0

I'm trying to determine the feasibility of using a serial port/cable to act as a simple and cheap data diode. I'll be connecting 2 Windows PCs (1 of which is on a secured network) using a 1-way null modem serial cable. I have physically removed pin 2 (receive data) on a DB9 connector that connects to the serial port of the PC located on the secured network in hope that this will make it impossible for a hacker to gain access to the secured PC through the serial port of the unsecured PC.

I tested this setup using Hyperterminal on both PCs and it appears to be able to prevent data from being sent from the unsecured PC to the secured PC at least when using a common serial communication tool such as Hyperterminal.

However, I'm concerned whether it is possible to hack the Windows API to hijack pin 3 (TD), and use it to receive data instead. I've seen a few articles but this is not clear to me that this is possible. Has anyone attempted to do something similar?

https://arstechnica.com/civis/viewtopic.php?f=20&t=538972

Or should I use one-way fibre instead? I've also considered 1-way fibre but it appears to be even more complex, I've also never used fibre before, so I can't figure how it could be done using commonly available network cards and equipment - anyway it's for another topic.

  • What exactly is it you are trying to accomplish? Are you just trying to force one-way communication with no possibility of two-way communication? Are both devices considered untrusted (i.e. can they collaborate with each other to send data in the "forbidden" direction), or is only one of them untrusted? – forest Jul 3 '18 at 7:30
  • @forest Yes, I’m trying to force one-way communication from the trusted to the untrusted PC. Two way communication should not be possible. The data sent (some server metrics) is not confidential and need not be encrypted. Even though the trusted PC is suppose to be secure, ideally the design must be such that even internal hacking is not possible, so we should not be able to bypass the security programmatically. Operators are not allowed to bring in any media and electronic equipment, including cellphones into the secure area housing the trusted PC. – Joshua Jul 3 '18 at 10:30
  • 1
    If it is physically possible for pin 3 to be used to receive data, then a fully compromised operating system could indeed use it to receive data. – forest Jul 3 '18 at 10:33
  • @forest Yes, this is what I'm trying to find out. I would assume that the trusted system has to be compromised in order for pin 3 to be used to receive data from the untrusted system? If it's not possible for a malware on the untrusted system to remotely change pin 3 on the trusted system, then a breach would only be possible through an insider job? Am I correct? – Joshua Jul 3 '18 at 12:34
  • Why not build your own? – ThoriumBR Jul 3 '18 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.