All United Flights Grounded Due to Mysterious Problem • Hacker News Board

Re: All United Flights Grounded Due to Mysterious Problem

#11

Post by toomuchtodo » Tue, Jun 02, 2015, 4:25 PM UTC

minot wrote: post #9

rubicon33 wrote: post #4

Earlier quoted context omitted.

What does "air gapped" mean?

> An air gap or air wall is a network security measure that consists of ensuring that a secure computer network is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network. It is often taken for computers and networks that must be extraordinarily secure. Frequently the air gap is not completely literal, such as via the use of dedicated cryptographic devices that can…

You can also accomplish a one-way airgap using optics that can only pass data in one direction.

Re: All United Flights Grounded Due to Mysterious Problem

#12

Post by schneidmaster » Tue, Jun 02, 2015, 4:25 PM UTC

rubicon33 wrote: post #4

arca_vorago wrote: post #3

From what I understand of the Chris Roberts fiasco, their avionics systems weren't airgapped from the other systems. If that is the case and not just hype, then no fucking wonder shit like this can happen.

What does "air gapped" mean?

Completely disconnected. It refers to the physical metaphor of having a gap of air (no wired connections) between critical systems (like the flight software) and other systems (like the entertainment system), although it's sometimes implemented via software means such as cryptographic tunneling rather than a physical gap.

Re: All United Flights Grounded Due to Mysterious Problem

#13

Post by josephmosby » Tue, Jun 02, 2015, 4:25 PM UTC

rubicon33 wrote: post #4

arca_vorago wrote: post #3

From what I understand of the Chris Roberts fiasco, their avionics systems weren't airgapped from the other systems. If that is the case and not just hype, then no fucking wonder shit like this can happen.

What does "air gapped" mean?

"Air gapped" means that there is a physical separation between two networks (i.e., there's "air" between them). If two networks are physically connected, there is always a chance that someone could bypass any software security restrictions. If the two networks aren't physically connected, there's no way to gain access to one network from another.

In this instance, the inflight entertainment network and the avionics network were physically connected, and the security researcher was able to gain access to the avionics network by connecting to the inflight entertainment network.

Re: All United Flights Grounded Due to Mysterious Problem

#14

Post by saganus » Tue, Jun 02, 2015, 4:30 PM UTC

toomuchtodo wrote: post #11

minot wrote: post #9

Earlier quoted context omitted.

> An air gap or air wall is a network security measure that consists of ensuring that a secure computer network is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network. It is often taken for computers and networks that must be extraordinarily secure. Frequently the air gap is not completely literal, such as via the use of dedicated cryptographic devices that can…

You can also accomplish a one-way airgap using optics that can only pass data in one direction.

Can you elaborate a bit more please?

This sounds almost as if you configured a network adapter to only send and not receive, but you used "optics", so I'm guessing you refer to some sort of fibre-based device that actually impedes light to go in the other direction, and thus the security is via physical means?

Re: All United Flights Grounded Due to Mysterious Problem

#15

Post by atonse » Tue, Jun 02, 2015, 4:33 PM UTC

toomuchtodo wrote: post #11

minot wrote: post #9

Earlier quoted context omitted.

> An air gap or air wall is a network security measure that consists of ensuring that a secure computer network is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network. It is often taken for computers and networks that must be extraordinarily secure. Frequently the air gap is not completely literal, such as via the use of dedicated cryptographic devices that can…

You can also accomplish a one-way airgap using optics that can only pass data in one direction.

How can that ever work? If you're using TCP/IP, you always need to receive an acknowledgement that what you sent actually got to the destination, right?

Or does raw fiber use different protocols?

Re: All United Flights Grounded Due to Mysterious Problem

#16

Post by karambahh » Tue, Jun 02, 2015, 4:34 PM UTC

toomuchtodo wrote: post #11

minot wrote: post #9

Earlier quoted context omitted.

> An air gap or air wall is a network security measure that consists of ensuring that a secure computer network is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network. It is often taken for computers and networks that must be extraordinarily secure. Frequently the air gap is not completely literal, such as via the use of dedicated cryptographic devices that can…

You can also accomplish a one-way airgap using optics that can only pass data in one direction.

I was at a security trade show earlier this year and some companies were marketing "FTP diode": one way FTP transfert.

I did not have time to discuss it with them, but how a tcp based protocol could be "one way" just does not make sense to me...

Re: All United Flights Grounded Due to Mysterious Problem

#17

Post by toomuchtodo » Tue, Jun 02, 2015, 4:36 PM UTC

saganus wrote: post #14

toomuchtodo wrote: post #11

Earlier quoted context omitted.

You can also accomplish a one-way airgap using optics that can only pass data in one direction.

Can you elaborate a bit more please? This sounds almost as if you configured a network adapter to only send and not receive, but you used "optics", so I'm guessing you refer to some sort of fibre-based device that actually impedes light to go in the other direction, and thus the security is via physical means?

> so I'm guessing you refer to some sort of fibre-based device that actually impedes light to go in the other direction, and thus the security is via physical means?

Correct. To simplify, imagine a diode on one side and a photodetector cell on the other. On a microcontroller, this would be an opto-isolator (http://en.wikipedia.org/wiki/Opto-isolator).

Of course, the higher levels of the OSI protocol you're using need to support this sort of physical layer. Its typically used on very primitive, low-bitrate connections (sensors mostly, although I've seen it used in highly sensitive installations using scada equipment).

Bruce Schneier has a great piece on air gaps. I've included a link to it below.

https://www.schneier.com/blog/archives/2013/10/air_gaps.html

Re: All United Flights Grounded Due to Mysterious Problem

#18

Post by [deleted] » Tue, Jun 02, 2015, 4:37 PM UTC

atonse wrote: post #15

toomuchtodo wrote: post #11

Earlier quoted context omitted.

You can also accomplish a one-way airgap using optics that can only pass data in one direction.

How can that ever work? If you're using TCP/IP, you always need to receive an acknowledgement that what you sent actually got to the destination, right? Or does raw fiber use different protocols?

[deleted]

Re: All United Flights Grounded Due to Mysterious Problem

#19

Post by jonah » Tue, Jun 02, 2015, 4:38 PM UTC

atonse wrote: post #15

toomuchtodo wrote: post #11

Earlier quoted context omitted.

You can also accomplish a one-way airgap using optics that can only pass data in one direction.

How can that ever work? If you're using TCP/IP, you always need to receive an acknowledgement that what you sent actually got to the destination, right? Or does raw fiber use different protocols?

The GP probably means an opto-isolater.

It obviously wouldn't work for carrying something like TCP/IP but rather much lower level signaling.

http://en.m.wikipedia.org/wiki/Opto-isolator

Re: All United Flights Grounded Due to Mysterious Problem

#20

Post by kbenson » Tue, Jun 02, 2015, 4:40 PM UTC

karambahh wrote: post #16

toomuchtodo wrote: post #11

Earlier quoted context omitted.

You can also accomplish a one-way airgap using optics that can only pass data in one direction.

I was at a security trade show earlier this year and some companies were marketing "FTP diode": one way FTP transfert. I did not have time to discuss it with them, but how a tcp based protocol could be "one way" just does not make sense to me...

Maybe it's a variation of TFTP (which uses UDP) that doesn't ack the connection or the file? That would be rather amusing, broken TFTP sold as a security app.