Hacker News Reader

Comment by jrockway | Hacker News Reader

Cyberterrorism is a bullshit argument. If you don't want your machines to be attacked from the Internet, don't connect them to the Internet. In fact, governments and big companies already do this!

At work, we have an IP network called BARONET. It's like the Internet except it's not. There is a bridge on one machine that proxies HTTP requests from this network to the Internet. There are no routes to the Internet.

This significantly reduces the possibility of "cyberattacks", since you'll have to go through that proxy box. (Which probably runs Windows, but hey... if you actually cared about security, you wouldn't do that. The rest of the idea is good.)

View on HN

Many years ago I worked on a secure system that comprised a Sun running the webserver, connected over a 9-pin RS232 serial cable to another box running Windows 95, on which the secure part of the system ran, which was in turn connected via an ISDN line to some mainframe somewhere. I've never heard of a case of Windows being compromised via the serial port!

> I've never heard of Windows being compromised via the serial port!

As a point of order: serial port exploits exist for other OSes (Linux, Juniper, Cisco, APC...) and also for windows virtual com ports so whilst probably not trivial it's not entirely infeasible either.

Oh, nothing's infeasible, but the decision was made (not by me, tho' I agreed with it) to use an OS that didn't even offer a shell on COM1 at all. We could have used MacOS 7.5 equally well. The serial handling was raw; the worst thing that could happen (we believed) was that the process could be crashed by an attacker, at which point the port would just go dead and need a human to restart it, but there was no way to get sufficient control to do anything with the ISDN line (and even if there were, there was more security on the other side).

Point of information: that's a point of information, not a point of order.

http://www.apdaweb.org/guide/rules

I implemented a secure logging system once, where we really wanted to be sure we have the logs and that they cannot be erased via an online attack.

What we did was use a serial port, but with no protocol (just plain ascii) and with the return wire physically cut. There was hardware flow control (RTS and CTS were there), but you could only send data one way. The logging machine at the other end wasn't connected to any other network.

You want security, you have to deal with physical security.

The trouble with this kind of thing from the perspective of government is that not everybody who runs important things does it. Those that do may not always do it well, and if they don't, there generally isn't anyone in government with the expertise or responsibility to tell them things like "if you actually cared about security, you wouldn't do that".

The other problem with it is anthropomorphic Stuxnet, which giggles like a schoolgirl when anyone says there's no route to the Internet.

http://en.wikipedia.org/wiki/Anthropomorphism

They can't make country's networks secure by covering them with an `one-size-fits-all' global firewall either. Once they cover up all existing holes, new ones have to be `punched through' to achieve useful functionality -- opening new attack surfaces. Cat and mouse at best, countless hacks more realistically. Never mind inside jobs -- and also remember the Google hack springboarded from within via vulnerable IE.

Could you explain what does that `anthropomorphic Stuxnet' stand for?

They can't make country's networks secure by covering them with an `one-size-fits-all' global firewall either.

True, but I don't think that's central to what most governments are seeking to do, if it is as all. Even the US "kill switch bill" was almost entirely about things other than the so-called "kill switch".

Could you explain what does that `anthropomorphic Stuxnet' stand for?

The "anthropomorphic" bit was just me being excessively silly and forgetting that it's not a very common word even among native English speakers. My apologies. Stuxnet does not, in fact, giggle.

As for Stuxnet: As jrockway correctly pointed out you can secure a network against attacks from the Internet by not connecting it to the Internet. But, on the other hand, one of the most notable attacks in recent history, and one that I think that governments have in mind when thinking about cybersecurity, is an attack that targeted (and reached) systems which weren't connected to the Internet.

http://en.wikipedia.org/wiki/Anthropomorphism Anthropomorphism is a term coined in the mid 1700s to refer to any attribution of human characteristics (or characteristics assumed to belong only to humans) to non-human animals or non-living things, phenomena, material states and objects or abstract concepts, such as god(s).

http://en.wikipedia.org/wiki/Stuxnet Stuxnet attacked Windows systems using an unprecedented four zero-day attacks (plus the CPLINK vulnerability and a vulnerability used by the Conficker worm) It is initially spread using infected removable drives such as USB flash drives, and then uses other exploits and techniques such as peer-to-peer RPC to infect and update other computers inside private networks that are not directly connected to the Internet.

Oh, and here I was assuming the ((giggling)) `anthropomorphic Stuxnet' (the whole phrase) was a parabole for some other malware, spontaneous network effect (like the popular `routing around censorship') or perhaps a hacktivist group. Disappointed a bit now that you explained it, but thanks anyway :-) Somehow I've missed the fact that Stuxnet worked via good ole sneakernet rather than the usual kind of network.

Semi-related, there was that old sci-fi story by Stanisław Lem. A mad scientist was researching two AIs (based on organical matter, IIRC) that somehow communicated with one another in spite of some distance and thorogh screening of all known means of communication. The scientist was puzzled beyond comprehension; story's protagonist notes the scientist himself served as as unnwitting messenger -- as he (affectionaly) touched AI's chassiss, he subconsciously passed data by taping on 'em, probably somehow `programmed' to do so by the other AI. Oh well.

To be more precise, there are routes from the internet but not always back to it; not that I expect anthropomorphic Stuxnet to understand, it wasn't programmed with a brain.

Reply on news.ycombinator.com