Hacker News Reader

Comment by can16358p | Hacker News Reader

Simple question: what would be the mitigation against any security threats in the randomly-bought off-the-shelf products? E.g. In a case there is a general hardware exploit that isn't targeted to Monzo explicitly, but since you've bought that item (e.g. A router) there is a possible attack vector.

View on HN

A few things:

- Since all the components we purchase are kept air-gapped, you'd need to already be on a machine in the air-gapped system (which isn't assembled and powered on except when we need to deal with key material) to exploit a vulnerability

- We're keeping things as minimal as possible in what we trust from coming out a store, for example if we purchase a Laptop we gut it of most of its components before it goes near our key material, Laptop's dont need batteries (or even CMOS batteries) to run basic live systems so they're going out.

- Compromising one part of the system won't let you sneak private key materials out on its own by-design, the part we've tried to make the hardest is exfiltration, the only material that leaves the air-gapped system leaves either as QR codes on a screen or on CD-R drives that we keep for years in a safe in their own tamper evident bags. This is all part of an effort to try and make sneaking private material out (even if you had full control of the system) as difficult as possible to do without being detected.

Have you gone fully paranoid and your air-gaped system is in a Faraday cage inside an anechoic chamber? Things like bus radio [1], coil whine and power fluctuations can be used (it has been shown) to exfiltrate data.

[1] https://github.com/fulldecent/system-bus-radio

We haven't gone as far as a Faraday Cage inside an anechoic chamber because we think the risks of these attacks is (luckily) not big enough (yet) for now to justify these. Eventually though? Maybe.

There's also projects to guess keystrokes based on sound which don't even require you to be on the host device https://news.ycombinator.com/item?id=29266783

Having worked in systems in the basements of TEMPEST checked buildings, I can say that the attacker first needs to eliminate the physical security measures, and manage to get close to the devices close to the servers storing, processing, transmitting the classified information. After that first breach via personally, or a specific device such as a USB dongle used by a user, the software needs to infect airgapped computers and find its way to the servers. Afterwards, the attacker needs to be close to the facility to listen to the radio, whose waves managed to get through the fortified walls with Faraday cages. And if this scenario happens, there is a huge problem with security, other than a system of a malware and an AM radio.

I was more thinking along the lines of an insider close to the device :)

In this case the private key is in HSM, and the laptop has no access to any interesting information worth to exfiltrate. Air gap is to prevent intrusion.

How do you secure physical access? Tamper evident bags and stuff are nice, but they'll only allow you to discover a breach after the fact, potentially days/weeks after the damage is done (said damage can be sneaky and just use the keys to extract sensitive data or introduce further malicious software into the infrastructure, which may remain there even after the keys themselves are rotated).

Totally understandable if you can't/don't want to answer obviously.

Everything lives in safes and those safes are covered by cameras, if you try to drill the safes you'll be found (or heard) a long time before you manage to break in

Unless someone figures out how to compromise the cameras and microphones. (Maybe I've watched too many Hollywood heist movies?)

I believe there is multiple redundancy both in cameras being in multiple places and also delivery mechanisms (local copy + remote stream etc). I'm inclined to believe that there are more mitigations that haven't been told in the post, which is plausible.

Hacking the closed-circuit cameras probably only works in a James Bond movie, since all you have to do is keep that circuit air-gapped to prevent it. I imagine that physical access to the cameras' control system is also guarded.

Beware that normal CD-R uses organic dye subject to rotting. Use either something like M-DISC or normal BD-R discs (HTL, with an anorganic phase-change recording layer).

I also suggest using at least dvdisaster (I suggest it's RS03 codec in augumented-image mode) or equivalent (if you come across a proper competitor to dvdisaster RS03, please let me know).

I've heard about the rotting, we've got a plan in about a year or two to do a key ceremony to move stuff onto more permanent hardware we can retain for at least 20 years (our roots last 15)

What that hardware will be is still an open question, but probably BD-R HTL.

Also worth noting (I think it's in the script too from memory) we make at least 3 identical copies of each CD in case of CD failure.

Yeah, from my understanding the rot is literally a fungus/bacteria colony that eats the dye. If you store the 3 copies separately in sealed containers, regular (no worse than yearly) inspections should probably suffice. The damage is visible; if anything looks off, put it back and immediately organize preemptive data rescue. This can be obvious discoloration (likely with a gradient) or discrete specs, the latter can also happen to BD-R HTL where they are "just" delamination. That is thankfully a fairly slow progressive effect from AFAIK the acrylic glue slowly hydrolyzing, and can be counteracted by cold constant-temperature constant-low-humidity storage (an office cabinet with AC is better than a finished basement w/o AC).

Reply on news.ycombinator.com