Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What the CIA WikiLeaks Dump Tells Us: Encryption Works

nytimes.com

Post reply on HN
Print view View original

81–90 of 270 posts

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#81

Post by danbruc »

andai wrote: post #75
imaginenore wrote: post #72

Earlier quoted context omitted.

If it's airgapped, how do you use it for communication?

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

Have you considered light instead of sound, a simple optical link either through air or fiber?

And it can be exploited in the same way it happens on any computer, somewhere in the path from reading the input through processing the message to sending the response is a bug and a specifically crafted sequence of inputs causes unintended things to happen, possibly allowing an attacker to execute arbitrary code.

However, if you specifically build a very simple interface and application, then you can keep the attack surface small as compared to your average computer. There will be no programmable NIC, no hardware driver, no TCP/IP stack, and probably only a single application processing messages and using the interface.

But this of course also depends heavily on the implementation. Controlling the GPIO pins of a Raspberry Pi with a Python application build on top of a Python library, Python, a GPIO driver and Linux provides quite a bit of attack surface. If you use a microcontroller and a hand full lines of assembly to poll input and drive output pins, then the attack surface becomes really small.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#82

Post by mmcwilliams »

andai wrote: post #75
imaginenore wrote: post #72

Earlier quoted context omitted.

If it's airgapped, how do you use it for communication?

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

I think that what imaginenore is suggesting is that if you are communicating between your public network-connected machine and your air gapped machine, there is no longer an air gap (barring some very specific use cases). The technique you're describing is actually an attack used to defeat security of machines not on untrusted networks[0].

[0] https://en.wikipedia.org/wiki/Air_gap_malware

EDIT: This is specifically the method I was thinking of: http://www.jocm.us/index.php?m=content&c=index&a=show&catid=...

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#83

Post by andyjohnson0 »

andai wrote: post #75
imaginenore wrote: post #72

Earlier quoted context omitted.

If it's airgapped, how do you use it for communication?

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

Peer-to-peer IrLAN [1] is less prone to interference then sound, and being directional is harder to attack if the air-gap is small. Nowadays its probably obscure enough to make creating an exploit prohibitively expensive, even more so if you write your own drivers. With some electronics knowledge you could probably build your own simple transceivers too.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#84

Post by kevincox »

andai wrote: post #75
imaginenore wrote: post #72

Earlier quoted context omitted.

If it's airgapped, how do you use it for communication?

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

Airgapped means it has no communication.

But yes, in practice it is often useful to move data to and from. In a "perfect" airgap this would probably be you typing and reading the screen. However this isn't the most convient but the more things automatically accessing it the less security you will have.

If you are going to connect it I won't bother maknig your own system and just use something standard (like ethernet) but now you have a firewalled system then an airgapped one.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#85

Post by Certhas »

dromenkoning wrote: post #6

The article mentions WhatsApp multiple times as a service that successfully made the transition to end-to-end encryption, but it always seemed to me that this claim is rather meaningless when we don't have the possibility of auditing their source code.

Why do you think it is completely meaningless?

I agree that it's weakened but I think it's still meaningful. If someone is choosing between WhatsApp and Allo the former is more likely to be properly encrypted.

After all, even though we can't verify it WhatsApp has strong incentives to implement it properly, and OWS has strong incentives to only endorse WhatsApps use of their protocol if they are convinced that it's done properly.

I really think "completely meaningless" is dangerously misleading hyperbole.

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#86

Post by andai »

kevincox wrote: post #84
andai wrote: post #75

Earlier quoted context omitted.

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

Airgapped means it has no communication. But yes, in practice it is often useful to move data to and from. In a "perfect" airgap this would probably be you typing and reading the screen. However this isn't the most convient but the more things automatically accessing it the less security you will have. If you are going to connect it I won't bother maknig your own system and just use something standard (like ethernet)…

Yes, I also considered using text input, and then something like converting encrypted bytes into english words for ease of input.

But I've noticed that not all my friends are very good at typing, so an automated solution is more user friendly... and a security solution that actually gets used is more secure than one that doesn't :)

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#87

Post by andai »

danbruc wrote: post #81
andai wrote: post #75

Earlier quoted context omitted.

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

Have you considered light instead of sound, a simple optical link either through air or fiber? And it can be exploited in the same way it happens on any computer, somewhere in the path from reading the input through processing the message to sending the response is a bug and a specifically crafted sequence of inputs causes unintended things to happen, possibly allowing an attacker to execute arbitrary code. However,…

Yes indeed! A few years ago I read about a project using infrared "lasers" for a LAN. (Can't find it now since the concept has become quite popular.)

I only wish I was that badass... I can barely do C, let alone asm. I imagine attempting those now would only make the system less secure! haha. I'm just getting started with Arduino. I think I'll keep it simple for now :)

I do plan to learn them (c/asm) some day, then I will be able to make the system even more secure. Thanks for the tips!

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#88

Post by andai »

mmcwilliams wrote: post #82
andai wrote: post #75

Earlier quoted context omitted.

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

I think that what imaginenore is suggesting is that if you are communicating between your public network-connected machine and your air gapped machine, there is no longer an air gap (barring some very specific use cases). The technique you're describing is actually an attack used to defeat security of machines not on untrusted networks[0]. [0] https://en.wikipedia.org/wiki/Air_gap_malware EDIT: This is specifically t…

Ahh.. remember BadBIOS? :) It did need USB flash drives to spread though. (See BadUSB.. and weep!)

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#89

Post by andai »

andyjohnson0 wrote: post #83
andai wrote: post #75

Earlier quoted context omitted.

I'm thinking about giving both machines a little speaker and microphone and using high frequency pulses to transfer the text. (modem) I don't know enough about computer security to understand whether a specially crafted piece of morse code audio (transferred through actual sound waves) could be used as an exploit, but I'm leaning towards "implausible".

Peer-to-peer IrLAN [1] is less prone to interference then sound, and being directional is harder to attack if the air-gap is small. Nowadays its probably obscure enough to make creating an exploit prohibitively expensive, even more so if you write your own drivers. With some electronics knowledge you could probably build your own simple transceivers too.

Yes, I am considering precisely these kinds of solutions! There was an IR LAN project a while back (ten years?) but I can't remember the name (and the concept has skyrocketed in popularity making Googling difficult). Excellent suggestion :)

Re: What the CIA WikiLeaks Dump Tells Us: Encryption Works

#90

Post by bitexploder »

andai wrote: post #67

I don't see any mention of quantum computers in here so I thought I'd mention: the NSA themselves are concerned that quantum computing will be a great threat to encryption in the near future. Keep in mind that the NSA and god knows who else are storing encrypted communications to break them later. Quantum computing will defeat RSA, DH, ECC, asymmetric crypto, but it will only weaken symmetric crypto (eg. AES) by a fa…

Yes. https://en.m.wikipedia.org/wiki/Post-quantum_cryptography

Doubled key size does not mean twice as hard to break. Algorithm weaknesses are a thing.

This WP is pretty accurate though. It describes the world we think will exist after legitimate quantum computing.

Post reply on HN