Live data from Hacker News

Air gaps never exist (2011)

gse-compliance.blogspot.com

41–50 of 53 posts

Re: Air gaps never exist (2011)

#41
post #11

Doesn't "air gapped" imply physical separation? Putting a firewall, even if it's totally locked down, between two networks does not make it "air gapped".

You can get physical separation with WAPs, too...

Technically that's not physically separate, as photons are physical entities.

Re: Air gaps never exist (2011)

#42
post #38
post #25

Earlier quoted context omitted.

That sketch annoys me. Sure, marketing/sales/PM/design guys are idiots, whatever. Here are 11 things "I can't do it" can mean: I don't have time I don't want to I don't have anyone who knows how to I want someone else to do it I don't want to maintain it once built I want to work on this other thing Doing it would take away job security for me I think it is beneath me You're not going to use it anyway I don't think i…

>I think it would be easyish to fill out another 10 reasons for what "can't" really means that are more common than "it is flat out impossible regardless of budget/resources". Yes. But the skit isn't about that. I often get impossible tasks from managers. Luckily when I tell them why they actually listen and aren't purposefully obtuse like the team from the skit. But the obtuse manner of the meeting is part of the co…

The crazy thing is that the fake tech is also often actually real, but real in the sense that there's a recent academic paper where in certain specific conditions they were able to do what is being asked ask by using lots of math, domain knowledge, and custom programming, at a total cost of hundreds of thousands to millions of dollars when it's all done.

Does that help you in any way in a commercial setting? No, unless you are Google or Apple or the like and it's not a simple request but the basis of a new business division.

Re: Air gaps never exist (2011)

#43
post #37
post #25

Earlier quoted context omitted.

That sketch annoys me. Sure, marketing/sales/PM/design guys are idiots, whatever. Here are 11 things "I can't do it" can mean: I don't have time I don't want to I don't have anyone who knows how to I want someone else to do it I don't want to maintain it once built I want to work on this other thing Doing it would take away job security for me I think it is beneath me You're not going to use it anyway I don't think i…

Half of those are perfectly valid responses. "I don't have time" or "I don't know anyone who knows how" or "it is too expensive" - these aren't the passive-aggressive responses that you're implying.

Those aren't the responses, otherwise it would be fine, you would be accurately communicating the actual problem. Instead, those are the underlying reason for just saying "I can't do it" instead of being forthcoming.

Re: Air gaps never exist (2011)

#44

That's why you commit to multiple layers and types of defensive and recovery measures. Intelligence, preparation, prevention, prevention, prevention, monitoring, adaptation, more monitoring, effective response, well planned recovery.

I'm pretty sure you missed another 2-3 prevention layers. Shit's pretty dire after you're past that layer.

Re: Air gaps never exist (2011)

#45
post #38
post #25

Earlier quoted context omitted.

That sketch annoys me. Sure, marketing/sales/PM/design guys are idiots, whatever. Here are 11 things "I can't do it" can mean: I don't have time I don't want to I don't have anyone who knows how to I want someone else to do it I don't want to maintain it once built I want to work on this other thing Doing it would take away job security for me I think it is beneath me You're not going to use it anyway I don't think i…

>I think it would be easyish to fill out another 10 reasons for what "can't" really means that are more common than "it is flat out impossible regardless of budget/resources". Yes. But the skit isn't about that. I often get impossible tasks from managers. Luckily when I tell them why they actually listen and aren't purposefully obtuse like the team from the skit. But the obtuse manner of the meeting is part of the co…

> I don't necessarily blame these people or get angry with them. I blame CSI and other investigative shows where they "enhance" a blurry photo to 4k crystal-clear resolution and read the reflection off of a button of a guys' jeans to read the licence plate of his car.

I wouldn't get angry with them, but I would certainly blame them for thinking something is possible which a small child should be able to tell is not. I would advise you avoid working with people who believe computers are literally magic, as your life will be much better.

Re: Air gaps never exist (2011)

#46
post #42
post #38

Earlier quoted context omitted.

>I think it would be easyish to fill out another 10 reasons for what "can't" really means that are more common than "it is flat out impossible regardless of budget/resources". Yes. But the skit isn't about that. I often get impossible tasks from managers. Luckily when I tell them why they actually listen and aren't purposefully obtuse like the team from the skit. But the obtuse manner of the meeting is part of the co…

The crazy thing is that the fake tech is also often actually real , but real in the sense that there's a recent academic paper where in certain specific conditions they were able to do what is being asked ask by using lots of math, domain knowledge, and custom programming, at a total cost of hundreds of thousands to millions of dollars when it's all done. Does that help you in any way in a commercial setting? No, unl…

Are you talking about the paper where they replicate keys from the roof of a building across the street when the keys were on the floor some several hundred feet away from a photograph? :)

Re: Air gaps never exist (2011)

#47
post #45
post #38

Earlier quoted context omitted.

>I think it would be easyish to fill out another 10 reasons for what "can't" really means that are more common than "it is flat out impossible regardless of budget/resources". Yes. But the skit isn't about that. I often get impossible tasks from managers. Luckily when I tell them why they actually listen and aren't purposefully obtuse like the team from the skit. But the obtuse manner of the meeting is part of the co…

> I don't necessarily blame these people or get angry with them. I blame CSI and other investigative shows where they "enhance" a blurry photo to 4k crystal-clear resolution and read the reflection off of a button of a guys' jeans to read the licence plate of his car. I wouldn't get angry with them, but I would certainly blame them for thinking something is possible which a small child should be able to tell is not.…

>I wouldn't get angry with them, but I would certainly blame them for thinking something is possible which a small child should be able to tell is not.

Your domain experience is showing. ;) A small child doubtfully knows what pixels are, how computers represent data, how an image is actually displayed, and why you can make them smaller with minimal (meaningful) data loss but you cannot make them larger.

That part confuses lots of people. From children to adults to my grandparents.

Also photo restoration is black magic to some people - and a joy to my heart when I get the opportunity to restore a photo for someone.

Re: Air gaps never exist (2011)

#48

Earlier quoted context omitted.

if the requirement is just email, seems like it would be quite feasible to set something up so that the MTA on the administrative system tunnels the email to the MTA of something network-connected in a non-tcp/ip kind of way (PTP microwave/laser link, printer-carrier pigeon-scanner combo, ...) that just passes the message over while remaining air-gapped

Oh neat... so i just have to own the system by sending a bad attachment (containing the malware), and having exfiltration happen via mail attachments. Got it.

I've seen actual near-airgapped systems that communicate by fax as risk reduction. Email-to-fax gateways rendered attachments and such in the DMZ, then dialed into the secure side, the theory being that owning a T1 fax card over the PSTN is much harder than sending a malicious email.

Re: Air gaps never exist (2011)

#49
post #47
post #45

Earlier quoted context omitted.

> I don't necessarily blame these people or get angry with them. I blame CSI and other investigative shows where they "enhance" a blurry photo to 4k crystal-clear resolution and read the reflection off of a button of a guys' jeans to read the licence plate of his car. I wouldn't get angry with them, but I would certainly blame them for thinking something is possible which a small child should be able to tell is not.…

>I wouldn't get angry with them, but I would certainly blame them for thinking something is possible which a small child should be able to tell is not. Your domain experience is showing. ;) A small child doubtfully knows what pixels are, how computers represent data, how an image is actually displayed, and why you can make them smaller with minimal (meaningful) data loss but you cannot make them larger . That part co…

Nah. I'm pretty sure I could have figured out that zooming in makes things fuzzy, just like if you hold it close to your face it doesn't any detail to a photo, at age 7 or so.

Photo restoration is more art than magic, assuming you're more or less drawing in the missing pieces.

Re: Air gaps never exist (2011)

#50
post #18

I thought "air gap" meant a machine or network that is physically separated (these days also without any radio connection) to other machines. How can those not exist?

Perhaps you should read the submission. The larger point here is that even if you set up a network in the first place which is genuinely airgapped, as time passes and systems evolve there will be constant pressure from within and without to re-establish a network connection somewhere in order to make everyone's lives easier and eventually, whether deliberate or inadvertent, a connection will be made (and of course, w…

I tried parsing it several times but from what I understood, they established an Internet connection out from the air gapped network, without coming into the facility with a big reel of network cable. So it seemed the network wasn't physically disconnected after all?

An air gapped computer is pretty easy to create -- just disable the radios and don't connect any network cables to it.

A network would be much harder but the key has to be that there are no other non-air gapped machines in the same facility. If someone wants to bridge the gap it should be obvious by the cable coming in the door and running all the way up to the machine.

Obviously the kind of air-gapped networks I'm talking about are computers never involved in any internet business at all, the kind that operate power plants (or centrifuges...).

Post reply on HN