| 词条 | Air gap (networking) |
| 释义 |
An air gap, air wall or air gapping[1] is a network security measure employed on one or more computers to ensure that a secure computer network is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network.[2] It means a computer or network has no network interfaces connected to other networks,[3][4] with a physical or conceptual air gap, analogous to the air gap used in plumbing to maintain water quality. Use in classified settingsAn "air-gapped" computer or network is one that has no network interfaces, either wired or wireless, connected to outside networks.[3][4] Many computers, even when they are not plugged into a wired network, have a wireless network interface controller (WiFi) and are connected to nearby wireless networks to access the Internet and update software. This represents a security vulnerability, so air-gapped computers either have their wireless interface controller permanently disabled or physically removed. To move data between the outside world and the air-gapped system, it is necessary to write data to a physical medium such as a thumbdrive, and physically move it between computers. Physical access is easier to control than an electronic network interface, which can be attacked at any time from the exterior insecure system, and if malware infects the secure system can be used to export secure data. In environments where networks or devices are rated to handle different levels of classified information, the two disconnected devices or networks are referred to as "low side" and "high side", "low" being unclassified and "high" referring to classified, or classified at a higher level. This is also occasionally referred to as "red" (classified) and "black" (unclassified). Access policies are often based on the Bell–LaPadula confidentiality model, where data can be moved low-to-high with minimal security measures, while high-to-low requires much more stringent procedures to ensure protection of the data at a higher level of classification. The concept represents nearly the maximum protection one network can have from another (save turning the device off). The only way to transfer data between the outside world and the air-gapped system is to copy data on a removable storage medium such as a removable disk or USB flash drive and physically carry the storage to the other system. This access can be more easily controlled. The upside to this is that such a network can generally be regarded as a closed system (in terms of information, signals, and emissions security), unable to be accessed from the outside world. The downside is that transferring information (from the outside world) to be analyzed by computers on the secure network is extraordinarily labor-intensive, often involving human security analysis of prospective programs or data to be entered onto air-gapped networks and possibly even human manual re-entry of the data following security analysis.[5] Computer viruses such as Stuxnet[6] and agent.btz have been known to bridge the gap by exploiting security holes related to the handling of removable media. The possibility of using acoustic communication has also been demonstrated by researchers.[7] Researchers have also demonstrated the feasibility of data exfiltration using FM frequency signals.[8][9]ExamplesExamples of the types of networks or systems that may be air gapped include:
Many of these systems have since added features that connect them to the public internet, and are no longer effectively air gapped, including thermostats with internet connections and automobiles, with Bluetooth, Wi-Fi and cellular phone connectivity. LimitationsLimitations imposed on devices used in these environments may include a ban on wireless connections to or from the secure network, or similar restrictions on EM leakage from the secure network through the use of TEMPEST or a Faraday cage. Further, scientists in 2013 demonstrated the viability of air gap malware designed to defeat air gap isolation using acoustic signaling.[14] Shortly after that, network security researcher Dragos Ruiu's BadBIOS received press attention.[15] In 2014, researchers introduced "AirHopper", a bifurcated attack pattern showing the feasibility of data exfiltration from an isolated computer to a nearby mobile phone, using FM frequency signals.[8][9] In 2015, BitWhisper, a covert signaling channel between air-gapped computers using thermal manipulations was introduced. BitWhisper supports bidirectional communication and requires no additional dedicated peripheral hardware.[16][17] Later in 2015, researchers introduced GSMem, a method for exfiltrating data from air-gapped computers over cellular frequencies. The transmission - generated by a standard internal bus - renders the computer into a small cellular transmitter antenna.[18][19] ProjectSauron malware discovered in 2016 demonstrates how an infected USB device can be used to remotely leak data off of an air-gapped computer. The malware remained undetected for 5 years and relied on hidden partitions on a USB drive not visible to Windows as a transport channel between the air-gapped computer and a computer connected to the internet, presumably as a way to share files between the two systems.[20]NFCdrip was the name given to the discovery of stealthy data exfiltration through NFC (Near-field communication) radio abuse and signal detection in 2018. Although NFC enables devices to establish effective communication by bringing them within a few centimeters of each other,[21] researchers showed that it can be abused to transmit information at a much longer range than expected - up to 100 meters.[22]In general, malware can exploit various hardware combinations to leak sensitive information from air-gapped systems using "air-gap covert channels".[23] These hardware combinations use a number of different mediums to bridge the air-gap, including: acoustic, light, seismic, magnetic, thermal, and radio-frequency.[24][25] See also
References1. ^Whatis.com: Air gapping 2. ^{{IETF RFC|4949}} 3. ^1 {{cite web | last = Zetter | first = Kim | title = Hacker Lexicon: What is an air gap? | work = Wired magazine website | publisher = Conde Nast | date = 8 December 2014 | url = https://www.wired.com/2014/12/hacker-lexicon-air-gap/ | format = | doi = | accessdate = 21 January 2019}} 4. ^1 {{cite book | last1 = Bryant | first1 = William D. | title = International Conflict and Cyberspace Superiority: Theory and Practice | publisher = Routledge | date = 2015 | pages = 107 | url = https://books.google.com/books?id=LJ9GCgAAQBAJ&pg=PA107&dq=%22air+gapped%22 | doi = | id = | isbn = 1317420381 }} 5. ^{{cite web|url=http://www.zdnet.com/news/nsa-attempting-to-design-crack-proof-computer/114035|title=NSA attempting to design crack-proof computer|last=Lemos|first=Robert|date=2001-02-01|work=ZDNet News|publisher=CBS Interactive, Inc.|accessdate=2012-10-12|quote=For example, top-secret data might be kept on a different computer than data classified merely as sensitive material. Sometimes, for a worker to access information, up to six different computers can be on a single desk. That type of security is called, in typical intelligence community jargon, an air gap.}} 6. ^{{cite news|url=http://news.cnet.com/8301-13772_3-57413329-52/stuxnet-delivered-to-iranian-nuclear-plant-on-thumb-drive/|title=Stuxnet delivered to Iranian nuclear plant on thumb drive|newspaper=CNET|date=12 April 2012}} 7. ^{{cite journal |last=Hanspach |first=Michael |last2=Goetz |first2=Michael |date=November 2013 |title=On Covert Acoustical Mesh Networks in Air |url=http://www.jocm.us/index.php?m=content&c=index&a=show&catid=124&id=600 |journal=Journal of Communications |publisher=Engineering and Technology Publishing |volume=8 |issue=11 |pages=758–767 |doi=10.12720/jcm.8.11.758-767 |accessdate=22 November 2013|arxiv=1406.1213 }} 8. ^1 {{cite arXiv |title=AirHopper: Bridging the Air-Gap between Isolated Networks and Mobile Phones using Radio Frequencies |first1=Mordechai|last1=Guri |first2=Gabi|last2=Kedma |first3=Assaf|last3=Kachlon |first4=Yuval|last4=Elovici |date=November 2014 |arxiv=1411.0237}} 9. ^1 {{cite web |title=How to leak sensitive data from an isolated computer (air-gap) to a near by mobile phone - AirHopper |first1=Mordechai|last1=Guri |first2=Gabi|last2=Kedma |first3=Assaf|last3=Kachlon |first4=Yuval|last4=Elovici |date=November 2014 |journal=BGU Cyber Security Labs |url=http://cyber.bgu.ac.il/content/how-leak-sensitive-data-isolated-computer-air-gap-near-mobile-phone-airhopper}} 10. ^{{cite web|url=http://www.infoworld.com/article/2655459/networking/hack-tales--air-gap-networking-for-the-price-of-a-pair-of-sneakers.html|title=Hack Tales: Air-gap networking for the price of a pair of sneakers|last=Rist|first=Oliver|date=2006-05-29|work=Infoworld|publisher=IDG Network|accessdate=2009-01-16|quote=In high-security situations, various forms of data often must be kept off production networks, due to possible contamination from nonsecure resources — such as, say, the Internet. So IT admins must build enclosed systems to house that data — stand-alone servers, for example, or small networks of servers that aren't connected to anything but one another. There's nothing but air between these and other networks, hence the term air gap, and transferring data between them is done the old-fashioned way: moving disks back and forth by hand, via 'sneakernet'.}} 11. ^{{cite web|title=Weber vs SEC|url=http://www.insurancenewsnet.com/images/post/112612_Weber_complaint.pdf|publisher=insurancenewsnet.com|page=35|date=2012-11-15|quote=Stock exchange internal network computer systems are so sensitive that they are “air gapped” and not attached to the internet, in order to protect them from attack, intrusion, or other malicious acts by third party adversaries.}} 12. ^{{cite web|title=Weber vs SEC|url=http://www.insurancenewsnet.com/images/post/112612|quote=Industrial internal network computer systems are so sensitive that they are “air gapped” and neither attached to the internet nor insecurely connects to the corporate network, in order to protect them from attack, intrusion, or other malicious acts by third party adversaries.}} 13. ^{{cite web|url=https://www.wired.com/politics/security/news/2008/01/dreamliner_security|title=FAA: Boeing's New 787 May Be Vulnerable to Hacker Attack|last=Zetter|first=Kim|date=2008-01-04|work=Wired Magazine|publisher=CondéNet, Inc.|accessdate=2009-01-16|quote=(...Boeing...) wouldn't go into detail about how (...it...) is tackling the issue but says it is employing a combination of solutions that involves some physical separation of the networks, known as air gaps, and software firewalls.| archiveurl= https://web.archive.org/web/20081223151833/http://www.wired.com/politics/security/news/2008/01/dreamliner_security| archivedate= 23 December 2008 | deadurl= no}} 14. ^{{cite journal |title=On Covert Acoustical Mesh Networks in Air |first1=Michael|last1=Hanspach |first2=Michael|last2=Goetz |date=November 2013 |journal=Journal of Communications |doi=10.12720/jcm.8.11.758-767 |volume=8 |pages=758–767}} 15. ^{{cite news|last1=Leyden|first1=John|title=Hear that? It's the sound of BadBIOS wannabe chatting over air gaps|url=https://www.theregister.co.uk/2013/12/05/airgap_chatting_malware/|accessdate=30 December 2014|date=5 Dec 2013}} 16. ^{{cite arXiv |title=BitWhisper: Covert Signaling Channel between Air-Gapped Computers using Thermal Manipulations |first1=Mordechai|last1=Guri |first2=Matan|last2=Monitz |first3=Yisroel|last3=Mirski |first4=Yuval|last4=Elovici |date=April 2015 |arxiv=1503.07919}} 17. ^{{cite web |title=BitWhisper: The Heat is on the Air-Gap |first1=Mordechai|last1=Guri |first2=Matan|last2=Monitz |first3=Yisroel|last3=Mirski |first4=Yuval|last4=Elovici |date=March 2015 |journal=BGU Cyber Security Labs |url=http://cyber.bgu.ac.il/blog/bitwhisper-heat-air-gap}} 18. ^{{cite web |title=GSMem: Data Exfiltration from Air-Gapped Computers over GSM Frequencies |first1=Mordechai|last1=Guri |first2=Assaf|last2=Kachlon |first3=Ofer|last3=Hasson |first4=Gabi|last4=Kedma |first5=Yisroel|last5=Mirsky |first6=Yuval|last6=Elovici |date=August 2015 |journal=24th USENIX Security Symposium (USENIX Security 15) |url=http://blogs.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/guri}} 19. ^{{cite web |title=GSMem Breaking The Air-Gap |first1=Mordechai|last1=Guri |first2=Assaf|last2=Kachlon |first3=Ofer|last3=Hasson |first4=Gabi|last4=Kedma |first5=Yisroel|last5=Mirsky |first6=Matan|last6=Monitz |first7=Yuval|last7=Elovici |date=July 2015 |journal=Cyber Security Labs @ Ben Gurion University |url=https://www.youtube.com/watch?v=RChj7Mg3rC4}} 20. ^{{cite news |url=https://www.bbc.com/news/technology-37021957 |title='Project Sauron' malware hidden for five years |publisher=BBC |author=Chris Baraniuk |date=2016-08-09}} 21. ^{{cite web |url=http://www.techradar.com/news/phone-and-communications/what-is-nfc-and-why-is-it-in-your-phone-948410 |title=What is NFC? Everything you need to know |newspaper=Techradar.com |date= |author=Cameron Faulkner |accessdate= 30 November 2015}} 22. ^{{cite web |title=NFCdrip: NFC Data Exfiltration Research |url=http://www.NFCdrip.com |publisher=Checkmarx |accessdate=19 December 2018 |language=English}} 23. ^Carrara, Brent (September 2016). “Air-Gap Covert Channels.” Ph. D. Thesis. University of Ottawa. 24. ^{{Cite journal|last=Carrara|first=Brent|last2=Adams|first2=Carlisle|date=2016-01-01|title=A Survey and Taxonomy Aimed at the Detection and Measurement of Covert Channels|url=http://doi.acm.org/10.1145/2909827.2930800|journal=Proceedings of the 4th ACM Workshop on Information Hiding and Multimedia Security|series=IH&MMSec '16|location=New York, NY, USA|publisher=ACM|pages=115–126|doi=10.1145/2909827.2930800|isbn=9781450342902}} 25. ^{{Cite journal|last=Carrara|first=Brent|last2=Adams|first2=Carlisle|date=2016-06-01|title=Out-of-Band Covert Channels—A Survey|url=http://doi.acm.org/10.1145/2938370|journal=ACM Comput. Surv.|volume=49|issue=2|pages=23:1–23:36|doi=10.1145/2938370|issn=0360-0300}} 2 : Network architecture|Data security |
| 随便看 |
开放百科全书收录14589846条英语、德语、日语等多语种百科知识，基本涵盖了大多数领域的百科知识，是一部内容自由、开放的电子版国际百科全书。