Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Air gaps never exist (2011)

gse-compliance.blogspot.com

Post reply on HN
Print view View original

31–40 of 53 posts

Re: Air gaps never exist (2011)

#31

Post by specialist »

cba9 wrote: post #18
alkonaut wrote: post #15

I thought "air gap" meant a machine or network that is physically separated (these days also without any radio connection) to other machines. How can those not exist?

Perhaps you should read the submission. The larger point here is that even if you set up a network in the first place which is genuinely airgapped, as time passes and systems evolve there will be constant pressure from within and without to re-establish a network connection somewhere in order to make everyone's lives easier and eventually, whether deliberate or inadvertent, a connection will be made (and of course, w…

as time passes and systems evolve there will be constant pressure from within and without to re-establish a network connection somewhere

Thank you.

Proponents of electronic voting and tabulation (eg central count of physical ballots) enthuse about security, air-gapping, data diodes, etc.

Alas, it's turtles all the way down. Dig deep enough and you'll expose the fiction.

Then you're in the trap of explaining technology to policy makers, testifying against trained bureaucrats supported by an army of vendor sales minions defending their cheddar.

You can't win.

It's nutty making.

Re: Air gaps never exist (2011)

#32

Post by [deleted] »

munin wrote: post #24
andreyf wrote: post #23

Earlier quoted context omitted.

from the link: "SIPRNet and NIPRNet are referred to colloquially as sipper-net and nipper-net (or simply sipper and nipper), respectively"

when you pronounce them, sure, but why capitalize them like an acronym, but mis-spell the acronym?

[deleted]

Re: Air gaps never exist (2011)

#33

Post by _wldu »

Air gaps can also be bridged by using radio or sound waves. There could be a bunch on non-networked computers in a secure lab all talking to each other. This assumes trojaned hardware and/or operating system software in the systems that can send and receive data and commands.

Finally, technology such as Morse Code is still useful in these scenarios. Dits and dahs. Zeros and ones. That's all you need to be able to send and recv data.

http://www.jocm.us/index.php?m=content&c=index&a=show&catid=...

http://www.wired.com/wp-content/uploads/2014/11/air-hopper-m...

Re: Air gaps never exist (2011)

#34

Post by Nadya »

msm23 wrote: post #27
Nadya wrote: post #16

Earlier quoted context omitted.

Well he was an expert.. wasn't he? https://www.youtube.com/watch?v=BKorP55Aqvg (Draw seven perpendicular red lines)

Never thought I'd see it, but here's the solution to the expert problem: https://www.youtube.com/watch?v=B7MIJP90biM Credit to D. Scott Williamson, Expert

My personal favorite solution: http://i.imgur.com/fdHpJS4.png

Re: Air gaps never exist (2011)

#35

Post by wallaceowen21 »

Back in the early days of Ethernet there were fiber to AUI widgets, that used 2 multimode fibers, one for TX, one for RX. We used these on classified systems with ony RX connected - we could send data in to these systems over UDP, and it was truly a one-way path.

Re: Air gaps never exist (2011)

#36

Post by jrochkind1 »

pwg wrote: post #30
jis wrote: post #13

Earlier quoted context omitted.

Years ago I was told by a colleague that he was required to setup an administrative system that was NOT connected the network, but also had to be able to send and receive e-mail. The inherent contradiction was lost on the people giving the orders. So...

UUCP delivered email (and Usenet and file transfers) for a very long time before full time network connections became the norm. https://en.wikipedia.org/wiki/UUCP So, it is possible to send/receive email without an always on network connection.

Heck, you could even do it with a never-on network connection, if someone wants to periodically ferry the ingoing/outgoing email over on a drive.

That probably isn't what the requirements makers had in mind though.

Re: Air gaps never exist (2011)

#37

Post by vacri »

jib wrote: post #25
Nadya wrote: post #16

Earlier quoted context omitted.

Well he was an expert.. wasn't he? https://www.youtube.com/watch?v=BKorP55Aqvg (Draw seven perpendicular red lines)

That sketch annoys me. Sure, marketing/sales/PM/design guys are idiots, whatever. Here are 11 things "I can't do it" can mean: I don't have time I don't want to I don't have anyone who knows how to I want someone else to do it I don't want to maintain it once built I want to work on this other thing Doing it would take away job security for me I think it is beneath me You're not going to use it anyway I don't think i…

Half of those are perfectly valid responses. "I don't have time" or "I don't know anyone who knows how" or "it is too expensive" - these aren't the passive-aggressive responses that you're implying.

Re: Air gaps never exist (2011)

#38

Post by Nadya »

jib wrote: post #25
Nadya wrote: post #16

Earlier quoted context omitted.

Well he was an expert.. wasn't he? https://www.youtube.com/watch?v=BKorP55Aqvg (Draw seven perpendicular red lines)

That sketch annoys me. Sure, marketing/sales/PM/design guys are idiots, whatever. Here are 11 things "I can't do it" can mean: I don't have time I don't want to I don't have anyone who knows how to I want someone else to do it I don't want to maintain it once built I want to work on this other thing Doing it would take away job security for me I think it is beneath me You're not going to use it anyway I don't think i…

>I think it would be easyish to fill out another 10 reasons for what "can't" really means that are more common than "it is flat out impossible regardless of budget/resources".

Yes. But the skit isn't about that.

I often get impossible tasks from managers. Luckily when I tell them why they actually listen and aren't purposefully obtuse like the team from the skit. But the obtuse manner of the meeting is part of the comedy. Sometimes the management/sales/marketing team just doesn't get it.

The most common request?

"Please enhance this 92x92 .jpg logo x5-x10 its current size without lowering the quality of the logo."

My most common pushback?

"Sure. Get with their designer and get me the original file, be it .psd or .ai so that I can work with a larger resolution copy of the image. If they don't have the original file for their logo, you are asking for one of two things: 1) Recreate their logo or 2) The impossible. If (1) my answer is no. If (2) my answer is with modern technology, I can't."

I've also been asked to uncrop photos. Not as in "restore a backup from before we saved over it with a cropped version" but literally uncrop a photo.

I don't necessarily blame these people or get angry with them. I blame CSI and other investigative shows where they "enhance" a blurry photo to 4k crystal-clear resolution and read the reflection off of a button of a guys' jeans to read the licence plate of his car. They've been told this shit is possible by TV shows that use just-enough real tech to make the fake tech seem real to people outside of the loop.

Re: Air gaps never exist (2011)

#39

Post by mikeash »

jrochkind1 wrote: post #36
pwg wrote: post #30

Earlier quoted context omitted.

UUCP delivered email (and Usenet and file transfers) for a very long time before full time network connections became the norm. https://en.wikipedia.org/wiki/UUCP So, it is possible to send/receive email without an always on network connection.

Heck, you could even do it with a never-on network connection, if someone wants to periodically ferry the ingoing/outgoing email over on a drive. That probably isn't what the requirements makers had in mind though.

I can see it now. You spend a month implementing a fancy, modern store-and-forward system that ticks all the boxes and provides an excellent blend of security and functionality. Then you get called into the big shot's office because he wants emails to go through in under ten seconds.

Re: Air gaps never exist (2011)

#40

Post by cba9 »

vonmoltke wrote: post #28
cba9 wrote: post #18

Earlier quoted context omitted.

Perhaps you should read the submission. The larger point here is that even if you set up a network in the first place which is genuinely airgapped, as time passes and systems evolve there will be constant pressure from within and without to re-establish a network connection somewhere in order to make everyone's lives easier and eventually, whether deliberate or inadvertent, a connection will be made (and of course, w…

> Perhaps you should read the submission. The larger point here is that even if you set up a network in the first place which is genuinely airgapped, as time passes and systems evolve there will be constant pressure from within and without to re-establish a network connection somewhere in order to make everyone's lives easier and eventually, whether deliberate or inadvertent, a connection will be made (and of course,…

> The article is not well written, and I personally had to parse it several times to figure out what he was trying to say. I'm still not even sure if this is the correct interpretation.

I thought it was perfectly clear. He was telling a funny story about how systems and technologies evolve, giving two examples of that (latter, the watch, former, the system's airgap springing a leak), and furnishing an object lesson in the need for regular thorough audits to ensure that systems and controls thereof are still in place and still working the way that the owners think it's working.

> A facility like the one he described should have had regular security audits to verify that no hard lines were placed where they should not be.

Exactly. In fact, I believe at the time he wrote this blog post, OP was an active auditor for BDO. In some of his other posts, he analyzes observations he made while auditing a variety of companies/organizations; unsurprisingly standards across the board are very poor. He would be the first to say that this sort of thing is what an audit should prevent and why audits are needed (although I'm not sure I agree with his venom against pentesting; which I see analogous to fuzzing).

Post reply on HN