Hacker News Reader

Comment by Ansil849 | Hacker News Reader

> For our attacker model, we assume that an initial compromise has happened on the target device through the software supply-chain similar to the incidents at SolarWinds [8] and CodeCov [7]. For example, a regular update of the device’s firmware might unnoticeably add the necessary code for sending and receiving data through a built-in LED.

I mean, sure, if you have the ability to compromise the airgapped device by running code on it then you could presumably be doing a lot of things besides just leveraging potential LED line of sight.

View on HN

The air-gap is specifically to prevent exfiltration of data. The air-gapped systems I have worked on had literally zero checking on software added to the system. But all the USB and media ports had super glue in them. An exploit that can't talk to the outside world is not terribly useful in the general case, although it's become lucrative with the rise of ransomware.

Or sabotage, as in Stuxnet.

Or privilege escalation, so that an insider threat can do more damage than otherwise possible.

I don't think "it's airgapped so vulnerabilities don't matter" really holds water.

Stuxnet was reportedly a USB stick delivery, but this could be media speculation.

I am however interested in the low volume high frequency range sound of "static" that appears over speakers _only_ if the volume is turned up to the max in an otherwise silent office. I've had this occur on one Netherlands based website so far in the last few days, but did it come from the Netherlands based website or was it already on my system waiting for activation when visiting websites without any obvious ties back to the US?

If you didnt have your speakers on max in a silent environment, only your mobile phone would pick it up not you (if you have a mobile phone), so is this some sort of malware which can jump from one device to another like a self contained virus of sorts and is it bringing data back to base, a few bytes at a time over time?

Its a clever exploit because most people have their mobile on their desk, and if they dont have speakers some will be listening to music on their headphones so will never be alerted to the communication taking place within smartphone sound frequency ranges.

ts exploiting human behaviour and exploiting the abilities of smart phones, not your usual bit of malware.

I have also noticed Windows with all its security measures on max is able to control the bridging settings for network adaptors in VMware, which can then prevent a WMware version of Kali and wireshark from working properly in promiscuous mode, making it harder to analyse network traffic on a machine.

What's the process for legitimate code updates and the like on that kind of system? Do you take the disk out and write directly to it?

I suspect most airgapped systems aren't updated.

It's been a few years for me. But at the time, write anything you want to bring in to DVD-R (write-once). Including system updates, documentation, open-source libs, etc.

Lots of systems rely on air gaps heavily, and then aren't too worried what the software on the machines is up to. For example, if you are running a nuclear power plant and need a printer, you probably aren't going to be hiring a team of printer firmware developers. You're just going to buy an off-the-shelf non-wifi printer, and use it offline.

> you probably aren't going to be hiring a team of printer firmware developers. You're just going to buy an off-the-shelf non-wifi printer, and use it offline.

In such a scenario, you're also probably never, ever going to be manually updating the printer's firmware.

But there's a reasonable chance someone evil works for the printer company and every printer sold contains this backdoor.

Or the FedEx driver who delivered it to the nuclear plant flashed a modded firmware with the same version number?

How often have you disassembled your printer firmware and given it a decent audit?

> But there's a reasonable chance someone evil works for the printer company and every printer sold contains this backdoor.

If your threat model does legitimately consider this to be a "reasonable chance", then your facility will be printer-free.

Don't forget toner has firmware in it these days ;)

Facts! But seriously, if we're talking about the realistic risks printers pose in most environments, it is not having data exfiltrated via LED signaling or other vanity supply chain injection attacks; the number one risk is by having staff not dispose of sensitive documents properly, whether it's leaving them out on their desk or just chucking them in the bin, or taking them home with them, etcetera.

Vanity attacks with branded names like this "Lasershark" sound sexy and appealing, because they invoke James Bond-style gadgetry and accompanying delusions of grandeur, but real life is decidedly more prosaic: someone is going to discover infinitely more intelligence while expanding exponentially less time and energy by just good old fashioned dumpster diving than by designing and successfully implementing a novel airgap exfiltration methodology.

Agreed, this kind of thing always seems like a post-grad expirement to get grant money from the bureaucratic fear mongers. I had to sit through a symposium on quantum messaging with qubits via encrypted laser transmission. It was literally line-of-sight and required impossibly expensive field equipment....

I don’t think you have a realistic appreciation for what kind of resources are available to interested parties. I would think that the classic “Mossad or not Mossad” threat model might be a good starting point.

Air gapped networks and hardware are interesting to powerful organizations. Don’t underestimate the base for “impossibly expensive”

Counter-example is that this style exploit was actually used in practice to get code off the Apple iPod.

I’m not familiar with this for the iPod, but the Magic Lantern team has dumped firmware from Canon cameras by using an LED as a bit-banged serial interface.

But I don’t know how much of a realistic threat it poses, because in order to control GPIO LEDs the computer already needs to be pwned. Magic Lantern dumped firmware via LED because there wasn’t a known serial link or display driver or anything like that to make it easier.

But it’s a camera, and it’s not designed to be airtight air-gapped. Running arbitrary code is certainly discouraged, but to my knowledge Canon has never fought against consensual hacking of their cameras. (I say “consensual,” because there have been, say, Wi-Fi exploits found and patched, but that’s probably not the way a camera owner would try to get in.)

Anyway, this boils down to the definition of an air gap, because any input/output device is bridging it. A printer was mentioned, of course printing sensitive information is a bridge across the gap. And if the machine has GPIO LEDs then that’s a bridge, too. But what about a hidden camera pointing at the monitor? Frankly the monitor itself is a serious exfiltration risk across the air gap, no?

So as always in security, at some point we have to say “good enough,” and consider it as safe as can be.

The operating part of the network for safety critical installation is shielded from the rest of the network by a physical diode. This printer can receive data but can’t send anything back.

Speaking with respect to non-nuclear builds, this is exactly how the military operates. USS and USNS vessels utilize off the shelf hardware for airgapped systems routinely, though USB device usage is strictly prohibited. In practice however, many unofficial semi-airgapped networks exist Equipment may require specialized software that is not purchased, but licensed and can only be operated by a service technician. The tech brings a preloaded laptop of questionable provenance and initiates a firmware/software update and reboot. Every company is vetted to some degree and employs background investigation, to what effect is hard to determine.

These are the dangerous ones...

Edward Snowdon was recently spied on by cameras installed by a fire extinguisher technician...

Got a link?

Assange, not Snowden, but I guess it could have happened to Snowden too.

https://english.elpais.com/elpais/2020/01/21/inenglish/15796...

Yeah thats about Assange rather than Snowden.

Yes I think that's the story that parent poster was referring to.

Reply on news.ycombinator.com