Industry standard is not always truly followed by everyone as seen here. Still can't believe this sounds like something out of Mr. Robot

When I first saw the title I thought this was about extracting data from an air gapped network through some crazy thermometer enabled means. Truth seems to be much more mundane.

Curious.. are there any recorded instances of air gapped networks being breached?

Not totally sure of the details but the dropped flash drive hack seems popular

https://www.wired.com/2011/06/the-dropped-drive-hack/

http://articles.latimes.com/2006/apr/10/world/fg-disks10

Stuxnet

https://en.m.wikipedia.org/wiki/Stuxnet

It would be nice if at home routers made this easy to do too

You can get Home routers that setup VLAN. Ubiquiti Edge Routers will do almost anything you need to do.

I have one of those (but no Internet of Shit devices to segregate). Still, it's nice to know I can do so if I need to.

Unfortunately, all is not rainbows and unicorns. Ubiquiti's GUI doesn't treat IPv6 as a first-class citizen; if you want IPv6 you need to head for the CLI and hope you hit upon the right recipe to enable it for your provider - and make sure you set up your firewall rules to only open IPv6 addresses/ports you want open.

This is also a feature on Pfsense, or just about any high end router, switch, or firewall.

The article asserts, "It expands the attack surface and most of this isn't covered by traditional defenses", which is bogus. It's just another device that doesn't need to be on the same network as critical services.

Tomato makes this very easy. I've set up an "untrusted" network, devices in which can't connect anywhere, neither to local nor to remote machines (only I can connect to them).

My router, the Asus RT-N66U can have multiple Wi-Fi guest networks with the default firmware.

Didn't that Wired article about the Jeep hack tell us something about how well that sometimes gets implemented?

From memory, there was an "untrusted trusted entertainment system" network segment, and a firewall which allowed one-way traffic out of the "trusted" vehicle management network (so the entertainment system could get car speed and similar), and the firewall could have it's firmware updated. From the untrusted network segment...

The problem with the entertainment system hack is that the can bus used in vehicles uses a priority system that is designed so that higher priority device can always claim the bus. If I remember correctly the entertainment system hack moved up the priority of the entertainment system on the bus so that it was higher priority than whatever nominally controls the car. A can bus isn't robust against bad actors and should have been air gapped to any external connection.

Priority doubles as ID in most CAN systems, so changing the priority means you're no longer sending the message to the same endpoint. As you say, though, CAN isn't secure against someone with physical access to the bus.

IMO "the problem" isn't the CAN priority system, it's that a remotely programmable device (the CAN gateway) was connected to both the control network and the internet (via the entertainment center). For something so security critical, it should have been kept as dumb as a box of rocks, and certainly never made network-updatable.

That is an obvious and sound plan. It would be interesting to know how that broke down in this particular case.

Yep. With the usual sorts of regulations, a casino can lose its license and be shut down for screwing up this kind of security. Compared to other sorts of businesses, casino regulation is very strict. I'd love to know how it played out.

As someone who has used the web-based room reservation software for rewards members, I find this a bit hard to believe.

Uncanny the number of times I get precisely two downvotes.