1      Air Gaps

     2 

     3 

     4 

     5 Since I started working with Snowden's documents, I have been using a 

     6 number of tools to try to stay secure from the NSA. The advice I shared 

     7 included using Tor, preferring certain cryptography over others, and 

     8 using public-domain encryption wherever possible.

     9 

    10 I also recommended using an air gap, which physically isolates a 

    11 computer or local network of computers from the Internet. (The name 

    12 comes from the literal gap of air between the computer and the Internet; 

    13 the word predates wireless networks.)

    14 

    15 But this is more complicated than it sounds, and requires explanation.

    16 

    17 Since we know that computers connected to the Internet are vulnerable to 

    18 outside hacking, an air gap should protect against those attacks. There 

    19 are a lot of systems that use -- or should use -- air gaps: classified 

    20 military networks, nuclear power plant controls, medical equipment, 

    21 avionics, and so on.

    22 

    23 Osama Bin Laden used one. I hope human rights organizations in 

    24 repressive countries are doing the same.

    25 

    26 Air gaps might be conceptually simple, but they're hard to maintain in 

    27 practice. The truth is that nobody wants a computer that never receives 

    28 files from the Internet and never sends files out into the Internet. 

    29 What they want is a computer that's not directly connected to the 

    30 Internet, albeit with some secure way of moving files on and off.

    31 

    32 But every time a file moves back or forth, there's the potential for attack.

    33 

    34 And air gaps *have* been breached. Stuxnet was a US and Israeli 

    35 military-grade piece of malware that attacked the Natanz nuclear plant 

    36 in Iran. It successfully jumped the air gap and penetrated the Natanz 

    37 network. Another piece of malware named agent.btz, probably Chinese in 

    38 origin, successfully jumped the air gap protecting US military networks.

    39 

    40 These attacks work by exploiting security vulnerabilities in the 

    41 removable media used to transfer files on and off the air-gapped computers.

    42 

    43 Since working with Snowden's NSA files, I have tried to maintain a 

    44 single air-gapped computer. It turned out to be harder than I expected, 

    45 and I have ten rules for anyone trying to do the same:

    46 

    47 1. When you set up your computer, connect it to the Internet as little 

    48 as possible. It's impossible to completely avoid connecting the computer 

    49 to the Internet, but try to configure it all at once and as anonymously 

    50 as possible. I purchased my computer off-the-shelf in a big box store, 

    51 then went to a friend's network and downloaded everything I needed in a 

    52 single session. (The ultra-paranoid way to do this is to buy two 

    53 identical computers, configure one using the above method, upload the 

    54 results to a cloud-based anti-virus checker, and transfer the results of 

    55 *that* to the air gap machine using a one-way process.)

    56 

    57 2. Install the minimum software set you need to do your job, and disable 

    58 all operating system services that you won't need. The less software you 

    59 install, the less an attacker has available to exploit. I downloaded and 

    60 installed OpenOffice, a PDF reader, a text editor, TrueCrypt, and 

    61 BleachBit. That's all. (No, I don't have any inside knowledge about 

    62 TrueCrypt, and there's a lot about it that makes me suspicious. But for 

    63 Windows full-disk encryption it's that, Microsoft's BitLocker, or 

    64 Symantec's PGPDisk -- and I am more worried about large US corporations 

    65 being pressured by the NSA than I am about TrueCrypt.)

    66 

    67 3. Once you have your computer configured, never directly connect it to 

    68 the Internet again. Consider physically disabling the wireless 

    69 capability, so it doesn't get turned on by accident.

    70 

    71 4. If you need to install new software, download it anonymously from a 

    72 random network, put it on some removable media, and then manually 

    73 transfer it to the air-gapped computer. This is by no means perfect, but 

    74 it's an attempt to make it harder for the attacker to target your computer.

    75 

    76 5. Turn off all autorun features. This should be standard practice for 

    77 all the computers you own, but it's especially important for an 

    78 air-gapped computer. Agent.btz used autorun to infect US military computers.

    79 

    80 6. Minimize the amount of executable code you move onto the air-gapped 

    81 computer. Text files are best. Microsoft Office files and PDFs are more 

    82 dangerous, since they might have embedded macros. Turn off all macro 

    83 capabilities you can on the air-gapped computer. Don't worry too much 

    84 about patching your system; in general, the risk of the executable code 

    85 is worse than the risk of not having your patches up to date. You're not 

    86 on the Internet, after all.

    87 

    88 7. Only use trusted media to move files on and off air-gapped computers. 

    89 A USB stick you purchase from a store is safer than one given to you by 

    90 someone you don't know -- or one you find in a parking lot.

    91 

    92 8. For file transfer, a writable optical disk (CD or DVD) is safer than 

    93 a USB stick. Malware can silently write data to a USB stick, but it 

    94 can't spin the CD-R up to 1000 rpm without your noticing. This means 

    95 that the malware can only write to the disk when you write to the disk. 

    96 You can also verify how much data has been written to the CD by 

    97 physically checking the back of it. If you've only written one file, but 

    98 it looks like three-quarters of the CD was burned, you have a problem. 

    99 Note: the first company to market a USB stick with a light that 

   100 indicates a write operation -- not read *or* write; I've got one of 

   101 those -- wins a prize.

   102 

   103 9. When moving files on and off your air-gapped computer, use the 

   104 absolute smallest storage device you can. And fill up the entire device 

   105 with random files. If an air-gapped computer is compromised, the malware 

   106 is going to try to sneak data off it using that media. While malware can 

   107 easily hide stolen files from you, it can't break the laws of physics. 

   108 So if you use a tiny transfer device, it can only steal a very small 

   109 amount of data at a time. If you use a large device, it can take that 

   110 much more. Business-card-sized mini-CDs can have capacity as low as 30 

   111 MB. I still see 1-GB USB sticks for sale.

   112 

   113 10. Consider encrypting everything you move on and off the air-gapped 

   114 computer. Sometimes you'll be moving public files and it won't matter, 

   115 but sometimes you won't be, and it will. And if you're using optical 

   116 media, those disks will be impossible to erase. Strong encryption solves 

   117 these problems. And don't forget to encrypt the computer as well; 

   118 whole-disk encryption is the best.

   119 

   120 One thing I didn't do, although it's worth considering, is use a 

   121 stateless operating system like Tails. You can configure Tails with a 

   122 persistent volume to save your data, but no operating system changes are 

   123 ever saved. Booting Tails from a read-only DVD -- you can keep your data 

   124 on an encrypted USB stick -- is even more secure. Of course, this is not 

   125 foolproof, but it greatly reduces the potential avenues for attack.

   126 

   127 Yes, all this is advice for the paranoid. And it's probably impossible 

   128 to enforce for any network more complicated than a single computer with 

   129 a single user. But if you're thinking about setting up an air-gapped 

   130 computer, you already believe that some very powerful attackers are 

   131 after you personally. If you're going to use an air gap, use it properly.

   132 

   133 Of course you can take things further. I have met people who have 

   134 physically removed the camera, microphone, and wireless capability 

   135 altogether. But that's too much paranoia for me right now.

   136 

   137 

   138 Yes, I am ignoring TEMPEST attacks.  I am also ignoring black bag 

   139 attacks against my home.

   140 

   141 My previous advice:

   142 https://www.schneier.com/essay-450.html

   143 

   144 Bin Laden had an air gap:

   145 https://www.schneier.com/blog/archives/2011/05/bin_laden_maint.html

   146 

   147 agent.btz:

   148 http://www.washingtonpost.com/national/national-security/cyber-intruder-sparks-response-debate/2011/12/06/gIQAxLuFgO_story.html 

   149 or http://tinyurl.com/cjqxphd

   150 

   151 TrueCrypt:

   152 http://www.truecrypt.org/

   153 

   154 BleachBit:

   155 http://bleachbit.sourceforge.net/

   156 

   157 People plugging in found USB drives:

   158 https://www.schneier.com/blog/archives/2012/07/dropped_usb_sti.html

   159 

   160 Tails:

   161 https://tails.boum.org/