Re:Cryptography May Not Be Dead, But It Is on Life Support
by MichaelGG on Tuesday January 21, 2014 @02:45PM
(#7097764)
I think the idea is to use simple physical media, like CDROM, where hiding a malicious payload is far more difficult since there's no embedded electronics on a disc.
If that's too cumbersome, one could always implement a simple teletype-like system with a low bitrate. Like an automatic machine that can physically press keys on a keyboard. Then remove every key except letters, numbers, shift and tab.
You could use a similar system or OCR to get data off the gapped machine.
Re:Cryptography May Not Be Dead, But It Is on Life Support
by pyre on Tuesday January 21, 2014 @05:23PM
(#7099001)
One could, but IIRC Schneier has mentioned using a USB drive (though it could all be a clever ruse to throw off the NSA ;-).
Re:Cryptography May Not Be Dead, But It Is on Life Support
by chris_mahan on Tuesday January 21, 2014 @02:11PM
(#7097503)
And he's probably high enough in the list of NSA "persons of interest" to warrant a field agent's time.
What if they swap Scheier's USB key (or drive) with one that will exploit the USB stack on his offline computer (disabling 'auto-mount' won't help you here)?
Yes, it's a physical access attack, but physical access to his person might be easier to achieve (while remaining unnoticed) than access to the offline computer.