The Air Gap Myth

The BBC discusses here an interesting report from Chatham House on the vulnerability of worldwide nuclear energy plants to cyber attack.  The report says that although many facilities claim that they do not have direct Internet connections---an air gap---that some of them do in fact have Internet connections.  For example, a connection may have been installed for maintenance, then not uninstalled and forgotten.

But let's be clear---the notion of an air gap is a fantasy in the modern world. Even if no direct connection exists, indirect connections through storage devices is sufficient to allow hackers to attack a cyber-physical system. Sneakernet---moving data manually from machine to machine---has a long and storied tradition in computing.  (Rumor had it that while Sun promoted its Network File System on the outside, it relied on Sneakernet for internal data transfers.)  The Stuxnet attacks were initiated through data carried by maintenance workers on flash drives. Those flash drives were infected on outside machines, then carried inside the facility to help the workers with their tasks.  The UCSD team showed in its demonstrations of car hacking that the maintenance computers used by mechanics were vectors for attacking cars.

Cyber-physical systems cannot ensure a circle of trust merely by claiming that they are not connected to the Internet.   It is hard to imagine a safety-critical system that is not vulnerable to sneakernet attacks. We need to design safety-critical systems that monitor themselves during operation to watch for attacks.  Trust but verify...

Intel HDCP master key cracked

tomshardware.com reports here that the Intel HDCP master key has been cracked.  HDCP is a multimedia encryption standard.

Intel Automotive Security Review Board

Here is an article at tomshardware.com on Intel's new Automotive Security Review Board (ASRB).

Volkswagen Defeats Its Own Emissions Software

Here is an extremetech.com article on Volkswagen's efforts to disable its own emissions control software.

More on IoT Security

Extremetech posts here a nice summary piece on the state of IoT security.

Article on Embedded Multi-Core Performance/Power

Here is a great article from Anandtech with some experimental results on cell phone multicore architectures.  Their experiments show how many threads are at work in some typical cell phone scenarios and provide utilization and power results.

SIMON block cypher

Here is an interesting paper on a hardware design for the SIMON block cypher.  The paper comes from Patrick Schaumont's group at Virginia Tech.