3

A common trope in cyberpunk fiction is the necessity of physical access to a networked machine in order to execute an attack--the brilliant hacker has to hire a team of meatspace criminals (or vice versa), and the whole team physically enters a secured location.

In current, real-world networks, what benefits would physical access to a networked machine provide a potential attacker?

How do these benefits compare to the risks associated with breaching physical security? For example's sake, let's say at a Tier II center (https://www.colocationamerica.com/data-center/tier-standards-overview.htm) in line with most or all of the security measures outlined in this article.

Finally, are there any network security measures in use today which can effectively prevent remote access by an attacker? Specifically, I'm looking for measures with 1) proven effectiveness, that 2) could be most easily circumvented with physical access to a network machine.

4
  • Physical access makes the ports and drives avaliable. You can plug in rogue usb devices or cds and with access to the power you can force a reboot and potentially boot from a device if your choice. You could also theoretically add a device to capture network traffic.
    – iainpb
    May 9 '17 at 21:06
  • Please provide a definition or example of a data center you consider to be "average". There is no such thing that each and every person could agree upon, as each user has different experience and knowledge. "Average" in this sense is very arbitrary and makes your second question unanswerable.
    – 0xSheepdog
    May 10 '17 at 0:22
  • "...are there any network security measures in use today which can effectively prevent..." Uhm, yes. There is literally an entire industry based upon the practices, protocols, controls, and behaviors that work to prevent unauthorized remote access, among many other threats. Can you be a bit more precise in what you are asking for?
    – 0xSheepdog
    May 10 '17 at 0:25
  • 1
    I've added some detail to the second and third points @0xSheepdog
    – KidDublin
    May 10 '17 at 13:33
2

In current, real-world networks, what benefits would physical access to a networked machine provide a potential attacker?

The most obvious example is an 'air gapped' network that is not connected to the internet - there was a real-life example of this in stuxnet where the target facility had no external networking. To physically access the network, the attackers dropped USB drives containing the worm around the facility that facility employees found, picked up, and plugged in, accidentally releasing the worm into their internal network.

You may also frequently hear the term "m&m network" or "m&m security". These terms refer to a network with a hard 'outer shell' and a soft 'chocolate center' - networks that have strong perimeter security but no security features (encryption, authentication, etc) between services or hosts in their network. Physical access to one of these networks can help bypass the hard outer shell.

How do these benefits compare to the risks associated with breaching physical security at, say, an average data center?

Like other risk questions, this depends on risk/reward. If all you need to do is drop some USB drives near the target network there is low risk. I've been in a few data centers and they all have substantial security - unauthorized physical access is highly unlikely, and employees have been trained against common social engineering tricks and won't disclose information or plug in USB devices. Suffice to say that 99.999% of the time you can be assured that nobody will have unauthorized physical access to the datacenter.

Finally, are there any network security measures in use today which can effectively prevent remote access by an attacker?

This is too broadly scoped to fully answer, but a good example is the airgapping we discussed before: disconnecting your network from the public internet to prevent anyone remote from even seeing your network. Of course this has the drawback of preventing your network from talking to any other networks or the internet.

1

In current, real-world networks, what benefits would physical access to a networked machine provide a potential attacker?

One immediate benefit is physical sabotage of the machine itself. Although this is highly unlikely to be successful without being detected, it is an added benefit of physical access nevertheless. Another benefit would be information gathering. By observing the machine setup and its physical environment, an attacker can gain further information to plan for future, more serious attacks.

How do these benefits compare to the risks associated with breaching physical security at, say, an average data center?

The answer depends greatly on the motivation of the attacker. Without more information, it is hard to answer more definitively.

Finally, are there any network security measures in use today which can effectively prevent remote access by an attacker?

Yes and TACACS+ is an example. The client, (ex: firewall) , queries authentication server and server replies to client with a response indicating whether user requesting access should be granted access. By having tight access control around the central authentication server, it is possible to effectively control malicious remote access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.