3 ms·

> It's really trivial to set things up so that the only connection allowed in either direction is the one your file-transfer program is using. You sound a bit

> It's really trivial to set things up so that the only connection allowed in either direction is the one your file-transfer program is using. You sound a bit like a 10-year-old playing James Bond. Network packets have plenty of metadata fields and slack space that can be used for data egress. And then there are steganographic methods like playing tricks with packet fragmentation, retransmission, and jitter. The only way to do it with any degree of security is to convert to a primitive serial connection like RS-232 and run the data through an NSA-style guard device.

notacoward 13y ago
I'm not the one thinking magically. Of course it's possible to do nasty things even on a physically isolated network. I know because I was doing nasty things on physically isolated thicknet twenty-some years ago. ;) But that's not the point. The point is that there are also vulnerabilities in the proposed alternative. Those vulnerabilities have in fact existed even longer (see mseebach's diskette comment) and Schneier mentions a couple that should give pause to anyone from the "USB sticks are better" camp. When all is said and done, "left the USB stick on the counter" vulnerability is probably the largest of all. Recording your data transfer, which is what that amounts to, is doing half of the bad guy's job already. Brilliant. Sure, you avoid one set of problems, but only by walking into a much worse set. "convert to a primitive serial connection like RS-232 and run the data through an NSA-style guard device." Actually I thought of suggesting line-of-sight IR. That's a true air gap, optical is harder than electrical to eavesdrop on, and it still avoids the vulnerabilities specific to sneakernet.
- bradleyland 13y ago
  Hold the phone. Who is engaged in magical thinking here? Everyone in this conversation appears to be presenting rational arguments. There's some disagreement over whether networks have a larger attack surface than physical media, but neither side has engaged in any magical thinking.

notacoward 13y ago

I'm not the one thinking magically. Of course it's possible to do nasty things even on a physically isolated network. I know because I was doing nasty things on physically isolated thicknet twenty-some years ago. ;) But that's not the point. The point is that there are also vulnerabilities in the proposed alternative. Those vulnerabilities have in fact existed even longer (see mseebach's diskette comment) and Schneier mentions a couple that should give pause to anyone from the "USB sticks are better" camp. When all is said and done, "left the USB stick on the counter" vulnerability is probably the largest of all. Recording your data transfer, which is what that amounts to, is doing half of the bad guy's job already. Brilliant. Sure, you avoid one set of problems, but only by walking into a much worse set. "convert to a primitive serial connection like RS-232 and run the data through an NSA-style guard device." Actually I thought of suggesting line-of-sight IR. That's a true air gap, optical is harder than electrical to eavesdrop on, and it still avoids the vulnerabilities specific to sneakernet.

bradleyland 13y ago
Hold the phone. Who is engaged in magical thinking here? Everyone in this conversation appears to be presenting rational arguments. There's some disagreement over whether networks have a larger attack surface than physical media, but neither side has engaged in any magical thinking.