Everyone commenting about the strict definition is a very smart boy. Good job and gold stars all around for the productive conversation! You're solving the real problems of our times here.
Creating a bespoke data diode for air‑gapped networks
61–70 of 86 posts
Re: Creating a bespoke data diode for air‑gapped networks
#62A "diode" is not an air gap. If there is any flow in either direction, you don't have an air gap. This isn't hard to understand.
There's only a couple of cases where this can go wrong. Either the contents of what is being sent out could be wrong, or the hardware itself could be tampered with to extract extra information on another optical or radio channel. Both of these require extensive software tampering. In the simple case where you trust the software on both sides, and the hardware, this can be practically as good as it gets (with the requirement that the inside be monitored automatically somehow).
Re: Creating a bespoke data diode for air‑gapped networks
#63Earlier quoted context omitted.
Prepare to give up I'd say[1][2]. [1]: https://arxiv.org/abs/1503.07919 [2]: https://arxiv.org/abs/2012.06884
both of these require the isolated machine to be heavily compromised to begin with. there are a lot of such extremely hypothetical attacks no one should take seriously. you might as well worry about sensitive data being exfiltrated from your unshielded optical nerve,
Eavesdropping on stray RF signals is not so theoretical though. It's been done by NSA and no doubt others. We also need to worry about hardware supply chains including random compromised stuff that "accidentally" leaks or exposes backdoors.
Re: Creating a bespoke data diode for air‑gapped networks
#64I'm assuming you don't have any audit requirements for this application. The stupid pricing for hardware often isn't in the hardware, it's in the compliance.
Here it might fail. If you were sufficiently motivated and controlled the software stacks on the rpi's you may be able to get data to flow in the other direction. LEDs have their voltage modulated by light. And it's possible that is the voltage on the transistor if properly modulated it may able to emit light. It's a lot of ifs and requires the adc of the rpi to be sensitive enough (and one of the pinmux options). Bu…
I reckon it is also possible to set up a second channel covertly at a higher frequency. It may also have surprising flaws. People have read network packets from router indicator LEDs lol.
Re: Creating a bespoke data diode for air‑gapped networks
#65> An opto coupler, also known as an opto isolator, allows an electrical signal to pass from one device to another using light, preventing direct electrical connection. *This ensures data flows in a single direction, maintaining the integrity of the air gap.* I would like to know how they come to such a conclusion as this is either a misunderstanding or an AI solution. The opto isolator does not maintain the air gap.…
I don't understand your point. Isn't the galvanic isolation implemented in the optoisolator by an air gap between the light transmitter and receiver? Maybe I don't know the definition of air gap?
The point is you don't need the opto isolator at all.
Re: Creating a bespoke data diode for air‑gapped networks
#66A "diode" is not an air gap. If there is any flow in either direction, you don't have an air gap. This isn't hard to understand.
I don’t see what diving into pointless semantics adds to the discussion here.
Because a company advertising security solutions who misunderstands basic terminology is highly suspect.
Re: Creating a bespoke data diode for air‑gapped networks
#67Unless you needed Ethernet, you could have done the same thing with a null modem RS-232 cable with the TX pin cut on one end.
How confident are you that a compromised receiving machine able to send arbitrary voltages on 8 of the 9 pins wouldn't be able to trigger some unexpected behavior on the airgapped machine?
What voltages would these be? If the receiver and transmitter are both the same as in the article then I don't see how this is an issue.
Re: Creating a bespoke data diode for air‑gapped networks
#68Earlier quoted context omitted.
I don't understand your point. Isn't the galvanic isolation implemented in the optoisolator by an air gap between the light transmitter and receiver? Maybe I don't know the definition of air gap?
The point is you don't need the opto isolator at all.
That's a separate point. Are you agreeing that if an air gap was needed an optoisolator would be suitable?
Re: Creating a bespoke data diode for air‑gapped networks
#69Earlier quoted context omitted.
both of these require the isolated machine to be heavily compromised to begin with. there are a lot of such extremely hypothetical attacks no one should take seriously. you might as well worry about sensitive data being exfiltrated from your unshielded optical nerve,
Eavesdropping on stray RF signals is not so theoretical though. It's been done by NSA and no doubt others. We also need to worry about hardware supply chains including random compromised stuff that "accidentally" leaks or exposes backdoors.
In many industrial applications, the concern is mostly control of the isolated side, like because that could physically destroy stuff. Exfiltration is a smaller or nonexistent concern, since you're already sending most data out deliberately.
So there's still an attack surface, but it's a lot smaller. Any side channel exploit would need to work (at least in some initial form) without changes to the software on the isolated side, since you otherwise can't bootstrap your way to installing it.
Re: Creating a bespoke data diode for air‑gapped networks
#70There are reasons that the US Government is super serious about certifying data diodes and cross domain solutions because you need to be absolutely sure what you are doing doesn’t accidentally leak data where it doesn’t need to go.
Real data diode and cross domain solutions are super expensive for this reason.