I have recently been occupied with a question regarding IT security. Suppose there is an application on a PC that is connected to the Internet, but it does not have access to the Internet or support any other connection (such as Bluetooth or NFC).

Can an bug in this software be used from outside to gain access to the system?

Personally, I don't think that is possible because the application has no external interfaces. Is that right?


Directly? No. By your scenario's definition, the "bug" is local to the computer and not a matter of a bug in its networking or communications (because it doesn't have that function).

But if the computer is accessible by other means, then once access is gained, the bug can be exploited. That's why it is still very important to update applications even if they do not have network access.

It is a common scenario that an attacker gains partial network access to a computer through some bug in some other application or a misconfiguration, or by tricking the user to run malware. And while that access is limited, it grants access to another vulnerable local application that the attacker leverages to get deeper access, and depending on the bug, and in a worst-case scenario, full control over the computer.

|improve this answer|||||
  • Thanks, I think this is the perfect answer to my question. +1 for pointing out the importance to update applications even if the have no network access – OldTimeRambler Nov 21 '19 at 7:55

It is possible, but improbable as a bug.

  1. Hardware may have embedded tools that allow remote connection even without standard communications means to exist. Example: Intel Core vPro processors contain a “secret” 3G chip that allows remote disabling and backdoor access to any computer even when it is turned off. Statement from intel: "Sandy Bridge and future chips will have, "...the ability to remotely kill and restore a lost or stolen PC via 3G."

  2. A program may generate some sort of electrical noise/spikes that may be used to transmit data. Given that all computer systems today use switched power supplies, you can definitely control a PSU to generate different level of noise interference, which is more than sufficient for a data transmission to occur.

The 2 situations I mentioned are intentional. For an unintentional bug to trigger something like the above there's an extremely low probability. If a software was specifically designed to exfiltrate data, it can definitely do it by other than conventional means.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.