> (It is, however, extremely important to me that I make clear that I had no idea there was a law like this for a reward when I resigned from UBS in October 2005, as the law passed in December 2006.)
If your machine has a USB port, it's no longer properly isolated.
Obviously that's a tremendous pain to work with, because you're limited to PS/2 keyboards and mice (etc etc), but given that there's no way of authenticating USB devices and they've already been used in various attacks, a serious airgap protocol has to ban USB ports.
You could quite easily hide a USB mass storage device inside a mouse, or with a bit more work have an unmodified mouse with a spare Flash area used for data exfiltration.
(Firewire is even worse, and Thunderbolt lets you onto the PCI bus)
This is slightly too strong – it should be “has to ban unsecured USB ports”. By 2002 or so, people I met who worked at SPAWAR were advising conference attendees to follow their standard practice of epoxying necessary USB devices to the computer and completely filling unused ports. That moved USB into the same difficulty class as other physical access attacks, which they were already depending on building security to restrict.
Also note that while it's true that Firewire and Thunderbolt are definitely still riskier, newer versions of Windows, OS X, and Linux can use the IO-MMU to prevent DMA attacks. That started shipping in OS X 10.7 and Windows 8.1 (only when locked) and OS X 10.8 enables that all of the time for hardware made around 2012 and later.
If you just leave away the USB mass storage kernel module when compiling the kernel, the mass storage device won't work anymore while the mouse still works. I wonder if this is a solution to this problem or not since it seems quite naive.
This is not sufficient. One known vector is to emulate a USB network device that provides a nameserver via DHCP, but no default route,allowing the attacker to MitM chosen connections. And of course you have a plethora of different USB device types with default drivers that probably contain exploitable bugs.
Just speculating: this might mitigate some kernel level exploits but since its typically usb card <--> usb bus/controller <--> PCI bus, presumably hardware or kernel bugs elswhere in that stack could still be exploited. Interesting thought!
And if that malware can't liberate USB access, and still needs to read data (rather than just writing it), it could exploit the capacity for various devices to emit detectable EM radiation. The fake keyboard/mouse, being inside the Faraday cage, would be able to sense that radiation and extract data that the malware in its payload sends back to it.
In fact, all of this would work equally well with a PS/2 port.
Too easy to have that undone by a security update later. Better to physically disable the ports (fill them with epoxy for example). Much more foolproof and easy to verify.
> You could quite easily hide a USB mass storage device inside a mouse
AFAIK one could mitigate something like this by really restrictive udev rules only allowing certain usb drivers on certain usb ports (like no usb msc on the port dedicated for keyboard only).
Personally? PC gets locked in a box with some sort of venting. Keyboard / Mouse are plugged in by IT and no one unauthorized has physical access to the PC itself.
If they're serious enough about finding 0 days and exploits to the USB or OS to load this shit any physical access to the box itself is off limits.
This is why you need defense in depth: physical seals on components, either protecting cables or keeping them clearly visible where someone can notice tampering, and – above all – having the physical space setup to strictly limit someone's ability to bring arbitrary objects in or spend time alone with sensitive hardware.
Consider what someone with the time, skill, and access to do that could also do without that: opening the case and directly installing some sort of device, planting a camera which records you typing passwords in (“oops, left my cellphone sitting out. Won't happen again!”), planting a radio receiver which opens up all sorts of side channel attacks, installing a passive network tap, etc.
A guard with a metal detector and strict limits on what you can bring into the building or what tools you can use inside is going to do a better job preventing all of those.
You can mitigate the exploit against standard mass storage drivers, yes, but there are other ways. It appears in this case the host was compromised (so able to override the drivers).
If a userland program can get at the raw HID interface, that can also be used for exfiltration to a tailored device.
I meant, using a physically compromised keyboard that records LED transitions set by the host, since the context was USB devices that look like normal keyboard or mice but actually contain storage.
And they had every login for the network it was found on:
"The library was masquerading as a Windows password filter, which is something administrators typically use to ensure passwords match specific requirements for length and complexity. The module started every time a network or local user logged in or changed a password, and it was able to view passcodes in plaintext."
This was a network authentication module on a domain controller. It's intercepting every low level token used to authenticate a network transaction, including encryption keys.
If security has been penetrated that far you are already owned.
What really scares me are things that can live in firmware; not just on mass storage drives but also in host system firmware. We've let too many dragons breed in dark places in the name of Digital Restrictions Management.
Part of what makes ProjectSauron so impressive is its ability to collect data from air-gapped computers. To do this, it uses specially prepared USB storage drives that have a virtual file system that isn't viewable by the Windows operating system. To infected computers, the removable drives appear to be approved devices, but behind the scenes are several hundred megabytes reserved for storing data that is kept on the air-gapped machines. The arrangement works even against computers in which data-loss prevention software blocks the use of unknown USB drives.
Okay first, it probably doesn't get information from air gapped computers without being plugged in, so let's quit with the voodoo right now. You guys are discounting the possibility of idiocy.
Second, making partitions that windows doesn't see is trivially easy. I went out of my way to buy a 128gb flash drive nearly 10 years ago at great expense, it had a 4gb fat 32 partition which is what Windows would see.
It had an 16gb Linux partition with 8gb of that being an encrypted partition
I installed a bootloader that allowed it to be switched to if plugged in when any computer was starting up
"making partitions that windows doesn't see is trivially easy"
Are we talking "partitions Windows wont mount because they aren't FAT/NTFS" or "partitions that literally do not show up to Windows Disk Management because the disk itself is showing a different capacity. EG: A 16GB USB reporting only 8GB, regardless of the OS installed"
A big chunk of space would take some work, but if you only needed a few KB there is slack space (at least a handful of sectors) on the end of every USB drive that doesn't align with partition sizes. I've used it before to store data on how many times my reformatting tool was used on the disk.
This seems trivial to me. Heck, you could practically make it full out remote exec and grab output from airgapped machines if USB keys were moved between them frequently enough. Serialize and encrypt tiny blob with command, do the same for the output and dump it back on the same USB drive or the next one plugged in, send the data out the next time it's on an internet connected machine... I don't see any challenge or skill involved here. Good post-exploitation malware is often more about doing simple things right than about doing impressive things though I suppose. Having the exploit that allows this attack to happen is the impressive part.
Is this not just a humblebrag? I really fail to see the point of this. It is really cool to read about people who find inventive ways to overcome economic obstacles. It's somewhat boring to read that someone got a high paying job, and married someone with a high paying job, and then things worked out.
This is the third story I submitted today from a series called Into the Black: https://medium.com/tag/into-the-black which is about people paying down debt. This is the title that grabbed the HN crowd. The others got one and zero upvotes, respectively (so far).
Feel free to go read the other stuff in the series if this is not your cup of tea. I didn't think it made sense to submit the link (above) to the series as a "story" on HN. But it is hardly surprising that this is the title that would grab the HN crowd. (shrug)
Sadly enough that is considered "advice" these days. Compare this to the girl who tried to live in SanFran as a low paying worker and got fired from her job for complaining about it.
You're not going to get a much better reply than this. Speak their language, they will listen. Especially if you have access to historical data, it can be pretty easy to cherry pick some examples of where the improved QA would have had drastic savings.
People fear change, but no one wants to throw away money. Make them see the dollar signs.
The entire point of money laundering is to convert ill-gotten money into seemingly legitimate assets. It's not like they offered Espinoza dirty cash that he would buy for cents on the dollar with clean cash. He didn't channel their cash through legitimate business channels to obfuscate its history. He engaged in nothing resembling money laundering. This was a man who sold a commodity. Replace Bitcoin with literally anything else. If Espinoza sold them $30,000 of frozen orange juice concentrate, who cares if they're going to trade that for stolen Russian credit cards? In no way is he facilitating money laundering in either scenario.
Laundering is usually "the concealment of the origins of illegally obtained money." That could apply to swapping for euros or whatever. It's whether you are doing it to conceal the origins that is important.
Yeah, I think they messed this up. In my view they could have charged him with money laundering if they could have proven that the bitcoins he was using were purchased with illicitly obtained funds. The laundering would have taken place when the bitcoins were purchased, not when they were sold.
>He engaged in nothing resembling money laundering
I happen to know what money laundering is, being a certified money laundering specialist (CAMS) and all, and what he allegedly engaged in was money laundering. However, the judge was being completely fair in her statement as the prosecution did a lot of flippity flop and kept switching back the defendant's position from what is a business and a payment instrument seller. This was a relatively easy case to win for the prosecution, but pretty astounding as to how a very ill prepared prosecution and well prepared defense can go a long way.
> I happen to know what money laundering is, being a certified money laundering specialist (CAMS) and all
One would hope that you are, in fact, a Certified Anti-Money Laundering Specialist, since what you initially labeled yourself as implies that you routinely engage in illegal activites.
Let's say person X has lots of bitcoins (potentially mined from the early days, when it was very easy to obtain). They go and sell it for $30,000, in cash. Let's assume X has the intention to declare the gains in their upcoming tax returns.
Why this would be money laundering?
Basically X is selling a property in the form of a mathematical equation, that was obtained legally. Of course they'll have to pay taxes like in any other profit-generating transaction, but other than that I'm failing in seeing the issue.
ps: it seems that in this case they were trying to entice the guy with stolen credit cards. As that didn't work, they tried switching to money laundering.
>Let's say person X has lots of bitcoins (potentially mined from the early days, when it was very easy to obtain). They go and sell it for $30,000, in cash. Let's assume X has the intention to declare the gains in their upcoming tax returns.
it's not what's happening here. i haven't seen where that was implied either.
>it seems that in this case they were trying to entice the guy with stolen credit cards. As that didn't work, they tried switching to money laundering.
no, they didn't entice him stolen credit cards, they, undercover, purported the sale of bitcoins/cash to him for the purpose of laundering the proceeds of the crime ( stolen credit card). Therefore, if he engaged in that sale knowingly, he willingly engaged in the laundering of proceeds of crime, i.e: money laundering. What they were weak or unable to demonstrate substantially was that his transactions thus far before the sting, were largely derived in the operations of aiding and abetting the laundering of the proceeds of crime.
They did try to entice with him with bullshit stolen credit cards. If you read carefully the first two pages, nothing was technically illegal, other than the fishy part where the defendant said he would "think about it" when offered to be paid with stolen credit cards. Had he said "No way Jose", it would have been a perfectly clean transaction, that could have happened to anyone on HN.
Still, he allegedly didn't accept the credit cards, and the detective tried to proceed with counterfeit money. In the end the defendant was charged with money laundering simply because he was selling bitcoins, which is utterly absurd. The judge was spot on to throw the case out.
I have no sympathy for crooks using bitcoins to cover their illicit actions, but I have equally no sympathy for law enforcement burning taxpayer dollars to chase ghosts.
I did the read the case, your premise and understanding of what money laundering is, in this case incorrect. When something is illegal it does not have a binary state of technically illegal, and nontechnically illegal. It is or it isn't. Knowing and willingly, aiding and abetting laundering proceeds of crime is considered in the same case of money laundering, whether you stole the cards, or got money for stolen cards you sold, or you helped the guy who got money for the cards he sold, or you helped the guy who helped the guy that got money for the stolen cards he sold.
It's not easy to understand the vague and imprecise world of money laundering because the laws were written to be broad.
This is not the first time stings are carried out, this is also not the first time a prosecution fails at a case that by all indications of the allegation should have been easy to close.
Actually, the government invests quite a lot of time and resources in prosecuting people who facilitate money-laundering through the purchase and sale of commodities (look up "trade based money laundering").
