Suppose I have a Windows PC in a safe room, disconnected from the internet, with only 3 cables connecting to another room, to a mouse, monitor and keyboard.
The computer contains highly sensitive data. The HDMI monitor cable is no problem, but the mouse and keyboard cables are USB cables, and co...
@Stephane One could cut the cable, and solder some USB port. Also, this is supposed to be admin-proof. As I said, please disregard other ways of stealing information.
@Stephane I would like some hardware I could put inside the computer room (thus inaccessible to the users) that would not allow any device except a specific mouse or a specific keyboard to connect to it.
Why not a motion camera installed in your 'safe room' that is connected to the Internet that automatically alerts you of any physical intrusion into the room. The PC is still disconnected to the Internet as you say.
Use a regular PS2 mouse/keyboard? They're rare, not impossible to find. Pretty much all motherboards still support them, and I wouldn't be surprised if you found expansion slot cards for one...
@HorusKol Sure, but then there is latency. The specific application demands virtually zero latency. And in fact, there is no remote terminal, since I'm talking about isolated computers.
To clarify again: The users and admin have NO ACCESS to the safe room. There is no risk of invasion of the safe room. There are only 3 cables leaving the safe room (mouse, keyboard and video). Cable could be cut only outside of the safe room.
@MarcG Is this a thought experiment, or are you actually seeking a solution to implement? As for a real world implementation, The best solution has already been proposed: connecting to a remote machine to which only keyboard and mouse commands are forwarded. Input lag is measured in the millisecond range, which is imperceptible to a human user (reaction time in the 100's of ms). as for theory, others have also discussed providing of custom usb firmware, and the possibility (and headache) of blocking external devices that way.
giving access to hdmi is arguably worse still, because of ethernet over hdmi capability. From this standpoint, you shouldn't give access to any untrusted party to any piece of copper that is in electric contact with your computer at all.. (from a theoretic standpoint, attacks have even been carried out by undervolting or generally playing around with supply power, though this is generally more of a concern with embedded systems that use slower clock speeds (google "glitch attack"))
What is your threat model? Are you looking for solutions which will stop an average admin who can buy hardware at Best Buy? Or are you looking to stop an exceedingly clever admin who has the complete financial and technological backing of a large nation-state?
@Aaron It's no thought experiment. Regarding lag, I have tested mouse through KVM switches, and more than 100 ms is too much lag. Time for information to reach your brain is 80ms.
"I know there is software to do that but since the user is using the computer he could disable it." - so make them log in as low privilege users who can't disable it?
@Aaron, I am researching this: "We’ve already mentioned that not all HDMI cables provide Ethernet capability. So while an older HDMI cable should work fine if you connect it to an Ethernet-over-HDMI capable device, it won’t automatically give you an Internet signal. You need an HDMI cable that has Ethernet built into it, in order to get your system online. That means there are really four categories of HDMI cables on the market: standard, standard with Ethernet, high-speed, and high-speed with Ethernet."
@MarcG KVM switches likely don't put an emphasis on speed and I don't have experience with them. RDP with a dedicated lan connection should be in the 5-20 ms range. (professional csgo players play for hundreds of thounds of dollars with as much as 30ms ping time)
Giving potential attackers access to a desktop is a bad idea anyway.. There are so many more attack vectors than if you served a database of this information and users only got access to what they need. If properly implemented, user authentication and minimum required privileges is a much smaller surface area of attack.
@Aaron Ethernet over HDMI (HDMI Ethernet Channel) was never actually implemented by anything. No video card supports it, so even if you could find or make something that implemented on the monitor end, it wouldn't have anything on the other end to connect to. A slightly more practical attack vector would be to try to use the HDMI DDC channel to cause a buffer overrun in the display driver or Windows.
I'm confused, if the machine is in an inaccessible room, with the keyboard and mouse in another room, and your threat actor is an "average admin" with the resources of Best Buy who wants to steal data, where's the threat? Cutting the keyboard cable and splicing in new wires? Aren't you exceeding your threat actor's abilities?
I have the same question as @schroeder ... if the mouse and keyboard are in the open room, and the cables go through the wall to the secure room, how the hell is the user in the open room going to attach something to the usb ports in the closed room? Does the keyboard or mouse have a USB A port on them to attach more devices? This question does not make much sense, or you have not given us a clear picture of the situation/setting.
@schroeder So yes, cutting the keyboard cable and splicing in new wires, for the sake of argument. Suppose we don't actually control whatever happens outside of the safe room.
If you don't control what happens outside of the safe room, but you let physical peripherals outside of the safe room directly attach to the system, then your physical security is FAIL. There are a number of solutions that allow virtual remote console connectivity to a system that only pass keystrokes and pointer movements to the physical system.
Surround your glued-on USB cables with a tube of acid to discourage cutting them. For more danger, have 2 chemicals, one outside the USB and one inside, that explode on contact with each other if the cable is cut. Or less dangerous, build all items into a table so that the wires are not accessible, maybe use touchscreen.
@TessellatingHeckler Obviously all attack vectors are important, including photos, HDMI vulnerabilities etc. I say disregard because I wanted to discuss only this specific USB problem in this question. But if you want to discuss all possible vulnerabilities, go on. I don't mind. I already learned what I wanted from this question.
Discussion on question by MarcG: Allo…
Discussion on question by MarcG: Allo…