Schneier on Security

Clive Robinson • December 7, 2018 4:13 PM

@ All,

The earlier attack I refered to above was against the UK’s Barkleys bank, back in 2013, and used a KVM switch to perform the attacks.

https://www.bbc.com/news/uk-england-24172305

@ All,

Irrespective of the specifics of devices you can now get the equivalent of a PC on a form factor a lot lot less than a Raspberry Pi, even smaller than a stick of chewing gum.

Whilst these devices are not “implanted” in other hardware they could easily be built into network socket face plates or spliced into a neywork cable in the floor or other plenum or crawl space.

Worse they could as with the KVM switch be put on the user side of a PC on the HCI where all security is open to what is the simplest of MITM attacks.

It takes no great brains to realise the best way to attack a system is as “the admin” Ed Snowden kind of made that obvious to the world. It’s why various people go after Admin Credentials where ever they can, because they might not be quite “the keys to the kingdom” but they do get close.

If you could get a 3g/4g mobile device connected to the Sys admins desktop via a KVM switch, you could achive a great deal without needing their credentials.

If you likewise built your own version of the “crotch shot heat destector” used to check employees are at their desks to put under the Sys Admins desk or a wireless CCTV camera in a clock / fire detector / light fitting you could get all the “habit” information to find the best times to take over an Admins PC for a few moments.

Such attacks are very stealthy in some respects[1] and difficult to find using “on the wire” instrumentation / enumeration and can require people to “walk the wire/line” examining each point in detail.

Because walking the wire/line is manpower intensive and very disruptive, it’s not done often or at all these days[2]. This gives an advantage to an attacker especially if they are “just another face” in the office and thus can spot signs of “stranger danger” of investigators and switch down to what is a highly covert “pass through” state.

Combating such types of what are “insider attacks” can be exyrodinarily difficult and as with older high security military systems, you need to have the ability to do such checks built in from “day zero” of the system[3], as bolting them on will almost certainly be prohibitively expensive, and have a high probability of being ineffective…

[1] They are also due to their use of RF also “very noisy” thus can be found with the likes of Software Defined Radios (SDR) which are quite small, light and above all highly flexable oh and can cost as little as $10.

[2] In the early “terminal” days of high security computing all the cables were carried in preasurised ducting, which had alarms that tripped on even small changes of pressure. Thus causing an “armed response” to an area, whilst acceptable in a high security military facility, assult weapons and office workers generally do not mix well.

[3] There are if you know the right people to talk to solutions for protecting cabling without having to resourt to pressure ducting[2]. In essence they use special armoured coaxial cables which are instrumented with Time Domain Refectomatary detectors, that check the cable hundreds if not thousands of times a second looking for electrical impedence changes that signify the cable is being attacked or even just touched and at what distence and direction from the detector, alowing very rapid response.