Hacker News Reader

Comment by gaius | Hacker News Reader

Many years ago I worked on a secure system that comprised a Sun running the webserver, connected over a 9-pin RS232 serial cable to another box running Windows 95, on which the secure part of the system ran, which was in turn connected via an ISDN line to some mainframe somewhere. I've never heard of a case of Windows being compromised via the serial port!

View on HN

I implemented a secure logging system once, where we really wanted to be sure we have the logs and that they cannot be erased via an online attack.

What we did was use a serial port, but with no protocol (just plain ascii) and with the return wire physically cut. There was hardware flow control (RTS and CTS were there), but you could only send data one way. The logging machine at the other end wasn't connected to any other network.

You want security, you have to deal with physical security.

> I've never heard of Windows being compromised via the serial port!

As a point of order: serial port exploits exist for other OSes (Linux, Juniper, Cisco, APC...) and also for windows virtual com ports so whilst probably not trivial it's not entirely infeasible either.

Oh, nothing's infeasible, but the decision was made (not by me, tho' I agreed with it) to use an OS that didn't even offer a shell on COM1 at all. We could have used MacOS 7.5 equally well. The serial handling was raw; the worst thing that could happen (we believed) was that the process could be crashed by an attacker, at which point the port would just go dead and need a human to restart it, but there was no way to get sufficient control to do anything with the ISDN line (and even if there were, there was more security on the other side).

Point of information: that's a point of information, not a point of order.

http://www.apdaweb.org/guide/rules

Reply on news.ycombinator.com