4 ms·

Is there an effective way to "mostly" airgap, if you need Internet connectivity for your work? This is a comment I posted on a similar thread a few weeks ago.

Is there an effective way to "mostly" airgap, if you need Internet connectivity for your work? This is a comment I posted on a similar thread a few weeks ago. ========================================= Just curious, how would airgapping be practical if you need Internet connectivity for your "real work"? For example, let's say you run a quant trading firm and the algorithms you're concerned about being stolen need connectivity to download live trading info, and then after processing that info they need to communicate buy/sell orders to the outside world. Are there any methods that could be used that would prevent all communication with a secure system (with an airgap level of certainty) besides the strictly defined data you need to do your "real work"? ----- gaius 19 days ago | link Sure, you would just use Radianz, and that is in fact what everyone does. This is a very solved problem! Bloomberg also operates a private network, and there are others too. These systems can operate perfectly well without access to the public Internet. A couple of jobs ago I worked at a financial services firm with 2 networks and 2 PCs on everyone's desk. Rednet for outside connectivity, and an internal network for real work, and never the twain shall meet. NO-ONE needs the Internet for real work, let's be honest, just for goofing off. Time we all started to prioritize security over mere convenience. ----- * wikiburner 19 days ago | link Yep, maybe trading wasn't the best example, although they are still effectively at the mercy of the security of their data providers network - which admittedly is probably quite good. Let's say you're a P.I., journalist, researcher, law enforcement, or intel agency, and need to automate news or people searches for some reason. If you were able to very strictly define the data you're expecting to receive, isn't there any way you could automatically pass this data on to a secure system without opening yourself up to exploits?

deleted 13y ago
[deleted]
Retric 13y ago
What you want is a firewall that uses deep packet inspection so that only data meeting your specifications get's through aka it's an XML file with the correct schema. Unfortunately, you can't exactly trust of the shelf Software for this stuff, however a firewall can be far simpler than a modern OS so they tend to be much more secure so you are reasonably safe just updating the inspection code. Though if you have a sufficient budget or are overly paranoid you can build your firewall from scratch. Also, what you do at the endpoint matters, opening websites in IE is going to be far less secure than say doing day trading using custom software. That said, the usual rules of defense in depth still apply, ensure that your machine can only talk to a white-list of IP address, etc etc.
Spearchucker 13y ago
I've not played in this space for a looong time but... There are four things you want to do - 1. Get a herd of cash together. The stuff that follows is not cheap. 2. Set up a hardware data diode (an appliance that only allows data to travel in one direction). [1] 3. Set up an air gap like Whale Comm's appliance used to do (two 1U rack-mount servers, back-to-back, which [dramatization alert] automates plugging a USB stick into one server, copying data onto it, pulling it out, sticking it into the other server, and coping the data onto it - at ~10Mb/s, if memory serves). [2] 4. Any time anything traverses the trust boundary, convert from one format to another, so PDF becomes RTF, DOC becomes TXT, PNG becomes GIF, and so on. The point is that converting attachments into other formats drops malicious payloads, or stops them from exploiting vulnerabilities in the apps that open the original formats. [1] Tenix used to do one, but they cost crazy money (millions). I don't know much about this space anymore, but this might provide some pointers: http://en.wikipedia.org/wiki/Unidirectional_network http://en.wikipedia.org/wiki/Unidirectional_network [2] Whale Communications was acquired by Microsoft. The product is now called ForeFront Unified Access Gateway, and while still a good application firewall, no longer provides that air gap (http://en.wikipedia.org/wiki/Microsoft_Forefront_Unified_Access_Gateway http://en.wikipedia.org/wiki/Microsoft_Forefront_Unified_Acc...). I've no idea who else can do this.
- sneak 13y ago
  It seems like a wifi device in monitor mode might work for this. You could write a small utility to assemble streams from sequenced udp broadcast traffic or raw frames, and ensure the radio in the airgap machine never transmits.
  - chockablock 13y ago
    > ensure the radio in the airgap machine never transmits How? Do any wifi devices use separate receive/xmit antennas? If not, then you are back to relying on software.
- pilom 13y ago
  Nowadays the poor mans 1-way data diode is a fiber link with the bad transmit connector physically obstructed. So you're using fiber where transmit is on one fiber and receive is on the other but the receive is blocked. Then only use 1-way protocols (UDP).
deftnerd 13y ago
I'm a big fan of Qubes-OS. It's an interesting OS distro that's based on the Xen hyprevisor and allows you to maintain different VM zones that integrate with the desktop. You could have a Banking VM that only runs a certain browser and the firewall only lets traffic to-and-from your banks site. You Work VM could be set to only allow traffic through a VPN connection to your work. Your BitCoin VM could be set to not have any network traffic at all. You could even have a Tor VM with a browser. http://qubes-os.org/trac http://qubes-os.org/trac
- hershel 13y ago
  But qubes did issue a security advisory , talking about a security bug in VT-d/VT-x hardware that only intel can fix. For someone like schneier who want to avoid the NSA , maybe qubes is not enough.
danbruc 13y ago
What about having two computers, one connected to the internet, one disconnected. Then develop and install two custom services - one obtains the required information, e.g. the trading data, from the internet or sends data to the internet. The other service runs on the disconnected computer and communicates with the software actually using and producing the data, probably in the form of a proxy server. Finally connect both computers using something simple like a null modem cable and make both service communicate over this link using a very simple proprietary protocol. Assuming the disconnected computer is not already compromised before you start using the system and you have not been extremely sloppy when you designed and implemented the two services, it should be quite hard to compromise the disconnected computer. One way would be to find valid data (passing the protocol checker in the receiving service) to be transferred from the connected to the disconnected computer that triggers a bug in any data consuming software leading to code injection and execution which in turn sends secret data over the null modem link to the (compromised) connected computer. That seems to be a quite a complex attack to me, especially if the data traveling over the link is something simple like stock price time series which enables very simple protocols and thorough validation. To avoid some classes of bugs, e.g. buffer overflows, in the services linking both computers I would implement them using a managed runtime like .NET. This will of course expose the system to vulnerabilities in the underlying runtime.
_wiv7 13y ago
A few years ago, I once met someone who worked on imaging devices for satellites for a military contractor, which was about all he would say about the specific work he did. He indicated that the building they did their work in had _no_ internet access. Generally, if they wanted to refer to things on the internet, they had to go to some internet-connected computers in another building, print out whatever they wanted and bring it back to the building they worked in. Perhaps it's unrealistic to expect security without tradeoffs of convenience.
- pilom 13y ago
  Sounds like standard operating procedure for Classified programs. Everything is either printed and brought in, or burned to a CD-R and virus scanned and then brought in.
6d0debc071 13y ago
Depending on the bandwidth you wanted, the first thing I thought of was having the output orders on one computer - perhaps using something with a higher data density than plain text - aiming a webcam at that computer's monitor and using some form of image recognition to copy the orders across.

deleted 13y ago

[deleted]

Retric 13y ago

What you want is a firewall that uses deep packet inspection so that only data meeting your specifications get's through aka it's an XML file with the correct schema. Unfortunately, you can't exactly trust of the shelf Software for this stuff, however a firewall can be far simpler than a modern OS so they tend to be much more secure so you are reasonably safe just updating the inspection code. Though if you have a sufficient budget or are overly paranoid you can build your firewall from scratch. Also, what you do at the endpoint matters, opening websites in IE is going to be far less secure than say doing day trading using custom software. That said, the usual rules of defense in depth still apply, ensure that your machine can only talk to a white-list of IP address, etc etc.

Spearchucker 13y ago

I've not played in this space for a looong time but... There are four things you want to do - 1. Get a herd of cash together. The stuff that follows is not cheap. 2. Set up a hardware data diode (an appliance that only allows data to travel in one direction). [1] 3. Set up an air gap like Whale Comm's appliance used to do (two 1U rack-mount servers, back-to-back, which [dramatization alert] automates plugging a USB stick into one server, copying data onto it, pulling it out, sticking it into the other server, and coping the data onto it - at ~10Mb/s, if memory serves). [2] 4. Any time anything traverses the trust boundary, convert from one format to another, so PDF becomes RTF, DOC becomes TXT, PNG becomes GIF, and so on. The point is that converting attachments into other formats drops malicious payloads, or stops them from exploiting vulnerabilities in the apps that open the original formats. [1] Tenix used to do one, but they cost crazy money (millions). I don't know much about this space anymore, but this might provide some pointers: http://en.wikipedia.org/wiki/Unidirectional_network http://en.wikipedia.org/wiki/Unidirectional_network [2] Whale Communications was acquired by Microsoft. The product is now called ForeFront Unified Access Gateway, and while still a good application firewall, no longer provides that air gap (http://en.wikipedia.org/wiki/Microsoft_Forefront_Unified_Access_Gateway http://en.wikipedia.org/wiki/Microsoft_Forefront_Unified_Acc...). I've no idea who else can do this.

sneak 13y ago
It seems like a wifi device in monitor mode might work for this. You could write a small utility to assemble streams from sequenced udp broadcast traffic or raw frames, and ensure the radio in the airgap machine never transmits.
- chockablock 13y ago
  > ensure the radio in the airgap machine never transmits How? Do any wifi devices use separate receive/xmit antennas? If not, then you are back to relying on software.
pilom 13y ago
Nowadays the poor mans 1-way data diode is a fiber link with the bad transmit connector physically obstructed. So you're using fiber where transmit is on one fiber and receive is on the other but the receive is blocked. Then only use 1-way protocols (UDP).

deftnerd 13y ago

I'm a big fan of Qubes-OS. It's an interesting OS distro that's based on the Xen hyprevisor and allows you to maintain different VM zones that integrate with the desktop. You could have a Banking VM that only runs a certain browser and the firewall only lets traffic to-and-from your banks site. You Work VM could be set to only allow traffic through a VPN connection to your work. Your BitCoin VM could be set to not have any network traffic at all. You could even have a Tor VM with a browser. http://qubes-os.org/trac http://qubes-os.org/trac

hershel 13y ago
But qubes did issue a security advisory , talking about a security bug in VT-d/VT-x hardware that only intel can fix. For someone like schneier who want to avoid the NSA , maybe qubes is not enough.

danbruc 13y ago

What about having two computers, one connected to the internet, one disconnected. Then develop and install two custom services - one obtains the required information, e.g. the trading data, from the internet or sends data to the internet. The other service runs on the disconnected computer and communicates with the software actually using and producing the data, probably in the form of a proxy server. Finally connect both computers using something simple like a null modem cable and make both service communicate over this link using a very simple proprietary protocol. Assuming the disconnected computer is not already compromised before you start using the system and you have not been extremely sloppy when you designed and implemented the two services, it should be quite hard to compromise the disconnected computer. One way would be to find valid data (passing the protocol checker in the receiving service) to be transferred from the connected to the disconnected computer that triggers a bug in any data consuming software leading to code injection and execution which in turn sends secret data over the null modem link to the (compromised) connected computer. That seems to be a quite a complex attack to me, especially if the data traveling over the link is something simple like stock price time series which enables very simple protocols and thorough validation. To avoid some classes of bugs, e.g. buffer overflows, in the services linking both computers I would implement them using a managed runtime like .NET. This will of course expose the system to vulnerabilities in the underlying runtime.

_wiv7 13y ago

A few years ago, I once met someone who worked on imaging devices for satellites for a military contractor, which was about all he would say about the specific work he did. He indicated that the building they did their work in had _no_ internet access. Generally, if they wanted to refer to things on the internet, they had to go to some internet-connected computers in another building, print out whatever they wanted and bring it back to the building they worked in. Perhaps it's unrealistic to expect security without tradeoffs of convenience.

pilom 13y ago
Sounds like standard operating procedure for Classified programs. Everything is either printed and brought in, or burned to a CD-R and virus scanned and then brought in.

6d0debc071 13y ago

Depending on the bandwidth you wanted, the first thing I thought of was having the output orders on one computer - perhaps using something with a higher data density than plain text - aiming a webcam at that computer's monitor and using some form of image recognition to copy the orders across.