Security → Hacking air-gapped systems

OK, it's aimed at high value systems, but the technique is indeed interesting and could be developed for hacking financial and infrastructure systems.

Article at
»www.govinfosecurity.com/ ··· 442/op-1
--
"Apparently you can’t hack into a government supercomputer and try and buy uranium without the Department of Homeland Security tattling to your mother."
-- Sheldon Cooper

I take it that you've never seen a financial data center. Access is tight and controlled. While this is proof of concept, using it in the real world is going to be a bit more difficult. Laser control is going to be line of sight (LOS) You have to infect the printer. Then "ideally the lid of the all-in-one printer's scanner would be in a raised position." In a perfect storm you might be able to get something, but in the real world I think you would be very hard pressed.
--
All opinions are my own and should not be attributed to any other person or organization.

"Progress isn't made by early risers. It's made by lazy men trying to find easier ways to do something." - Robert A. Heinlein

As a matter of fact, I have been involved in the operations of several financial data centers, including but not limited to Chase, PNC, US bank, Nationwide financial as well as VISA and Mastercard processing centers. All were customers of IBM where I worked as a systems engineer and operations specialist.

What concerns me is the "well, we're so secure nothing can happen to us" attitude expressed in so many places by people who should be thinking beyond POC to real world possibilities. .
--
"Apparently you can’t hack into a government supercomputer and try and buy uranium without the Department of Homeland Security tattling to your mother."
-- Sheldon Cooper

Whenever you read an article on one of these "attacks" you have to take a closer look to see how feasible the attack is in the real world. These articles are meant to get your attention. The items in this attack designed to do that are laser, one mile away, drones. Once they have your attention they hope that you don't notice the little details like the scanner lid needing to be opened and that due to using a laser the attack needs to be LOS. You are more likely to lose your data to an internal leak than to an attack such as this. People are easy to compromise.
--
All opinions are my own and should not be attributed to any other person or organization.

"Progress isn't made by early risers. It's made by lazy men trying to find easier ways to do something." - Robert A. Heinlein

I think the big issue here is that these companies can make the network as secure as they want. But if social engineering can gain the "hacker" physical access to facilities id imagine far worse things than an infected MFC device are to worry about.
--
Filan - Aurin Spellslinger - Pago - Team Legacy

I know more than one data center with financial and HIPAA data that have windows to the tech support area, and office spaces with windows that have desktops and MFP printers connected to these centers. In addition to substantial HDD and flash storage, many MFPs have SNMP enabled with default community strings, so a great deal of fingerprinting can be done once that desktop printer in the windowed room is compromised.

That being said, there are also places like Batellle, Wright Pat, etc. where everything is secured in spaces that are EMF shielded, double door entries and have filtered utility power. These guys were doing this stuff since the late 70's. They were (and still are) ahead of their time in technical and social engineering security.

Historically, yesterday's improbable POC has too often been developed into today's attack. We can laugh them off or play black hat and see how they can be used before the 'other guys' do.
--
"Apparently you can’t hack into a government supercomputer and try and buy uranium without the Department of Homeland Security tattling to your mother."
-- Sheldon Cooper

i have heard some people say that they can hack an air-gapped computer but i don't believe it..

Yup. One of the significant barriers to security these days is the dismissive mindset, typically associated with the undervaluing of a target.

--
Be a Good Netizen - Read, Know & Complain About Overly Restrictive Tyrannical ISP ToS & AUP »comcast.net/terms/ »verizon.net/policies/
Say Thanks with a Tool Points Donation

Send in the drones. Free holiday gifts to the employees. They will fly them around the noc no problem for fun. Social engineering.

American express here on mundane things was evil. Years ago marking for Bluestake digging armed gaurds told me go away they take care of it. LOL Told them I need to mark ask higher ups. Maybe did or didint tossed away like a nothing get off our property and no way in secure area where I was told by bluestake ticket need marked.
But when digging crew shows up I get call back asap and told remain on site till they are done. Called my manager and let him remain on site. His job and I had more work to do.
But they are paranoid as hell. Though were the crew was digging and who they were so would I be.
I even called my manager when first told go away and marked it in logs etc. customer refused bluestake. Then they call back paranoid as hell a couple days later when the digging crew showed up as if it were an emergency,

Then when worked for local Telco I got in to fix their lines. Loved the inside and nice eats for lunch. Not given run of place but by then knew someone there and semi trusted. Still watched but not 24/7. Had to be let in and out of secure and if had messed up ???
Boss showed up to check on my work. They asked if I needed him and truthfully said no. He wasnt let in. He was mad as hell at me later. But never got in the few times I went there. Wasnt their main telco tech but got the work when others on vacation and I was allowed access as knew someone there.
I

Someone mind deciphering this post?

I tried and gave up. Seems to be complete gibberish.
--
Panic is the new patriotism

here is a related article, about hacking an air-gapped computer:

»arstechnica.com/security ··· -radios/

duh, make the computer into a radio and then have a reciever to recieve the radio-broadcast.. that is high-tech..

It would be much, much easier to just wait until they replace their MFP/copier and their copier company tells them, incorrectly, that everything they've ever scanned isn't on the disk in the copier, and then steal the disk from the copier.