the way through.
    - Houshalter 13y ago
      It seems like the simplest way would be to burn it.
    - mmagin 13y ago
      I'd like to suggest to everyone trying this that: 1. holding such a thin object against a belt sander may be difficult. 2. if you lose your grip, it might fly across the room at dangerous speed.
      - crb3 13y ago
        In the same spirit, I'd like to suggest that anyone trying this use some sort of jig to hold the disc against the belt rather then try to hold it in place against lateral force with your bare fingers. Source: long-ago experience. Ouch.
- venomsnake 13y ago
csandreasen 13y ago
> 1. When you set up your computer, connect it to the Internet as little as possible. It's impossible to completely avoid connecting the computer to the Internet, but try to configure it all at once and as anonymously as possible. There's no technical reason you can't keep your airgapped computer completely off the internet for its entire life cycle. I'd even go so far as to commit heresy say that this is just plain bad security advice that Mr. Schneier is giving out here. Instead, you should probably get your install media from a trusted source and use that to install the OS and any initial updates (maybe that's a manufacturer's install CD or a Linux ISO that you burned yourself - avoid anything that isn't write-once). If the OS on your airgapped machine has a unpatched remote vulnerability, you're already putting that system at risk by connecting it to the internet even once. Don't discard that trusted install media - if you need to create another airgapped machine, you're using the same airgapped data to perform the install. I realize that Bruce was discussing setting up a stand-alone computer, but I thought I'd share my experience: Years ago, around the same time that Blaster was a nuisance, I managed a network of airgapped machines. If any one of them had been hit because I chose to just let it download updates off the internet, the entire network would have been compromised. This would be much worse if you were worried about a targeted attack - every time you connect a fresh computer to the internet with the intent of moving that box over to the secure network, you're giving the attacker another opportunity to gain access. For transferring data back and forth, I've used CDs in the past, but toyed with the idea of using a dedicated serial cable for transfers instead. Tar up the files, connect the cable, tell the remote machine to listen, shoot them over, then disconnect the cable. The connection has no network stack to worry about independent programs sending data across the channel; if extra data is added, the result on the other end likely won't untar; there's no auto-execution of programs to worry about. The only thing I have to worry about being compromised are my copies of tar and cat. Removeable media in general has issues - Schneier mentions a few examples in the article of successful compromises using USB sticks.
- pdonis 13y ago
  If the OS on your airgapped machine has a unpatched remote vulnerability, you're already putting that system at risk by connecting it to the internet even once. Even if it's behind a NAT firewall with no external ports open? And you only connect via SSL (or SSH) to specific known hosts?
leephillips 13y ago
Knuth on his air gap: "I currently use Ubuntu Linux, on a standalone laptop—it has no Internet connection. I occasionally carry flash memory drives between this machine and the Macs that I use for network surfing and graphics; but I trust my family jewels only to Linux." : http://www.informit.com/articles/article.aspx?p=1193856 http://www.informit.com/articles/article.aspx?p=1193856
- jonlucc 13y ago
  In a post-Stuxnet world, can we trust flash drives? If I remember correctly, that virus would jump onto flash drives to spread to the next few computers it touched. I think I might prefer an ethernet wire connection without the outgoing wires.
  - dublinben 13y ago
    As long as you wipe and format the flash drive from the secure computer every time you use it, there shouldn't be any risk. I don't think even Stuxnet could have infected a linux machine that didn't mount or autorun the partition.
    - sneak 13y ago
      Flash drives are not dumb. I know that Travis Goodspeed has had some success in reflashing their microcontrollers to speak corrupt USB to attack USB stacks of host machines (which of course run in kernel mode).
      - dublinben 13y ago
        I guess the only safe options are CDRs and one-way ethernet connections.
      - lesterbuck 13y ago
        A fascinating talk by Travis Goodspeed on the mayhem possible by reprogramming the USB controller in a disk: http://www.youtube.com/watch?v=D8Im0_KUEf8 http://www.youtube.com/watch?v=D8Im0_KUEf8 Writing a Thumbdrive from Scratch: Prototyping Active Disk Anti-Forensics
danso 13y ago
Schneier is not as paranoid or as particular as I thought he would be: > 1. When you set up your computer, connect it to the Internet as little as possible. It's impossible to completely avoid connecting the computer to the Internet, but try to configure it all at once and as anonymously as possible. I purchased my computer off-the-shelf in a big box store, then went to a friend's network and downloaded everything I needed in a single session. (The ultra-paranoid way to do this is to buy two identical computers, configure one using the above method, upload the results to a cloud-based anti-virus checker, and transfer the results of that to the air gap machine using a one-way process.) A friend's house is not "anonymous". If you have the need for an air gap, then you probably should assume that your attackers have the ability to suss out your off and online social network. In a not-too-distant future, it's not hard to imagine a surveillance operative being able to expand their examination of network traffic to not only include you, but associates of yours, and then to detect when an online-installation routine was run. At that point, the fact that that computer's fingerprint (however it may be calculated) was never seen again from that friend's home might be one flag of several in a comprehensive surveillance flag. Though I guess if Schneier is talking about a off-the-parts computer, I'm assuming he means a desktop computer that can't be assembled in the Starbucks two states away to connect to the Wifi. OTOH, I think I would prefer a Linux laptop as my air-gapped computer
keyme 13y ago
"Don't worry too much about patching your system; in general, the risk of the executable code is worse than the risk of not having your patches up to date." Not good advice. If you plan to open anything other than text files on the machine, un-patched software is almost as big a risk as transferring executables. The only difference is that it seems less dangerous to you.
- tptacek 13y ago
  I came here to say the exact same thing. The problem with complicated file formats isn't that they contain "macros"; it's that the code that parses and interprets those files is prone to memory corruption.
fit2rule 13y ago
I'm not sure air-gaps are as safe as we think they are. Yes, its tinfoil time: the NSA and various other Defence agencies have deployed satellites capable of tuning into any CPU built since 1998. Air gap in a deep, deep hole. Or maybe on the other side of the Sun. These are the only really safe places fur humans subjects of the new Tech Overlords to to stash data...
- charlus 13y ago
  It's something worth thinking about in concept. Comments in here saying that this sort of precaution was nonsensical only months ago. So perhaps it's worth considering the ideas and precautions that seem ridiculous now.
- qwerty_asdf 13y ago
  [citation needed]
  - fit2rule 13y ago
    I don't have a desire to provide a citation because I'm exploring, conjecturing .. I mean, after all its not infeasible that the satellite-launches that the NSA has been progressively making, over and over, are to support a network of CPU-sipping listening posts. This had been discussed even in the 80's, in certain circles ..
antocv 13y ago
Schneier is kind of disappointing more and more... Be cautious of this advice dear readers. " (The ultra-paranoid way to do this is to buy two identical computers, configure one using the above method, upload the results to a cloud-based anti-virus checker, and transfer the results of that to the air gap machine using a one-way process.)" No, the ultra paranoid would buy two computers, perform install 1 from friend 1s internet connection, downloading everything keeping a copy and check-sums, then perform install 2 on a friend of a friends connection, then compare the results of both the downloaded check-sums and the installation. (For certain flavors of Linux it should be the same). There is no point in uploading to a cloud-anti-virus checker if the NSA is after you, its not like they are going to use Slammer or some other known virus against you. Jesus christ, and he is using Windows !? WTF. He is going against his own advice - to use public/free software as often as possible. For the step of moving files between air-gapped computer, he suggests using USB sticks. He forgot to say that you must encrypt the entire usb-stick as well, You dont write a file-system to it! Only an encrypted blob. As "viruses" can be transferred on the NTFS he is probably using. Even Linux fs had a vulnerability - when the kernel tried to mount the fs it would privilege escalate to root and run code - code that can be hidden in the NTFS alternate (hidden) streams. EDIT: For the NSA-agent wishing to leak, a good idea is too look into HaikuOS, MenuetOS etc and use those instead of GNU/Linux, or ArchHurd. Something very rare, something unexpected. Modify the installation from the default as much as you can. Hm, we should make an Ask HN thread - what is the best ingenious methods for current NSA employees to leak again, now that they have to share a computer with a partner?
- commandar 13y ago
  >For the NSA-agent wishing to leak, a good idea is too look into HaikuOS, MenuetOS etc and use those instead of GNU/Linux, or ArchHurd. Something very rare, something unexpected. Is that really the best idea, though? One of the things Linux has going for it is a couple of decades worth of public scrutiny and hardening.
  - elq 13y ago
    The suggestion is that hardening is less valuable than obscurity. As long as your choice is secret and uncommon you'll probably be safer than a well known hardened OS.
7952 13y ago
Ironically it is a result of modern encryption that separating things from the internet is so difficult. If every app sends data over an encrypted channel it makes it much harder to audit what exactly it is doing. You can't impose rules if you don't know what the data is or where it will end up.
Shivetya 13y ago
this reminds me a lot of what a lot of radio personalities who deal with personal finances recommend, the system which you do your banking on should only do that and nothing more. While such a system is obviously still connected to the net, you reduce your risk by running a discreet set of software. To be totally safe you would need a room which protects from emissions escaping it. Back in my service days we had system isolated as such simply because you could be monitored through walls.
- g8oz 13y ago
  discrete
apaprocki 13y ago
Isn't this an example of poor OPSEC? If he is in fact using the procedures spelled out in this post, he's giving his potential attackers a clear picture of all of his security measures so that they can focus effort on exploiting a weakness.
notacoward 13y ago
I'd do two things differently. First, instead of using removable media from which data could still be recovered, I'd get a second Ethernet switch. Whenever I wanted to move data from my regular machine to my secure machine, I'd have to move the cable on my regular machine from one switch to the other. Thus it would be physically impossible to be connected to both internal and external networks simultaneously, and I wouldn't be leaving any persistent physical data trail like a USB stick or CD-ROM. The second thing I'd do is a double air gap. Think of it as an airlock: you can't open the inner door until you're sure no contaminants got through the outer door. The intermediate host would have a single purpose: run malware checks. Thus, only data that had already been checked in a secure environment would even be allowed to touch the real secure machine.
- bradleyland 13y ago
  Networks are avoided for a reason. In your scenario, establishing a network connection between the intermediate computer and your "air gap" computer is a breach of the air gap if the intermediate computer has been compromised. The same argument could be made for removable media, but there are good methods for tightly controlling the transfer of data on removable media. Network interfaces have a larger attack surface.
  - notacoward 13y ago
    There are methods for tightly controlling the transfer of data on networks too. It's really trivial to set things up so that the only connection allowed in either direction is the one your file-transfer program is using. That's Firewall 101, too restrictive for any normal machine but easy to accomplish. Also, a compromise of the intermediate computer doesn't represent a breach of the air gap. The same two-gap approach could be used with removable media. It would still provide the same benefits (and vulnerabilities). You seem to be saying that the intermediate computer could get compromised because the air gap is breached, and the air gap is breached because the intermediate computer could be compromised. A bit circular, don't you think? That intermediate computer can provide an extra layer of protection or an extra vector for attack. Which matters more will depend on its configuration and use, but for any semi-sane configuration the protective aspect would quickly dominate. The intermediate computer in a double-air-gap setup would be just as secure as Schneier's single-air-gapped one, and the third computer even more so.
avn2109 13y ago
I'd actually be interested in hearing from Tptacek on this topic, but he's absent for once. Weird.
acomjean 13y ago
I worked on an "Air Gapped" network. We didn't call it that. As the internet and open source took off it became more and more painful. To get files over to the network, we'd have to download from internet and then burn to dvd and bring it over. The thinking was that DVD's with their write once capability would prevent unwanted files from hoping aboard. This didn't help if the file you were transfering was infected, but files were virus checked before burning. Oddly files went Windows->Dvd->HPUX machines meaning the virus scan on windows was somewhat useless. But having no access to cpan or online research on your main work machine was hard.
scott_karana 13y ago
Man, Bleachbit sure took no time at all to put up his "testimonial" blurb on their site! > "Since I started working with Snowden's documents, I have been using [...] BleachBit" -- Bruce Schneier
- nivla 13y ago
  haha I was thinking the same when I noticed it. Has anyone here used BleachBit? From the description it looks like ccleaner + eraser mix.
  - scott_karana 13y ago
    I'd try it out if I weren't a Mac guy these days. Looks decent, and nicely minimalist.
gknoy 13y ago
Bruce gives a good collection of tips, but in his specific case it probably matters little. If he is a target of surveillance, I would be thoroughly surprised if he did not get "black bag" intrusions (as he puts it). He is a target that is definitely high enough priority ("I have Snowden's documents!") that dedicating assets to investigation is more likely, and at that point an air gap seems more like an inconvenience to the attacker than true protection.
deleted 13y ago
[deleted]
macca321 13y ago
How about conducting all IO by webcam OCR?
john_b 13y ago
For the really paranoid, to the extent that your data can be represented as a text file, you can print it on paper from your internet connected machine and OCR it into your air gapped machine, and vice versa. In this case, you only have to worry about your printer or scanner having a backdoor. If you are very confident in your OCR accuracy, you can encrypt it prior to printing and decrypt it after scanning. Just remember to burn the paper afterwards.
BrianYesh 13y ago
"Note: the first company to market a USB stick with a light that indicates a write operation -- not read or write; I've got one of those -- wins a prize."
mrpdaemon 13y ago
What about isolation? With heavy use of virtualization one can make the air gapped machine even more secure: - Only open documents in a virtual machine - Only interface with the document transfer media (cd/dvd etc.) through virtual machines. Don't ever mount or use this media on your host. - Clone a new throw-away virtual machine for opening EACH document and delete it after reading the document About his points: 1) This is nonsense. It's possible to set up an OS (for example linux) with zero internet connectivity, just download the ISO on another computer, verify checksums and signatures, burn onto optical media and you're set. 8) Also, use one-time media. Write once on the internet host, fill up and finalize media, read once on the air gap host, destroy media. Also, I don't think Schneier is recommending to use Windows for this task. He's just assuming that most people out there is using Windows and can use these tips to improve their security. For his own high security setup(s) I'm pretty sure he'd have the common sense to not use Windows.
logicallee 13y ago
Secure Linux air gap. Here is a real secure Linux air gap: 1. From a friend's computer, burn two copies of your favorite Linux liveCD. 2. Hold the two identical discs so that you can see the reflection of the document in front of you in one (mirror writing) and the reflection of the reflection in the other. (normal writing.) 3. You now have a secure Linux air gap with which you can read any document.
paul 13y ago
He forgot to mention keeping the computer in a faraday cage. If he has Snowden info, it seems likely that intelligence agencies would be monitoring him closely enough to use Van Eck phreaking to spy on his laptop display (or other part of the computer that leak info through rf, which is all of them).
- elq 13y ago
  Schneier explicitly mentioned tempest (http://en.wikipedia.org/wiki/Tempest_(codename) http://en.wikipedia.org/wiki/Tempest_(codename)) in the article.
  - jedunnigan 13y ago
    Wild stuff! http://lasecwww.epfl.ch/keyboard/ http://lasecwww.epfl.ch/keyboard/
MarkMc 13y ago
I'd like to sign my executable files on an air-gapped machine. Problem is, the code-signing tools for OS X and Windows (ie. codesign and signtool.exe) seem to require access to my private key to generate the signature AND and an internet connection to generate the timestamp. Is there any solution here?
guard-of-terra 13y ago
Also you can boot from livecd each time. You can use livecd boot on your internet-enabled device. Imagine fellow rootkiter's frustration when he realises root filesystem is read only. Of course you're still vulnerable to BIOS/firmware malware.
derekp7 13y ago
There is another backchannel that can be used if your air-gapped computer ever does get compromised, which I haven't seen anyone discuss yet. If your internet-connected computer and air-gapped computer both have audio speakers / microphone, then that seems like a perfect covert way for a compromise to set up wireless communications between them An audio signal can appear to be similar to fan noise, or outside of human hearing range. I wonder if this has ever been exploited before.
deleted 13y ago
[deleted]
deleted 13y ago
[deleted]
ChrisNorstrom 13y ago
What about using a Linux CD? You can get online and use it for what you need without it downloading or installing software. Every time you re-boot it's guaranteed to be the same OS without any spying malware on it... I guess you'd have to save files on a USB drive though.
Sami_Lehtinen 13y ago
I've been using serial cable with data leds and gpg ascii armored data over it. Very easy to visually inspect all data before further processing. Only attack vector remaining is gpg ascii armored parser, signature verification & decryption. Afaik, this is quite safe. This computer has not been connected to the internet ever, and it won't be in future. Don't forget physical site security.
Grue3 13y ago
He forgot that the computer must be wrapped in tinfoil.
CurtMonash 13y ago
I ordered a new desktop computer last night, and a number of the options from which I chose did NOT seem to have Wi-Fi built in. Rather, they sold low-cost USB devices for Wi-Fi connectivity. I didn't actually check all the motherboard specs to confirm this, but it seems pretty accurate. So getting an air-gapped computer without Wi-Fi would seem to be the least of the problems.

343 points by bostik 13y ago

"the first company to market a USB stick with a light that indicates a write operation -- not read or write; I've got one of those -- wins a prize". Get to work, people!

chiph 13y ago
There are sticks out there that have hardware write-enable switches (I keep my medical records on one), so that you can at least control when writes occur.
- podperson 13y ago
  Including all SD cards.
  - FedRegister 13y ago
    Most SD card "write prevent" tabs are suggestions only. From Wikipedia: The presence of a notch, and the presence and position of a tab, have no effect on the SD card's operation. A host device that supports write protection should refuse to write to an SD card that is designated read-only in this way. Some host devices do not support write protection, which is an optional feature of the SD specification. Drivers and devices that do obey a read-only indication may give the user a way to override it. In most cases the switch is just software detectable. Some prosumer cameras use this switch to indicate there is a firmware update on the card and that the camera should try to apply it when it is powered up.
    - emillon 13y ago
      Interestingly enough, the switches are not electric ones. It's just something that can be physically (maybe even optically) detected by the device.
- nimble 13y ago
  Why do you write 'at least'? Isn't this strictly superior to Schneier's light idea?
  - hyperpape 13y ago
    Probably better on balance, but not strictly better. On the one hand, it gives you greater security when used perfectly. On the other hand, it has a cognitive overhead, and a worse failure mode (you forget that you've left it writeable, and won't have the light to give you feedback). So even better would be a hardware lock for writes and a light indicating when writes happen.
- sneak 13y ago
  Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. They aren't appliances.
  - jessaustin 13y ago
    What you propose is probably possible for many USB sticks, but I don't think it's possible in general. Flashing a microcontroller often requires access to a serial interface like SPI, I2C, or JTAG. That's typically on different pins than USB (which pins can be buried in potting or otherwise inaccessible to compromised hosts). In addition some models can have particular pins connected to disable flashing.
    - fest 13y ago
      Some microcontrollers I've been working with, that had USB capability also supported DFU- flashing new firmware via USB. I have also resurrected a write-broken flash drive, by re-flashing it's firmware (a tool for which was provided by microcontroller vendor, which I found out by looking at VID/PID values and googling them).
      - jessaustin 13y ago
        Oh definitely it's possible for many microcontrollers. DFU is very handy during development. I was just reacting to this statement: Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. Nothing, that is, except possibly a complete absence of such a facility! It depends on the microcontroller and how it has been wired into the USB device.
      - deleted 13y ago
        [deleted]
unwind 13y ago
How about an inline protocol analyzer that knows the USB mass storage device class protocol, and can detect when a write request is being sent? That would perhaps also make it possible to optionally prevent such requests from ever reaching the USB stick, thus adding write-protection to legacy sticks. Probably not 100% trivial given the signalling speed and general complexity of USB, but perhaps solvable using an FPGA? There is a software-only USB stack for 8-bit AVR:s, so it doesn't seem totally impossible, either. No, I don't have a startup manufacturing such a device. :) UPDATE: Ah, I just reinvented the WriteBlocker: http://www.wiebetech.com/products/USB-WriteBlocker.php http://www.wiebetech.com/products/USB-WriteBlocker.php. Sigh.
- deleted 13y ago
  [deleted]
- zokier 13y ago
  No reason to involve FPGAs (beyond performance concerns). Eg FTDI makes Arduino-like boards with host+device USB connections, seem to cost $35 at their store. With this specific device you are limited to full-speed USB which is slight inconvenience for storage use. But it's also the first product I happened to stumble upon, there probably are better alternatives out there. http://www.ftdichip.com/Products/Modules/DevelopmentModules.htm#Vinco http://www.ftdichip.com/Products/Modules/DevelopmentModules....
jonnycowboy 13y ago
www.youtube.com/watch?v=LZXaYLVFdcQ‎

wikiburner 13y ago

Is there an effective way to "mostly" airgap, if you need Internet connectivity for your work? This is a comment I posted on a similar thread a few weeks ago. ========================================= Just curious, how would airgapping be practical if you need Internet connectivity for your "real work"? For example, let's say you run a quant trading firm and the algorithms you're concerned about being stolen need connectivity to download live trading info, and then after processing that info they need to communicate buy/sell orders to the outside world. Are there any methods that could be used that would prevent all communication with a secure system (with an airgap level of certainty) besides the strictly defined data you need to do your "real work"? ----- gaius 19 days ago | link Sure, you would just use Radianz, and that is in fact what everyone does. This is a very solved problem! Bloomberg also operates a private network, and there are others too. These systems can operate perfectly well without access to the public Internet. A couple of jobs ago I worked at a financial services firm with 2 networks and 2 PCs on everyone's desk. Rednet for outside connectivity, and an internal network for real work, and never the twain shall meet. NO-ONE needs the Internet for real work, let's be honest, just for goofing off. Time we all started to prioritize security over mere convenience. ----- * wikiburner 19 days ago | link Yep, maybe trading wasn't the best example, although they are still effectively at the mercy of the security of their data providers network - which admittedly is probably quite good. Let's say you're a P.I., journalist, researcher, law enforcement, or intel agency, and need to automate news or people searches for some reason. If you were able to very strictly define the data you're expecting to receive, isn't there any way you could automatically pass this data on to a secure system without opening yourself up to exploits?

deleted 13y ago
[deleted]
Retric 13y ago
What you want is a firewall that uses deep packet inspection so that only data meeting your specifications get's through aka it's an XML file with the correct schema. Unfortunately, you can't exactly trust of the shelf Software for this stuff, however a firewall can be far simpler than a modern OS so they tend to be much more secure so you are reasonably safe just updating the inspection code. Though if you have a sufficient budget or are overly paranoid you can build your firewall from scratch. Also, what you do at the endpoint matters, opening websites in IE is going to be far less secure than say doing day trading using custom software. That said, the usual rules of defense in depth still apply, ensure that your machine can only talk to a white-list of IP address, etc etc.

kbart 13y ago

This article misses the most important security tip: do not use any proprietary software, especially the ones starting with "W" made by MS.

skrebbel 13y ago
Are you sure? How much more difficult would it be for an intelligence agency to get an open source hacker to "accidentally" inject a vulnerability disguised as a bug, than to pressure MS to write a backdoor? (or to get MS to hire a mole)
- kbart 13y ago
  Yes I'm sure. It would be much more difficult, because that vulnerability could be possibly detected by many people reviewing the code, so it must be more sophisticated and hidden than the one buried in the precompiled binary. Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet, contrary to the countless examples of products by big names. Not saying that open source is 100% secure, but it's still much safer than proprietary programs. [EDIT] Thanks for pointing out Debian SSL example, I wasn't aware of that. But it still doesn't deny the key point I mentioned - that there are more discovered backdoors and vulnerabilities in proprietary software than the open one.
  - claudius 13y ago
    > Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet. One could argue that the Debian SSL issue[0] would qualify as such a backdoor/vulnerability, although I don’t want to argue that it was introduced maliciously, merely that it could have been introduce with such intentions. [0] http://www.debian.org/security/2008/dsa-1571 http://www.debian.org/security/2008/dsa-1571
  - DanBC 13y ago
    All those people reviewing the code took two years to discover the Debian SSL bug. https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number... https://wiki.debian.org/SSLkeys https://wiki.debian.org/SSLkeys

jeanjq 13y ago

Surprised that he decided to use Windows.

podperson 13y ago
Indeed. If he picked Linux or a Mac he'd have the advantage of being able to read most MS proprietary formats without the disadvantage of embedded code executing.
- jeanjq 13y ago
  Seems to me the only reason to choose Windows for this would be to use Microsoft Office to read the NSA documents and he's stated that he's using OpenOffice, so...
Zigurd 13y ago
If you assume your connected machine is going to get p0wnd, and you rely on the air gap to prevent your secure machine from being penetrated, you could run any OS you like, no matter your opinion of how much the vendor cooperates with the NSA.
- jeanjq 13y ago
  I don't think this is right. You should reduce the entire attack surface. Since Bruce is worried about malware getting in via a removable device and cites examples that attacked Windows he should not use Windows.
- vacri 13y ago
  Given that he's going to the level of preferring a store-bought USB stick over one found in a parking lot, it shows he's concerned about transferring malware. Not using the OS for which the most malware exists seems like a sensible choice. After all, if you're going to all this trouble and inconveniencing yourself in the name of security, what's a touch more inconvenience with using an operating system that you're less user-friendly with?
  - 13y ago

nlh 13y ago

I find it somewhat amazing that a few months ago, I'd have read an article like this and thought "Man, talk about paranoid." But today, after all that I've read and learned recently, it makes perfect sense.

easytiger 13y ago
I read a comment just like this a couple of months ago. Someone saying that until this point they thought Richard Stallman was a complete paranoid nutjob but it turns out he was completely correct. I guess that's why he will be seen as a visionary in so many areas. And speaking of stallman and airgaps: http://stallman.org/stallman-computing.html http://stallman.org/stallman-computing.html > I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I fetch web pages from other sites by sending mail to a program (see git://git.gnu.org/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it.
- xanderstrike 13y ago
  While I admire his dedication to free software and security, I find it sad that he who has done so much for the internet and modern computing eschews most of it.
  - ygra 13y ago
    You could have said something similar about Dijkstra, who most of his life didn't even use a computer.
    - easytiger 13y ago
      Ihad a formal methods lecturer who insists that no computer scientist should be allowed to use a computer until they are 40
    - xanderstrike 13y ago

kephra 13y ago

Windows is a bad choice for an air gapped system. A much better would be Slackware, where its even simple to maintain an air gapped system. Maintaining a Linux with a package manager, e.g. Debian without internet is much more trouble. I had scripts to maintain an air gapped Debian 10 years ago, but can no longer recommend them, as Debian now has signed archives, and the script breaks the sign.

jlouis 13y ago
OpenBSD on some older hardware is probably even better!
claudius 13y ago
You can still use optical media (CD/DVD) or USB keys to install packages with APT, so I don’t see how Slackware would have any advantage over Debian there. There’s even a apt-offline[0] to create a list of ‘needed’ packages on one system, then download these packages on another one and transport them to the air-gapped system. Of course, you will still have to decide whether to trust these downloaded packages, and unless you trust at least some Debian Developers to do the right thing, this will be hard to do even with GPG signatures on all packages. [0] http://packages.debian.org/wheezy/apt-offline http://packages.debian.org/wheezy/apt-offline
- vezzy-fnord 13y ago
  Slackware is generally more secure by default, such as explicitly requiring root (not sudo) for package management and at least sudo for utilities that prompt the kernel. This is much in the vein of the *BSDs. Also its conservative nature, constant security advisories and eschewing of bleeding edge are a bonus.
  - claudius 13y ago
    $ dpkg-query -W -f '${Status}\n' sudo unknown ok not-installed IOW, it is perfectly possible not to use (or even install sudo) on Debian. I don’t want to argue whether Debian or Slackware have a more ‘conservative nature’ nor whether that’s an advantage, but there are of course also security advisories for Debian (e.g. today for the systemd packages…). > at least sudo for utilities that prompt the kernel Basically everything ‘prompts the kernel’ in one way or another, could you expand on how exactly Slackware manages to run when every syscall needs sudo? (Or what you mean by ‘prompt the kernel’.) I guess at the end of the day, you can configure a Debian installation to be more secure than any given Slackware installation and you can configure a Slackware installation to be more secure than any given Debian installation – this, of course, depends on your skills and experience with any of the two, so you should use with whatever you’re more comfortable :)

zactral 13y ago

It is completely possible that mentioning Windows in the article was meant to be only a smokescreen. I'm sure a person in his position would absolutely not want to publicly declare the exact solution he is using. In reality, it might as well be something completely else, like Slackware or some USB-bootable distro. Yes, this might be security through obscurity but considering that he admitted that he isn't familiar with the inner workings of Truecrypt etc, it is the safest bet. Not disclosing what exactly you are using doesn't allow an adversary with unlimited resources to adapt and optimize to break this specific scheme.

hyperpape 13y ago
That doesn't seem plausible. He could non-specifically say "don't use Windows. Ideally use [some stock linux distro] or investigate other unix operating systems that can be configured for safety." That wouldn't really give away anything.
- aliakbarkhan 13y ago
  It's not about giving things away -- it's about delaying your adversary. If the NSA takes Schneier at his word and targets him accordingly, then (assuming this is a diversionary tactic) any 0days or other attacks they attempt to send his way will fail. Now obviously that's not a long-term strategy, but it does provide an extra layer of protection against naïve attacks based on his public statements. To be clear, I'm not sure I buy the smokescreen idea, either, but your reason for disbelieving is flawed.
  - hyperpape 13y ago
    It's fair that this would make some difference. But it's not as "he's not on Windows, but we have no clue what he is on?" is a recipe for quick success. He doesn't have to say what linux distro he uses, just give a placeholder for a decent one, and he doesn't even have to use Linux. In any case, is it worth potentially misleading a lot of people for the sake of such a marginal increase in his own security? He could have an even more secure setup if he didn't talk about instituting an air gap. He's already giving away information.

beagle3 13y ago

I've been setting up networks since 2002 the following way: Internal network, NOT connected to the internet. External (small network) is connected to the internet, and has "terminal server" (Windows Terminal Server if I must, Xrdp if I can let the external servers be Linux). Firewall between outside world and external network, configured to allow reasonable work on that network. Firewall between external network and internal network only allows internal network initiated connections to the RDP port (3389) on the external network. Also, an rsync setup that allows some controlled transfer of files between inner and outer networks (preferable to USB drives - the USB ports should be disabled logically and physically, although I didn't always get to do that). This rsync setup goes through a different port, with a cable that is usually not connected (the air in "airgap"). When files need to go in or out, I plug the cable for a few minutes, and unplug when not needed. From experience, this lets you keep a network reasonably secure, without having to put two PCs on everyone's desk. Of course, there's risk: There might be a way to root the inside machines through a bug in RDP, after rooting the outside machines. However, it will work well, against "standard" attacks and malware that assume internet connectivity. Even if they get in (through a USB drive, as schneier says was done in the Iranian and US army facilities), they can't just call out to the internet.

j_s 13y ago
RDP makes it easy to access drives, devices, etc. from the the client... do you do any additional configuration to disable these features? http://geekswithblogs.net/DesigningCode/archive/2010/04/19/file-transfer-using-rdp.aspx http://geekswithblogs.net/DesigningCode/archive/2010/04/19/f...
- beagle3 13y ago
  Yes, drive sharing was disabled server side (though, if the external RDP server is compromised, one could turn this back on). On the client side, we set up the connection not to try to share anything.

spindritf 13y ago

> if you're using optical media, those disks will be impossible to erase I pop the old optical disks I'm tossing away into a microwave oven for 10 seconds at 1000 watts. How recoverable is the data stored on them? (And how cancerogenus the stench?)

emillon 13y ago
When microwaving a CD, the induction stops when the track is cut. There are usually big chunks of surface (~2cm²) unaffected. You can't read it with your drive but it's reasonable to think that some data can be retrieved from it, with enough work and money.
- crb3 13y ago
  A belt sander with rough grit should take care of that without damage to device or surroundings. Sand from the top -- that's where the data is, or used to be. For paranoid satisfaction, sand it all the way through.
  - Houshalter 13y ago
    It seems like the simplest way would be to burn it.
  - mmagin 13y ago
    I'd like to suggest to everyone trying this that: 1. holding such a thin object against a belt sander may be difficult. 2. if you lose your grip, it might fly across the room at dangerous speed.
    - crb3 13y ago
      In the same spirit, I'd like to suggest that anyone trying this use some sort of jig to hold the disc against the belt rather then try to hold it in place against lateral force with your bare fingers. Source: long-ago experience. Ouch.
venomsnake 13y ago

csandreasen 13y ago

> 1. When you set up your computer, connect it to the Internet as little as possible. It's impossible to completely avoid connecting the computer to the Internet, but try to configure it all at once and as anonymously as possible. There's no technical reason you can't keep your airgapped computer completely off the internet for its entire life cycle. I'd even go so far as to commit heresy say that this is just plain bad security advice that Mr. Schneier is giving out here. Instead, you should probably get your install media from a trusted source and use that to install the OS and any initial updates (maybe that's a manufacturer's install CD or a Linux ISO that you burned yourself - avoid anything that isn't write-once). If the OS on your airgapped machine has a unpatched remote vulnerability, you're already putting that system at risk by connecting it to the internet even once. Don't discard that trusted install media - if you need to create another airgapped machine, you're using the same airgapped data to perform the install. I realize that Bruce was discussing setting up a stand-alone computer, but I thought I'd share my experience: Years ago, around the same time that Blaster was a nuisance, I managed a network of airgapped machines. If any one of them had been hit because I chose to just let it download updates off the internet, the entire network would have been compromised. This would be much worse if you were worried about a targeted attack - every time you connect a fresh computer to the internet with the intent of moving that box over to the secure network, you're giving the attacker another opportunity to gain access. For transferring data back and forth, I've used CDs in the past, but toyed with the idea of using a dedicated serial cable for transfers instead. Tar up the files, connect the cable, tell the remote machine to listen, shoot them over, then disconnect the cable. The connection has no network stack to worry about independent programs sending data across the channel; if extra data is added, the result on the other end likely won't untar; there's no auto-execution of programs to worry about. The only thing I have to worry about being compromised are my copies of tar and cat. Removeable media in general has issues - Schneier mentions a few examples in the article of successful compromises using USB sticks.

pdonis 13y ago
If the OS on your airgapped machine has a unpatched remote vulnerability, you're already putting that system at risk by connecting it to the internet even once. Even if it's behind a NAT firewall with no external ports open? And you only connect via SSL (or SSH) to specific known hosts?

leephillips 13y ago

Knuth on his air gap: "I currently use Ubuntu Linux, on a standalone laptop—it has no Internet connection. I occasionally carry flash memory drives between this machine and the Macs that I use for network surfing and graphics; but I trust my family jewels only to Linux." : http://www.informit.com/articles/article.aspx?p=1193856 http://www.informit.com/articles/article.aspx?p=1193856

jonlucc 13y ago
In a post-Stuxnet world, can we trust flash drives? If I remember correctly, that virus would jump onto flash drives to spread to the next few computers it touched. I think I might prefer an ethernet wire connection without the outgoing wires.
- dublinben 13y ago
  As long as you wipe and format the flash drive from the secure computer every time you use it, there shouldn't be any risk. I don't think even Stuxnet could have infected a linux machine that didn't mount or autorun the partition.
  - sneak 13y ago
    Flash drives are not dumb. I know that Travis Goodspeed has had some success in reflashing their microcontrollers to speak corrupt USB to attack USB stacks of host machines (which of course run in kernel mode).
    - dublinben 13y ago
      I guess the only safe options are CDRs and one-way ethernet connections.
    - lesterbuck 13y ago
      A fascinating talk by Travis Goodspeed on the mayhem possible by reprogramming the USB controller in a disk: http://www.youtube.com/watch?v=D8Im0_KUEf8 http://www.youtube.com/watch?v=D8Im0_KUEf8 Writing a Thumbdrive from Scratch: Prototyping Active Disk Anti-Forensics

danso 13y ago

Schneier is not as paranoid or as particular as I thought he would be: > 1. When you set up your computer, connect it to the Internet as little as possible. It's impossible to completely avoid connecting the computer to the Internet, but try to configure it all at once and as anonymously as possible. I purchased my computer off-the-shelf in a big box store, then went to a friend's network and downloaded everything I needed in a single session. (The ultra-paranoid way to do this is to buy two identical computers, configure one using the above method, upload the results to a cloud-based anti-virus checker, and transfer the results of that to the air gap machine using a one-way process.) A friend's house is not "anonymous". If you have the need for an air gap, then you probably should assume that your attackers have the ability to suss out your off and online social network. In a not-too-distant future, it's not hard to imagine a surveillance operative being able to expand their examination of network traffic to not only include you, but associates of yours, and then to detect when an online-installation routine was run. At that point, the fact that that computer's fingerprint (however it may be calculated) was never seen again from that friend's home might be one flag of several in a comprehensive surveillance flag. Though I guess if Schneier is talking about a off-the-parts computer, I'm assuming he means a desktop computer that can't be assembled in the Starbucks two states away to connect to the Wifi. OTOH, I think I would prefer a Linux laptop as my air-gapped computer

keyme 13y ago

"Don't worry too much about patching your system; in general, the risk of the executable code is worse than the risk of not having your patches up to date." Not good advice. If you plan to open anything other than text files on the machine, un-patched software is almost as big a risk as transferring executables. The only difference is that it seems less dangerous to you.

tptacek 13y ago
I came here to say the exact same thing. The problem with complicated file formats isn't that they contain "macros"; it's that the code that parses and interprets those files is prone to memory corruption.

fit2rule 13y ago

I'm not sure air-gaps are as safe as we think they are. Yes, its tinfoil time: the NSA and various other Defence agencies have deployed satellites capable of tuning into any CPU built since 1998. Air gap in a deep, deep hole. Or maybe on the other side of the Sun. These are the only really safe places fur humans subjects of the new Tech Overlords to to stash data...

charlus 13y ago
It's something worth thinking about in concept. Comments in here saying that this sort of precaution was nonsensical only months ago. So perhaps it's worth considering the ideas and precautions that seem ridiculous now.
qwerty_asdf 13y ago
[citation needed]
- fit2rule 13y ago
  I don't have a desire to provide a citation because I'm exploring, conjecturing .. I mean, after all its not infeasible that the satellite-launches that the NSA has been progressively making, over and over, are to support a network of CPU-sipping listening posts. This had been discussed even in the 80's, in certain circles ..

antocv 13y ago

Schneier is kind of disappointing more and more... Be cautious of this advice dear readers. " (The ultra-paranoid way to do this is to buy two identical computers, configure one using the above method, upload the results to a cloud-based anti-virus checker, and transfer the results of that to the air gap machine using a one-way process.)" No, the ultra paranoid would buy two computers, perform install 1 from friend 1s internet connection, downloading everything keeping a copy and check-sums, then perform install 2 on a friend of a friends connection, then compare the results of both the downloaded check-sums and the installation. (For certain flavors of Linux it should be the same). There is no point in uploading to a cloud-anti-virus checker if the NSA is after you, its not like they are going to use Slammer or some other known virus against you. Jesus christ, and he is using Windows !? WTF. He is going against his own advice - to use public/free software as often as possible. For the step of moving files between air-gapped computer, he suggests using USB sticks. He forgot to say that you must encrypt the entire usb-stick as well, You dont write a file-system to it! Only an encrypted blob. As "viruses" can be transferred on the NTFS he is probably using. Even Linux fs had a vulnerability - when the kernel tried to mount the fs it would privilege escalate to root and run code - code that can be hidden in the NTFS alternate (hidden) streams. EDIT: For the NSA-agent wishing to leak, a good idea is too look into HaikuOS, MenuetOS etc and use those instead of GNU/Linux, or ArchHurd. Something very rare, something unexpected. Modify the installation from the default as much as you can. Hm, we should make an Ask HN thread - what is the best ingenious methods for current NSA employees to leak again, now that they have to share a computer with a partner?

commandar 13y ago
>For the NSA-agent wishing to leak, a good idea is too look into HaikuOS, MenuetOS etc and use those instead of GNU/Linux, or ArchHurd. Something very rare, something unexpected. Is that really the best idea, though? One of the things Linux has going for it is a couple of decades worth of public scrutiny and hardening.
- elq 13y ago
  The suggestion is that hardening is less valuable than obscurity. As long as your choice is secret and uncommon you'll probably be safer than a well known hardened OS.

7952 13y ago

Ironically it is a result of modern encryption that separating things from the internet is so difficult. If every app sends data over an encrypted channel it makes it much harder to audit what exactly it is doing. You can't impose rules if you don't know what the data is or where it will end up.

Shivetya 13y ago

this reminds me a lot of what a lot of radio personalities who deal with personal finances recommend, the system which you do your banking on should only do that and nothing more. While such a system is obviously still connected to the net, you reduce your risk by running a discreet set of software. To be totally safe you would need a room which protects from emissions escaping it. Back in my service days we had system isolated as such simply because you could be monitored through walls.

g8oz 13y ago
discrete

apaprocki 13y ago

Isn't this an example of poor OPSEC? If he is in fact using the procedures spelled out in this post, he's giving his potential attackers a clear picture of all of his security measures so that they can focus effort on exploiting a weakness.

notacoward 13y ago

I'd do two things differently. First, instead of using removable media from which data could still be recovered, I'd get a second Ethernet switch. Whenever I wanted to move data from my regular machine to my secure machine, I'd have to move the cable on my regular machine from one switch to the other. Thus it would be physically impossible to be connected to both internal and external networks simultaneously, and I wouldn't be leaving any persistent physical data trail like a USB stick or CD-ROM. The second thing I'd do is a double air gap. Think of it as an airlock: you can't open the inner door until you're sure no contaminants got through the outer door. The intermediate host would have a single purpose: run malware checks. Thus, only data that had already been checked in a secure environment would even be allowed to touch the real secure machine.

bradleyland 13y ago
Networks are avoided for a reason. In your scenario, establishing a network connection between the intermediate computer and your "air gap" computer is a breach of the air gap if the intermediate computer has been compromised. The same argument could be made for removable media, but there are good methods for tightly controlling the transfer of data on removable media. Network interfaces have a larger attack surface.
- notacoward 13y ago
  There are methods for tightly controlling the transfer of data on networks too. It's really trivial to set things up so that the only connection allowed in either direction is the one your file-transfer program is using. That's Firewall 101, too restrictive for any normal machine but easy to accomplish. Also, a compromise of the intermediate computer doesn't represent a breach of the air gap. The same two-gap approach could be used with removable media. It would still provide the same benefits (and vulnerabilities). You seem to be saying that the intermediate computer could get compromised because the air gap is breached, and the air gap is breached because the intermediate computer could be compromised. A bit circular, don't you think? That intermediate computer can provide an extra layer of protection or an extra vector for attack. Which matters more will depend on its configuration and use, but for any semi-sane configuration the protective aspect would quickly dominate. The intermediate computer in a double-air-gap setup would be just as secure as Schneier's single-air-gapped one, and the third computer even more so.

avn2109 13y ago

I'd actually be interested in hearing from Tptacek on this topic, but he's absent for once. Weird.

acomjean 13y ago

I worked on an "Air Gapped" network. We didn't call it that. As the internet and open source took off it became more and more painful. To get files over to the network, we'd have to download from internet and then burn to dvd and bring it over. The thinking was that DVD's with their write once capability would prevent unwanted files from hoping aboard. This didn't help if the file you were transfering was infected, but files were virus checked before burning. Oddly files went Windows->Dvd->HPUX machines meaning the virus scan on windows was somewhat useless. But having no access to cpan or online research on your main work machine was hard.

scott_karana 13y ago

Man, Bleachbit sure took no time at all to put up his "testimonial" blurb on their site! > "Since I started working with Snowden's documents, I have been using [...] BleachBit" -- Bruce Schneier

nivla 13y ago
haha I was thinking the same when I noticed it. Has anyone here used BleachBit? From the description it looks like ccleaner + eraser mix.
- scott_karana 13y ago
  I'd try it out if I weren't a Mac guy these days. Looks decent, and nicely minimalist.

gknoy 13y ago

Bruce gives a good collection of tips, but in his specific case it probably matters little. If he is a target of surveillance, I would be thoroughly surprised if he did not get "black bag" intrusions (as he puts it). He is a target that is definitely high enough priority ("I have Snowden's documents!") that dedicating assets to investigation is more likely, and at that point an air gap seems more like an inconvenience to the attacker than true protection.

deleted 13y ago

[deleted]

macca321 13y ago

How about conducting all IO by webcam OCR?

john_b 13y ago

For the really paranoid, to the extent that your data can be represented as a text file, you can print it on paper from your internet connected machine and OCR it into your air gapped machine, and vice versa. In this case, you only have to worry about your printer or scanner having a backdoor. If you are very confident in your OCR accuracy, you can encrypt it prior to printing and decrypt it after scanning. Just remember to burn the paper afterwards.

BrianYesh 13y ago

"Note: the first company to market a USB stick with a light that indicates a write operation -- not read or write; I've got one of those -- wins a prize."

mrpdaemon 13y ago

What about isolation? With heavy use of virtualization one can make the air gapped machine even more secure: - Only open documents in a virtual machine - Only interface with the document transfer media (cd/dvd etc.) through virtual machines. Don't ever mount or use this media on your host. - Clone a new throw-away virtual machine for opening EACH document and delete it after reading the document About his points: 1) This is nonsense. It's possible to set up an OS (for example linux) with zero internet connectivity, just download the ISO on another computer, verify checksums and signatures, burn onto optical media and you're set. 8) Also, use one-time media. Write once on the internet host, fill up and finalize media, read once on the air gap host, destroy media. Also, I don't think Schneier is recommending to use Windows for this task. He's just assuming that most people out there is using Windows and can use these tips to improve their security. For his own high security setup(s) I'm pretty sure he'd have the common sense to not use Windows.

logicallee 13y ago

Secure Linux air gap. Here is a real secure Linux air gap: 1. From a friend's computer, burn two copies of your favorite Linux liveCD. 2. Hold the two identical discs so that you can see the reflection of the document in front of you in one (mirror writing) and the reflection of the reflection in the other. (normal writing.) 3. You now have a secure Linux air gap with which you can read any document.

paul 13y ago

He forgot to mention keeping the computer in a faraday cage. If he has Snowden info, it seems likely that intelligence agencies would be monitoring him closely enough to use Van Eck phreaking to spy on his laptop display (or other part of the computer that leak info through rf, which is all of them).

elq 13y ago
Schneier explicitly mentioned tempest (http://en.wikipedia.org/wiki/Tempest_(codename) http://en.wikipedia.org/wiki/Tempest_(codename)) in the article.
- jedunnigan 13y ago
  Wild stuff! http://lasecwww.epfl.ch/keyboard/ http://lasecwww.epfl.ch/keyboard/

MarkMc 13y ago

I'd like to sign my executable files on an air-gapped machine. Problem is, the code-signing tools for OS X and Windows (ie. codesign and signtool.exe) seem to require access to my private key to generate the signature AND and an internet connection to generate the timestamp. Is there any solution here?

guard-of-terra 13y ago

Also you can boot from livecd each time. You can use livecd boot on your internet-enabled device. Imagine fellow rootkiter's frustration when he realises root filesystem is read only. Of course you're still vulnerable to BIOS/firmware malware.

derekp7 13y ago

There is another backchannel that can be used if your air-gapped computer ever does get compromised, which I haven't seen anyone discuss yet. If your internet-connected computer and air-gapped computer both have audio speakers / microphone, then that seems like a perfect covert way for a compromise to set up wireless communications between them An audio signal can appear to be similar to fan noise, or outside of human hearing range. I wonder if this has ever been exploited before.

deleted 13y ago

[deleted]

deleted 13y ago

[deleted]

ChrisNorstrom 13y ago

What about using a Linux CD? You can get online and use it for what you need without it downloading or installing software. Every time you re-boot it's guaranteed to be the same OS without any spying malware on it... I guess you'd have to save files on a USB drive though.

Sami_Lehtinen 13y ago

I've been using serial cable with data leds and gpg ascii armored data over it. Very easy to visually inspect all data before further processing. Only attack vector remaining is gpg ascii armored parser, signature verification & decryption. Afaik, this is quite safe. This computer has not been connected to the internet ever, and it won't be in future. Don't forget physical site security.

Grue3 13y ago

He forgot that the computer must be wrapped in tinfoil.

CurtMonash 13y ago

I ordered a new desktop computer last night, and a number of the options from which I chose did NOT seem to have Wi-Fi built in. Rather, they sold low-cost USB devices for Wi-Fi connectivity. I didn't actually check all the motherboard specs to confirm this, but it seems pretty accurate. So getting an air-gapped computer without Wi-Fi would seem to be the least of the problems.