Chinese Hacker Group Targets Air-Gapped Networks 71
itwbennett writes An otherwise unremarkable hacking group likely aligned with China appears to be one of the first to have targeted so-called air-gapped networks that are not directly connected to the Internet, according to FireEye, which released a 69-page technical report on Sunday on the group. FireEye picked up on it after some of the malware used by the group was found to have infected defense-related clients in the U.S., said Jen Weedon, manager of strategic analysis with FireEye.
What we need (Score:3, Funny)
is a bigger gap!
Re: (Score:2)
"Mr. President, we cannot allow an air gap gap!"
Is a water gap (Score:2)
Air is so passe.
Hillarrhea!'s mail server? (Score:1)
Haven't they already hacked that?
Re: (Score:1)
No mention of getting data out (Score:1)
Re: (Score:2)
"So even if I managed to get my malware on a machine and then somehow got the sensitive data onto some sort of external media, I still don't have anything useful."
In one acronym: DoS.
Re:No mention of getting data out (Score:5, Insightful)
you can bring your USB drive into the secure area, but it can't be removed ... I still don't have anything useful
Stuxnet wasn't all about "getting anything out," either.
Re: (Score:2)
Re:No mention of getting data out (Score:4, Insightful)
Re:No mention of getting data out (Score:5, Interesting)
dont have to dial home. Look for new incoming infections to carry the new commands.
You attack an airgapped but human vulnerable systems like you send probes to outer space. You keep sending them in hopes that one reaches it's target. Anything after you send with the same hopes but with new commands for anything that may have made it there.
and airgapped can have a reverse comms channel you just need to be clever in finding that channel. Attacking a science facility? You had to target a scientist to get it in there, so target that same person as the outgoing data stream. all you need is YES/NO data. so alter their data that they would communicate back out manually.
Pop up a typical windows error, "CAUTION ID10T ERROR OK/RETRY" They will report that back to IT via their email that you are watching. There is your return data channel.
Re:No mention of getting data out (Score:5, Informative)
I think they are relying on people to accidentally forget to confiscate the devices when leaving secure areas or the malware is waiting for some other way to communicate out of the network. Recently, a researcher showed how he was able to move data (albeit, very slowly) between two air-gapped machines just using temperature changes of both infected machines. Something using built-in speakers and mics of two machines could also move data using ultrasonic audio. If this is a targeted attack looking for a specific piece of information, a private key perhaps, you wouldn't need to transfer the information very long before someone notices.
All of these air-gapped exploits pretty much rely on people clicking things they shouldn't or plugging things in to other things they shouldn't but the hard part is getting back out of the air-gapped network.
Re:No mention of getting data out (Score:4, Insightful)
It seems that this group managed to spread their malware via USB sticks. The modern equivalent of floppy disk viruses. But in all of the classified networks that I've seen, you can bring your USB drive into the secure area, but it can't be removed. So even if I managed to get my malware on a machine and then somehow got the sensitive data onto some sort of external media, I still don't have anything useful. Not that I wouldn't want to defend against the malware, but it seems that the air gap really is doing it's job.
This may be true of the systems you have worked on, but it isn't true of all classified systems.
If a classified system is approved for trusted downloading, then it is enabled for certain data to be passed to and from that air-gapped system, usually via optical drive, but other means(USB, floppy) are not unheard of.
Let's put this another way. Ongoing development that also includes attacks on air-gapped systems would not be ongoing if there were no viable methods of attack. That would be rather pointless.
Re:No mention of getting data out (Score:5, Informative)
It seems that this group managed to spread their malware via USB sticks. The modern equivalent of floppy disk viruses. But in all of the classified networks that I've seen, you can bring your USB drive into the secure area, but it can't be removed. So even if I managed to get my malware on a machine and then somehow got the sensitive data onto some sort of external media, I still don't have anything useful. Not that I wouldn't want to defend against the malware, but it seems that the air gap really is doing it's job.
There are ways for a machine to transmit information other than a wire, that can be detected by other devices. The infected air-gapped machine could send information out through its speakers that a microphone elsewhere could hear. It could flash its screen in binary in the middle of the night that someone outside the building might see through a window. It can raise and lower its power usage through various means that might be detected at the power feed. There was even an article [hacked.com] a month ago talking about changing the heat output of the air-gapped machine that could be detected by the thermal sensors in a nearby computer. And there are even more that I won't go into.
So there are ways to send information out even if the USB drive doesn't leave.
Re: (Score:3)
Re: (Score:2)
It can do bursts of computation, memory access, or anything else that varies the amount you wiggle voltages or currents on wires in a way that emits radio waves. You can do it without even trying (which is one way some smartcards exposed private keys ...).
In the days of CRTs that applied especially well: Graphics output could modulate the beam and generate a LOT of radio. (Doing gray scales by making shifting fine patters would be an especially "in your face but you can't see it" approach.) A fast photo
Re: (Score:2)
Do you need some sort of auto-run action upon insertion of the USB stick in order for this to work?
Seems crazy that you would have a policy to automatically execute anything.
Re: (Score:2)
http://www.wired.com/2014/10/c... [wired.com]
Re: (Score:2)
That is not technically correct, as a proper air gapped network should not have any means to digitally add data other than via secured, monitored and filtered access points. So failures in air gap system design are obvious, still live wireless hardware, unconditioned power feeds and local terminals with poor input control methods. The untoward access to a properly designed air gapped network should be via corruption of personal and that data should only be copied and removed in hard copy form or be added m
Re: (Score:2)
...even if I managed to get my malware on a machine and then somehow got the sensitive data onto some sort of external media, I still don't have anything useful.
Unless the hack on that USB stick forces the target machine to start radiating data on RF via its monitor or other peripherals.
Those radiations could then be read from an external pickup.
"Van Eck phreaking is a form of eavesdropping in which special equipment is used to pick up side-band electronic-magnetic emissions from electronics devices that correlate to hidden signals or data for the purpose of recreating these signals or data in order to spy on the electronic device. Side-band electromagnetic radiat
Re: (Score:2)
Stuxnet was first therefore title should say, Chinese are following US footsteps, or Chinese are caching up to Americans, etc.
Getting malware onto air-gapped machines through covert means predates stuxnet by a large amount (decades), with the Russians being one of the earliest practicers.
Re: (Score:3)
Wasn't the first practitioner a computer store in Pakistan? Your computer would just display a message saying, "to fix this message, $$$ to this computer store in Pakistan" or something to that effect. Even had their name in it and everything.
Re: (Score:3)
Ah, here it is [wikipedia.org]. Even better that it was accidental.
Re: (Score:2)
Chinese are caching up to Americans, etc.
Hopefully not using nginx.
.....this is news? (Score:5, Interesting)
The group designed malware components with worm-like capabilities that can infect removable drives such as USB sticks and hard drives. Those devices can transfer the malware if connected to a device on an air-gapped network.
Um... welcome back to the 80s and 90s?
Re: (Score:3)
Re: (Score:2)
Ah, yes. I remember well, sticking a floppy into a rent-a-Mac at the local copy shop, and watching the virus scan.
I wonder... (Score:2)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
It's not hard to download the updates from a secure isolated computer burn them to disc and transfer them to an administration machine on the closed network. Ideally this machine would be locked down so heavily to be near unusable so its chance of compromising is reduced. Along with audits before and after downloading.
The NSA sets the DOD's policies on this stuff, and they wrote the book on compromising systems.
Re: (Score:1)
If the machines are air-gapped, how are their software updated?
If the computer is air-gapped and only connected to an internal network that is isolated from any other network which might have Internet connectivity, there is no reason to update software on a regular basis. If you only create documents and are using WordPerfect and print all documents for dissemination why would you update or change the word processing software?
Re: (Score:2)
And the answer is, they are not air-gapped during the update procedure, which thus must be carefully controlled Updates tend not to happen often in such evironments, for exactly that reason.
Sometimes it's not. (Score:1)
We've got systems where the software is simply frozen.
Re: (Score:2)
a:\update.exe
Re: (Score:2)
With floppies [arstechnica.com].
Note to the terminology-impaired (Score:4, Informative)
If you can stick foreign media into it, it's not airgapped.
Re: (Score:2)
Correct. And at that point, the system is not airgapped. It will be airgapped once installation is complete and system sealed.
Re: (Score:1)
Correct. And at that point, the system is not airgapped. It will be airgapped once installation is complete and system sealed.
The operating level is airgapped.
Stop being *that guy* who wants to nitpick this shit down to maintenance-level support for offline systems. The fucking power cord means it's "online" if you can build sensors that detect varying levels of voltage. Same goes for RF bleed if you've not built TEMPEST shielding around the hardware.
Re: (Score:2)
Re: (Score:2)
Sure it is. An "air gap" is a network configuration- e.g. there is no wire connecting the network to the outside world.
I have heard that many air gapped networks also put super glue in the USB ports, but that's not required.
Re: (Score:2)
Wrong. An "air gap" is a *network and system* configuration. There is no *nothing* connecting the system/network to the outside. If there isn't air between hardware and *any* outside media, network or otherwise, there isn't an air gap.
Re: (Score:2)
So workstations on an airgapped network can never get software upgrades?
Re: (Score:2)
Correct. The system would have to have its airgrapped status stand down temporarily to perform the upgrade. Which is one reason that upgrades on such systems are rarely done.
Re: (Score:1)
Or data to be processed? (Score:2)
So workstations on an airgapped network can never get software upgrades?
Or data to be processed?
Re: (Score:1)
Wrong. An "air gap" is a *network and system* configuration. There is no *nothing* connecting the system/network to the outside. If there isn't air between hardware and *any* outside media, network or otherwise, there isn't an air gap.
No, this is not the accepted industry definition of air gapped systems. Most air gapped systems needs some way of receiving updates to the code they are running or export/import changes to data sets. But USB sticks is probably the most dangerous method you could choose for this, CD would be better.
Been there, done that (Score:1)
Advanced hacking group likely aligned with China? (Score:1)
What evidence does FireEye have that 'China' is behind this and why don't you mention that the main technology required in order to facilitate crossing the 'air-gapped networks', is a portable USB device, malicious email attachments and Microsoft Windows.
Not only that, but.... (Score:2)