7

It is often suggested, for air-gapped PC's, to use CD/DVD's as a transfer medium between machines instead of USB sticks or portable hard-drives as it is difficult to write data to a CD/DVD without the user noticing.

I am wondering if there are any known attacks against this type of scenario? I'm not sure its possible but i'd be interested to see if there's been any research into such attacks. Schneier's article (linked above) seems to suggest it is possible by saying:

If you've only written one file, but it looks like three-quarters of the CD was burned, you have a problem.

Is it possible to write data (even a small amount) to a CD/DVD that wouldn't, under normal circumstances be read/recognized by the operating system but could potentially be accessed by malware?

Improve this question

1 Answer 1

Reset to default
7

It is totally feasible to write appreciable amounts of data in a "covert" fashion under these conditions. What is written on the disc is a filesystem: a sequence of bytes which encodes a number of files and directories. There are two main places where covert data would be hidden:

  1. In the "holes" in the filesystem. In particular, files will use an integral number of sectors (2048 bytes on a CD), so if a file length is not a multiple of 2048 then there is some "padding" at the end, i.e. bytes which the OS will simply ignored as long as it reads the data as files. But reading the CD as a "raw device" will allow access to these bytes. Note that filesystems meant to allow read-write operations (e.g. UDF, as opposed to ISO9660), there are bigger holes which an be used as well.

  2. Beyond the filesystem. A filesystem begins with a header which specifies a number of things about it, in particular its total size. But on the disc, there may be extra bytes afterwards, which are readable by accessing the "raw device", but ignored by the OS for all filesystem-related accesses. You can easily sneak up megabytes of data there.

The two methods above are generic to any storage device with a filesystem, so it applies to USB flash drives as well. There are other methods which depend on the actual device; for instance, on a CD, you can have multiple sessions with multiple tracks in each of them, allowing you to play a lot of sneaky games (and this has been used at times as basic protections against copying).

Improve this answer
1
  • 1. Are there any publicly-known cases of malware modifying a CD burning process on an air-gapped computer to exfiltrate data? 2. Are there any publicly-known cases of malware infecting an air-gapped linux machine via an inserted burned CD if the person inserting the CD did not take explicit actions to execute a file on the CD? (My thoughts on the Scheiner article are that he is saying that for the average person who can't afford expensive purpose-built hardware (such as probably used by the miliary) that burned CDs are the most secure (though not foolproof) option.
    – Ralph P
    May 23, 2016 at 0:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .