Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Adventures of AV and the Leaky Sandbox [pdf]

blackhat.com

Post reply on HN
Print view View original

1–10 of 20 posts

Re: The Adventures of AV and the Leaky Sandbox [pdf]

#4

Post by ech »

that is not what an air gap is. if at any time there is an exchange of data between the air gapped hosts/network and a non air gapped one, there is no air gap anymore. and yes, that includes an analyst taking a sample to an internet-connected host.

side channel exfiltration techniques like "fansmitter"[1] and "diskfiltration"[2] or the well known TEMPEST attacks are more interesting challenges in air gapped designs than relying on a very basic security boundary violation. (and solved in very much the same way, by having the secure terminals be as dumb as bricks as possible, with extremely limited known inputs and outputs, preventing the insertion of unclassified electronics in the secure zone through policy, and enforcing it through physical searches, RF hardening the zone with a faraday cage, absence of windows, etc... the "Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities"[3] is a great ressource for those interested in such designs)

incidentally, there are awfully little true air gapped networks (which are not ICSes and/or assorted single purpose hosts/networks whose absence of network connectivity is not a primary design feature) in the wild. they're operationally heavy precisely because of their nature, and outside of very specific situations, their security is not perceived as cost efficient by management, for good reasons.

[1]https://arxiv.org/abs/1606.05915 [2]https://arxiv.org/abs/1608.03431 [3]https://fas.org/irp/dni/icd/ics-705-ts.pdf

Re: The Adventures of AV and the Leaky Sandbox [pdf]

#5

Post by vinceguidry »

ech wrote: post #4

that is not what an air gap is. if at any time there is an exchange of data between the air gapped hosts/network and a non air gapped one, there is no air gap anymore. and yes, that includes an analyst taking a sample to an internet-connected host. side channel exfiltration techniques like "fansmitter"[1] and "diskfiltration"[2] or the well known TEMPEST attacks are more interesting challenges in air gapped designs t…

The paper never once uses the term "air gap." It's only in the headline as submitted to HN.

Re: The Adventures of AV and the Leaky Sandbox [pdf]

#6

Post by ech »

vinceguidry wrote: post #5
ech wrote: post #4

that is not what an air gap is. if at any time there is an exchange of data between the air gapped hosts/network and a non air gapped one, there is no air gap anymore. and yes, that includes an analyst taking a sample to an internet-connected host. side channel exfiltration techniques like "fansmitter"[1] and "diskfiltration"[2] or the well known TEMPEST attacks are more interesting challenges in air gapped designs t…

The paper never once uses the term "air gap." It's only in the headline as submitted to HN.

it has been submitted as such on both HN and reddit. i think it is reasonable to clear any misunderstanding.

Re: The Adventures of AV and the Leaky Sandbox [pdf]

#7

Post by Eridrus »

ech wrote: post #4

that is not what an air gap is. if at any time there is an exchange of data between the air gapped hosts/network and a non air gapped one, there is no air gap anymore. and yes, that includes an analyst taking a sample to an internet-connected host. side channel exfiltration techniques like "fansmitter"[1] and "diskfiltration"[2] or the well known TEMPEST attacks are more interesting challenges in air gapped designs t…

I think looking at operational issue with air gaps is much more interesting than TEMPEST attacks which require physical proximity to execute. If someone has gone to the trouble of air gapping their network, they almost certainly have physical security.

Re: The Adventures of AV and the Leaky Sandbox [pdf]

#9

Post by ech »

Eridrus wrote: post #7
ech wrote: post #4

that is not what an air gap is. if at any time there is an exchange of data between the air gapped hosts/network and a non air gapped one, there is no air gap anymore. and yes, that includes an analyst taking a sample to an internet-connected host. side channel exfiltration techniques like "fansmitter"[1] and "diskfiltration"[2] or the well known TEMPEST attacks are more interesting challenges in air gapped designs t…

I think looking at operational issue with air gaps is much more interesting than TEMPEST attacks which require physical proximity to execute. If someone has gone to the trouble of air gapping their network, they almost certainly have physical security.

you'd be surprised. when specifications get passed around in the endless maze of defense affiliated sub contractors and sub sub contractors, they may be implemented in all kind of creative ways. and i entirely agree that the operational issues of enforcing the air gap are by far the most challenging cost in this kind of environment. the culture of business environments is by and large ill suited to the kind of strict enforcement these environment require.

if RF leaks are part of your threat model, then i would definitely not class them as "proximity attacks". without adequate shielding, antenna black magic and a rented apartment on the other side of the street work perfectly well to capture signals of interest.

Post reply on HN