Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Creating a bespoke data diode for air‑gapped networks

nelop.com

Post reply on HN
Print view View original

71–80 of 86 posts

Re: Creating a bespoke data diode for air‑gapped networks

#71

Post by tripletao »

zephen wrote: post #52

If galvanic isolation is necessary, there are "digital isolators" (that's a good search term if you are interested) that are much faster than optocouplers and that don't suffer from the same sort of degradation (over a few years, the LED gets dimmer and dimmer). But there's probably no galvanic isolation going on here anyway, so a wire, or at most a simple logic buffer, would probably suffice. If I'm connecting two t…

> over a few years, the LED gets dimmer and dimmer

That shouldn't happen unless the LED is driven near the top of its current rating, which shouldn't be necessary unless you're pushing the limits of its rise/fall times (in which case a different part would be advisable as you say).

A random app note shows 95% of initial current transfer ratio after 25 years at If = 5 mA, and depending on the necessary bit rate we could probably design for at least 2x initial margin on that CTR. Such a design would last effectively forever.

https://www.we-online.com/catalog/media/o303314v410%20ANO006...

I think the galvanic isolation is mostly a feelgood here, allowing people to say it's "air-gapped" even though that's not directly relevant (since Wi-Fi is also "air-gapped"). A simple gate or level shifter can also enforce unidirectional data flow as you say.

Re: Creating a bespoke data diode for air‑gapped networks

#72

Post by PaulCarrack »

bigfatkitten wrote: post #37

Why not use optical ethernet as ‘real’ cross domain solutions do? Probably cheaper if you don’t mind eBay, and gives you an easy upgrade path to 10Gbps or more in future. Two port NIC on the low side. Port 2 has its TX side connected to Port 1’s RX, just so the port will see a carrier and show link up. Port 1 TX goes to the high side machine’s RX, with TX left open. From here, you have a whole ton of protocol options…

It's easier than that. You don't need two NICs to get a carrier, just use a fiber coupler. They are super cheap (< $30)

Re: Creating a bespoke data diode for air‑gapped networks

#73

Post by tripletao »

nancyminusone wrote: post #5

Unless you needed Ethernet, you could have done the same thing with a null modem RS-232 cable with the TX pin cut on one end.

The "RS-232" part is important here, since directly connecting the UART pins for the two MCUs without the RS-232 level shifters may trivially permit bidirectional dataflow, for example by reconfiguring the pins to GPIO and bit-banging a UART in the reverse direction, as already noted below. That wouldn't be directly exploitable (since you'd need to somehow bootstrap that reconfiguration in), but it would widen the attack surface.

If the cable wires control signals like DTR and RTS, then you'd need to cut those too. The goal in any case is one wire (plus ground) out of the transmitter and one wire into the receiver, with something in between that enforces data flow in only one direction. An optoisolator can do that, but a buffer without galvanic isolation (like the RS-232 level shifters) can do that too.

Re: Creating a bespoke data diode for air‑gapped networks

#74

Post by bigfatkitten »

PaulCarrack wrote: post #72
bigfatkitten wrote: post #37

Why not use optical ethernet as ‘real’ cross domain solutions do? Probably cheaper if you don’t mind eBay, and gives you an easy upgrade path to 10Gbps or more in future. Two port NIC on the low side. Port 2 has its TX side connected to Port 1’s RX, just so the port will see a carrier and show link up. Port 1 TX goes to the high side machine’s RX, with TX left open. From here, you have a whole ton of protocol options…

It's easier than that. You don't need two NICs to get a carrier, just use a fiber coupler. They are super cheap (< $30)

You can, but a 1x2 multimode splitter is not something people generally have on hand, whereas 1000BaseSX cards (or media converters) and ordinary patch cables are easy to find.

Re: Creating a bespoke data diode for air‑gapped networks

#75

Post by pseudohadamard »

bigfatkitten wrote: post #37

Why not use optical ethernet as ‘real’ cross domain solutions do? Probably cheaper if you don’t mind eBay, and gives you an easy upgrade path to 10Gbps or more in future. Two port NIC on the low side. Port 2 has its TX side connected to Port 1’s RX, just so the port will see a carrier and show link up. Port 1 TX goes to the high side machine’s RX, with TX left open. From here, you have a whole ton of protocol options…

Or you could get 10Mbps Ethernet hardware and cut the receive line.

I don't know the specifics, including what particular Ethernet tech it was that allowed it to work, just heard someone talking about it some decades ago.

Re: Creating a bespoke data diode for air‑gapped networks

#76

Post by zephen »

tripletao wrote: post #71
zephen wrote: post #52

If galvanic isolation is necessary, there are "digital isolators" (that's a good search term if you are interested) that are much faster than optocouplers and that don't suffer from the same sort of degradation (over a few years, the LED gets dimmer and dimmer). But there's probably no galvanic isolation going on here anyway, so a wire, or at most a simple logic buffer, would probably suffice. If I'm connecting two t…

> over a few years, the LED gets dimmer and dimmer That shouldn't happen unless the LED is driven near the top of its current rating, which shouldn't be necessary unless you're pushing the limits of its rise/fall times (in which case a different part would be advisable as you say). A random app note shows 95% of initial current transfer ratio after 25 years at If = 5 mA, and depending on the necessary bit rate we cou…

Upvoted for:

> which shouldn't be necessary unless you're pushing the limits of its rise/fall times

Right, I should have clarified this. To make them go fast, you can often use more power (to a point), and that can shorten the LED lifespan. (To be fair, there are techniques to give you a bit faster speed without making them too bright, like pulse-shaping, but it didn't appear anything that fancy was going on there.)

And, unfortunately, "fast" for the optoisolator isn't very, in any case. The cut-off frequency for the first datasheet I found corresponding to that app note was 80 KHz.

> I think the galvanic isolation is mostly a feelgood here,

And...

I don't get this.

If it does nothing useful, why bother?

IMO, the primary good use for an optoisolator these days is either for something analog-ish like the feedback for a switch mode power supply, or for when you're breadboarding something with really high voltages and don't want to bother with SMT devices.

Re: Creating a bespoke data diode for air‑gapped networks

#77

Post by wolrah »

avidiax wrote: post #46

I feel like it's easier to just have Ethernet and a strict HW firewall with the admin interfaces totally disabled (have to full reset to get back in). You can either just block packets in one direction, or you can add a small amount of risk and allow UDP and TCP with zero payload in one direction. That would allow you to reliably stream in one direction and request from either direction, albeit with a slightly exploi…

> I feel like it's easier to just have Ethernet and a strict HW firewall with the admin interfaces totally disabled (have to full reset to get back in).

Easier? Maybe, for certain values of easy, but as others have noted it's not hard to build a data diode setup using fiber ethernet and from there you just have to hardcode some ARP data and maybe a route entry to allow UDP to flow.

The thing is that with your solution as long as the firewall works properly data shouldn't be able to leak in the wrong direction. With a proper data diode, as long as physics continues to function more or less how we understand it you can prove that data can not leak in the wrong direction. That's a huge difference, especially when it comes to explaining what you're doing to non-technical higher ups, auditors, lawyers, etc.

Re: Creating a bespoke data diode for air‑gapped networks

#78

Post by tripletao »

zephen wrote: post #76
tripletao wrote: post #71

Earlier quoted context omitted.

> over a few years, the LED gets dimmer and dimmer That shouldn't happen unless the LED is driven near the top of its current rating, which shouldn't be necessary unless you're pushing the limits of its rise/fall times (in which case a different part would be advisable as you say). A random app note shows 95% of initial current transfer ratio after 25 years at If = 5 mA, and depending on the necessary bit rate we cou…

Upvoted for: > which shouldn't be necessary unless you're pushing the limits of its rise/fall times Right, I should have clarified this. To make them go fast, you can often use more power (to a point), and that can shorten the LED lifespan. (To be fair, there are techniques to give you a bit faster speed without making them too bright, like pulse-shaping, but it didn't appear anything that fancy was going on there.)…

I think those optoisolators are indeed sold mostly for switching power supplies. That's probably why someone cared enough about aging to write an app note, since the ambient temperature is high there and the exact CTR matters more when it's in that analog feedback loop. I've also seen them for digital inputs in industrial control systems, where speeds are slow and the wires might be coming from far away on a noisy ground.

That said, I believe optical isolation is typical for these "data diode" applications, even between two computers in the same rack. I don't think it provides any security benefit, but it's cheap and customers expect it; so there's no commercial incentive to do anything else.

Re: Creating a bespoke data diode for air‑gapped networks

#80

Post by elevation »

wakawaka28 wrote: post #63
Alex2037 wrote: post #51

Earlier quoted context omitted.

both of these require the isolated machine to be heavily compromised to begin with. there are a lot of such extremely hypothetical attacks no one should take seriously. you might as well worry about sensitive data being exfiltrated from your unshielded optical nerve,

Eavesdropping on stray RF signals is not so theoretical though. It's been done by NSA and no doubt others. We also need to worry about hardware supply chains including random compromised stuff that "accidentally" leaks or exposes backdoors.

If I gave away a PC with perfect RF isolation and a rock solid supply chain it wouldn’t improve most user’s overall security because their operational security is so poor. There is no need for any organization to snoop your RF when you’re leaking everything they care about in your metadata.
Post reply on HN