Schneier on Security

Clive Robinson • November 24, 2023 12:58 PM

@ Brucr, ALL,

Re : Flying across the gap.

“One of those tools is a computer worm designed to spread from computer to computer through USB drives.”

If you look way back on this blog…

I described how to do this years ago, pre Stuxnet when doing some research on how to do “fire and forget” attacks against “voting machines”.

The argument was that voting machines were never connected to the Internet so were “air gapped” so could not get “malware infections”…

However they were based on a well known commercial OS and,standard PC mother board designs. As such a maintainance tech would have to go around and patch them etc.

I reasoned that the techs would use laptops that did get connected to the Internet, and that they would plug in a USB device to get the patches etc. They would then use that USB drive to update the voting machines.

So all you had to do was “piggy-back” on the USB drive to get code onto the voting machines.

The hard part was how to get your code onto the technicians laptop. Hence the “fire and forget” nature. The code would travel around the Internet getting on machine after machine. If you knew the type of laptop or particular application the techs used then you had a “distinguisher” so your code would be like a “loitering munition”[1] just fliting about waiting to drop a payload and then ride in across the gap.

The part I decided not to talk about back then was how to do the reverse which is exfiltrate data. For two reasons, firstly it was not needed to attack voting machines, secondly I’d worked out a rather nifty way to extend my trick of creating an unblockable and decoupled control channel by co-opting Google’s search engine[2]… A trick that’s still not been seen in the wild as far as I’m aware… But the simple infiltration across an air gap was fairly quickly seen and several times since then.

Which suggests the readership of this blog has worn “several shades of grey” in headware.

[1] I know the term “loitering munition” was not used back then, but it’s just so apt –or should that be APT– these days.

[2] Creating an unblockable and decoupled control channel by co-opting Google’s search engine is actually not difficult and I’ve outlined it before.

Put simply you find any random blog –that Google Searches and puts in it’s cache– that alows anonymous posting. You simply add a unique “distinquisher” such as a “handle/name” that your code can run a Google search for. In the body of the post you hide your “control string”. Obviously you have to dress it up a bit in that the distinquisher has to be a “One Time Use” string and not directly visable in your code and a few other tricks but the idea works…