<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html style="direction: ltr;">
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<style>body p { margin-bottom: 0cm; margin-top: 0pt; } </style>
</head>
<body style="direction: ltr;" bidimailui-charset-is-forced="true"
bidimailui-detected-decoding-type="latin-charset" text="#000000"
bgcolor="#ffffff">
On 24/06/11 00:35, Orna Agmon Ben-Yehuda wrote:
<blockquote
cite="mid:BANLkTimMZx4O9T=gqVX8o1SK1M31g_tdBw@mail.gmail.com"
type="cite">
<div dir="ltr">Hello all security experts,<br>
<br>
</div>
</blockquote>
Hiya,<br>
<br>
<blockquote
cite="mid:BANLkTimMZx4O9T=gqVX8o1SK1M31g_tdBw@mail.gmail.com"
type="cite">
<div dir="ltr">I would like to export data from a machine on a
business's internal network on a safe media, such that only the
files I want exported are on the media. Specifically, I consider
the possibility that the machine may already be infected by a
malware which adds business-sensitive data to all outgoing
media, and would like to defend against such a theoretical
malware. The question may be limited to text files.<br>
<br>
Things already considered:<br>
*The media is a CD, which will be written and then finalized. No
USB devices.<br>
*An artificial file will be added to the data file, to fill the
media as much as possible. This, however, leaves a part of the
disk capacity unused - the part used for the structure table
(what used to be FAT), which is a place where additional data
can hide.<br>
</div>
</blockquote>
Don't see how that helps.<br>
<blockquote
cite="mid:BANLkTimMZx4O9T=gqVX8o1SK1M31g_tdBw@mail.gmail.com"
type="cite">
<div dir="ltr">
*The CD will be read in two different machines, with two
different operating systems.</div>
</blockquote>
Try "copied". The CD will be burned on one machine. Only the
relevant files copied to another CD on a second machine, and again
on a third machine. If any of these machines are not infected then
only the information you think is there will actually be there.<br>
<blockquote
cite="mid:BANLkTimMZx4O9T=gqVX8o1SK1M31g_tdBw@mail.gmail.com"
type="cite">
<div dir="ltr"> One of the systems will be a bootable linux disk,
to preserve its (hopefully) initial not-infected status. The
listing of files will be performed including hidden files (ls
-la in Linux). The person who wrote the files will read them, to
verify they contain the correct information.<br>
</div>
</blockquote>
If you copy the files rather than only read the disc, this step
becomes, thankfully, unneeded.<br>
<br>
I think you mis-stated your security concerns, though. Assuming I
can guess the reason for this requirement, I think you will not be
able to satisfy yourself that the same unknown that has infected
your computer has not also infected the Linux image you are booting
from or the USB controller that does the actual writes. Depending on
your level of paranoia (and when it comes to such scenarios,
"paranoia" is the only conceivable description), I would suggest the
following:<br>
<br>
The only way to avoid going into a loop over what an infinite
resources theoretical attacker might do is to use a media that can
have no room for hitchhiking information. My suggestion - print it
out and OCR it on another machine. I seem to recall a distant story
about PGP writing a program that did OCR helping during the printing
(MD5 of the line, or something like that), but I doubt your paranoia
will not suspect that that very same program also puts in unwanted
information into that area.<br>
<br>
Of course, you might still claim that the virus will use one dot
errors (either black pixels where white ones should have been or
vice versa) in order to leak information out. Some careful math can
put a limit on just how much information can leak this way before
the dots themselves become noticeable, and hopefully we can prove
that not enough information can leak to pose a real risk (i.e. -
decide that the attacker can get all the information she wants that
can fit inside 10 bytes, and we can live with that).<br>
<br>
Shachar<br>
<br>
<blockquote
cite="mid:BANLkTimMZx4O9T=gqVX8o1SK1M31g_tdBw@mail.gmail.com"
type="cite">
<div dir="ltr">Questions:<br>
What else should I do?<br>
What about a malware compressing the data, using the extra space
for additional data?<br>
If I compress the data to avoid further compression, how can the
person verify it contains exactly what it should?<br>
What can I not defend against?<br>
Are such malware as I imagine known? For Linux? Windows?<br
clear="all">
<br>
Thanks for considering the problem,<br>
-- <br>
Orna Agmon Ben-Yehuda.<br>
<a moz-do-not-send="true" href="http://ladypine.org">http://ladypine.org</a><br>
</div>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
Linux-il mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Linux-il@cs.huji.ac.il">Linux-il@cs.huji.ac.il</a>
<a class="moz-txt-link-freetext" href="http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il">http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il</a>
</pre>
</blockquote>
<p><br>
</p>
<br>
<pre class="moz-signature" cols="72">--
Shachar Shemesh
Lingnu Open Source Consulting Ltd.
<a class="moz-txt-link-freetext" href="http://www.lingnu.com">http://www.lingnu.com</a>
</pre>
</body>
</html>