How do we define "airgap" around here?

[philipma1957]

Another thing for the truly paranoid to worry about:

Data can be exfiltrated from a computer's screen. A surveillance van parked outside your home can reproduce the image on your screen by intercepting EMF radiation from your location. This might also be possible with keyboards, giving direct access to your keystrokes. So the only way to be truly airgapped is to use your device inside of a Faraday cage. Good luck, and stay safe.

Most users here do not have enough value to protect to justify building a big Faraday cage.   A lot of these attacks are nice theoretical proof of concepts, but there is nobody out there actually using them do accomplish something in practice. There are different possibilities, we could go on and bring out a few more research papers on what is theoretically possible.

However, if we consider what is actually realistic on the other hand, then why would someone bother with this when either a phishing attack or a wrench attack works much better? Pretty much every single non-anonymous forum user is completely exposed to both of them.

even an indirect 5 dollar wrench.  I.E. any loved one kidnapped till you send blank in btc to address blank.

[LoyceV]

As for air gapped.

Remove wifi
 remove bluetooth
Remove ethernet.

I finally did it! I found a laptop that wouldn't make me feel bad if I accidentally broke it in the process.

The ultimate paranoid airgapped offline laptop
Specs:

• Dual core 4W TDP Intel CPU, new enough to run 64 bit software
• 8 GB RAM
• SSD
• Working battery

Here's what I did:

• I installed a lightweight Linux distro, and used an ethernet cable to update all packages and install any additional packages I need.
• I encrypted the disk, and encrypted the user directory with a different password.
• I disabled the network drivers, so they won't start again on the next boot.
• I tested my offline USB laser printer, it detected it by default.
• From the BIOS, I set a disk password, admin password and user password.
• I removed the Wifi/Bluetooth card, and cut the cables inside the laptop so the metal connectors can't touch anything.
• I removed the speakers.
• I removed the webcam from the top of the screen. Based on the type number, the microphone should be inside the same module. It had one cable, which I cut inside the screen. I tried to strip the cable (to make sure it doesn't short circuit), but the textile outer layer made it impossible to get to the very thin individual strings. So I just cut it and hoped for the best. The connector on the motherboard is one large connector that includes the display cables, so I couldn't just remove it.

Here's what I didn't do:

• I did not remove the CPU fan (yet). It's a 4W CPU, so I think it'll be okay without a fan, but I didn't want to risk it (yet).
• I did not remove the USB and RJ-45 network connectors. I'm won't accidentally plug it in, and anyone else won't be able to boot from the encrypted disk. The USB ports I'll use for transferring data.

I put it back together, and it still worked!

But, the Input Volume Control showed it still picked up sound. Turns out there was another microphone close to the keyboard.

• I opened it up again, removed the motherboard, and found the microphone that's soldered on the bottom. I felt brave, got pliers, and twisted it off.

I put it back together, and it still worked!

I wasn't satisfied yet, as the RAM isn't soldered. My plan was to act as a completely paranoid person, so I assume the RAM can be removed in a cold boot attack. I opened it up again.

• I added Bison Kombi Power 2 component epoxy under the RAM, gluing it to the motherboard. I also added some more on top.

I put it back together, and it still works!

There are still a few things left to do:

• Write a script that turns off the laptop when the screen is locked for more than X minutes. That would limit the amount of time to carry out a physical attack when it's still running in locked state.
• Disable sleep mode/suspend, so that can't be used to have more physical access time.
• Disable USB ports, unless I manually turn them on in Linux. I've never done that, so I'll need to search how to do that.
  Or: disable auto-mount for inserted devices.
• Glue all parts of the casing together. I'm a bit hesitant to do that yet, as it will for sure be the last modification I can make to the hardware.

If this can be improved: please post!

[ABCbits]

• I encrypted the disk, and encrypted the user directory with a different password.

How do you encrypt the user directory? Do you create separate partition for /home or use one of software that perform actual directory level encryption?

If this can be improved: please post!

I have few suggestion,
1. Certain motherboard BIOS have option to partially of fully disable sleep/hibernation. Sometimes it's can be changed by limiting CPU state.
2. I'm not sure if it's actually possible, but consider adding whitelist of external device by modify udev rules or using software such as usbguard.

And if you or other reader use more powerful laptop, consider use Qubes OS instead.

[LoyceV]

How do you encrypt the user directory? Do you create separate partition for /home or use one of software that perform actual directory level encryption?

It encrypts only the user directory. Some distro's allow to do this from the GUI while creating a user, I used this:

Code:

sudo apt-get install -y ecryptfs-utils cryptsetup
sudo adduser --encrypt-home username

1. Certain motherboard BIOS have option to partially of fully disable sleep/hibernation. Sometimes it's can be changed by limiting CPU state.

I used a laptop with very limited BIOS, so that's not possible for me.

2. I'm not sure if it's actually possible, but consider adding whitelist of external device by modify udev rules or using software such as usbguard.

I've added "disable auto-mount" to my list, although I'd prefer to just disable the ports unless I enable them.

And if you or other reader use more powerful laptop, consider use Qubes OS instead.

For my purpose, I don't really need software isolation. If I'd ever run something I don't trust, I'd create a disk image first, and wipe the laptop afterwards.

[nc50lc]

Here's what I didn't do:

• I did not remove the CPU fan (yet). It's a 4W CPU, so I think it'll be okay without a fan, but I didn't want to risk it (yet).

Have you considered my suggested alternative of clipping the fan control pins instead of completely removing the fans?
That'll completely remove the MOBO's control over its speed for a malware to take advantage of.

You might not find a tutorial specific to your laptop's model but most of those laptops CPU fans have similar wirings.
If not sure (after reading some tutorials), you can test each wire on a same-volt DC power source to see which wires will power it on.

[LoyceV]

Have you considered my suggested alternative of clipping the fan control pins instead of completely removing the fans?

Nope. It barely turns on the fan, and I like it that way.

If not sure (after reading some tutorials), you can test each wire on a same-volt DC power source to see which wires will power it on.

It has only 2 cables, so the power is controlled by the motherboard. But I'm certain I'll remove the fan long before giving it constant voltage. That's why I like low-power laptops.

[vapourminer]

disconnect or cover/block any LEDs with black paint or something. no sense having blinky lights enabled to morse code out your keys or something.

[LoyceV]

disconnect or cover/block any LEDs with black paint or something. no sense having blinky lights enabled to morse code out your keys or something.

The charge and power LEDs are convenient to keep, but indeed, I'll look into removing the Caps Lock and other LEDs from the keyboard.
I checked, and this laptop doesn't have any other indicator LEDs. I don't think "power" or "charge" can be abused. But worse: if someone can see my LEDs, they can just as well read from my screen. Malware could choose a pixel to blink morse code. So LEDs are not on my list of concerns.

[nc50lc]

It has only 2 cables, so the power is controlled by the motherboard.

Dang, it's one of those types. Positive and neutral, then Mobo does the PWM.

At least using a wallet shouldn't heat up the CPU that requires active cooling, it should be safe to remove it if it doesn't even spin when you're testing your setup.
Deriving keys, calculating signatures, etc. shouldn't be too resource intensive.

[asUHWEceyc]

As for air gapped.

Remove wifi
 remove bluetooth
Remove ethernet.

I finally did it! I found a laptop that wouldn't make me feel bad if I accidentally broke it in the process.

The ultimate paranoid airgapped offline laptop
Specs:

• Dual core 4W TDP Intel CPU, new enough to run 64 bit software
• 8 GB RAM
• SSD
• Working battery

Here's what I did:

• I installed a lightweight Linux distro, and used an ethernet cable to update all packages and install any additional packages I need.
• I encrypted the disk, and encrypted the user directory with a different password.
• I disabled the network drivers, so they won't start again on the next boot.
• I tested my offline USB laser printer, it detected it by default.
• From the BIOS, I set a disk password, admin password and user password.
• I removed the Wifi/Bluetooth card, and cut the cables inside the laptop so the metal connectors can't touch anything.
• I removed the speakers.
• I removed the webcam from the top of the screen. Based on the type number, the microphone should be inside the same module. It had one cable, which I cut inside the screen. I tried to strip the cable (to make sure it doesn't short circuit), but the textile outer layer made it impossible to get to the very thin individual strings. So I just cut it and hoped for the best. The connector on the motherboard is one large connector that includes the display cables, so I couldn't just remove it.

Here's what I didn't do:

• I did not remove the CPU fan (yet). It's a 4W CPU, so I think it'll be okay without a fan, but I didn't want to risk it (yet).
• I did not remove the USB and RJ-45 network connectors. I'm won't accidentally plug it in, and anyone else won't be able to boot from the encrypted disk. The USB ports I'll use for transferring data.

I put it back together, and it still worked!

But, the Input Volume Control showed it still picked up sound. Turns out there was another microphone close to the keyboard.

• I opened it up again, removed the motherboard, and found the microphone that's soldered on the bottom. I felt brave, got pliers, and twisted it off.

I put it back together, and it still worked!

I wasn't satisfied yet, as the RAM isn't soldered. My plan was to act as a completely paranoid person, so I assume the RAM can be removed in a cold boot attack. I opened it up again.

• I added Bison Kombi Power 2 component epoxy under the RAM, gluing it to the motherboard. I also added some more on top.

I put it back together, and it still works!

There are still a few things left to do:

• Write a script that turns off the laptop when the screen is locked for more than X minutes. That would limit the amount of time to carry out a physical attack when it's still running in locked state.
• Disable sleep mode/suspend, so that can't be used to have more physical access time.
• Disable USB ports, unless I manually turn them on in Linux. I've never done that, so I'll need to search how to do that.
  Or: disable auto-mount for inserted devices.
• Glue all parts of the casing together. I'm a bit hesitant to do that yet, as it will for sure be the last modification I can make to the hardware.

If this can be improved: please post!

I like it. Still trusting the CPU, its firmware, various firmwares for other on-board components and peripherals (memory controller, keyboard, USB, graphics, touchpad, i2c, battery, battery charge controller, etc). Can the components store data or input? An insane person would set about extracting, reversing and replacing all firmware.

Will the CPU generate keys? Intel and AMD CPUs are officially backdoored via ME and PSP and other means (since ~2009). It wouldn't be surprising to learn that predictable CSPRNG bias exists on specific "modern" platforms for exploitation when used in combination with other novel entropy reduction methods (ie subtle backdoor insertion- see historical examples of ie NSA doing exactly this).

The current absence of evidence pointing to an upcoming Intel hardware wallet rugpull is that it's either a well-kept secret or nonexistent since keys generated circa 2008/09 on Windows XP are yet to be swept.

Finally, is there a way to permanently handcuff to the hardware?

[Satofan44]

Finally, is there a way to permanently handcuff to the hardware?

Every solution must start with the question: Who and what are you trying to defend against? What assumptions are you willing to make? Without that, most of these are vanity and pointless paranoia.

I like it. Still trusting the CPU, its firmware, various firmwares for other on-board components and peripherals (memory controller, keyboard, USB, graphics, touchpad, i2c, battery, battery charge controller, etc). Can the components store data or input? An insane person would set about extracting, reversing and replacing all firmware.

Will the CPU generate keys? Intel and AMD CPUs are officially backdoored via ME and PSP and other means (since ~2009). It wouldn't be surprising to learn that predictable CSPRNG bias exists on specific "modern" platforms for exploitation when used in combination with other novel entropy reduction methods (ie subtle backdoor insertion- see historical examples of ie NSA doing exactly this).

The current absence of evidence pointing to an upcoming Intel hardware wallet rugpull is that it's either a well-kept secret or nonexistent since keys generated circa 2008/09 on Windows XP are yet to be swept.

However, all of this is completely correct. Open hardware is a much harder challenge than open software, that is why many forum members that pretend to be experts here continue to ignore this topic since it goes beyond their heads. No amount of source software in the world can make up for the trust in the underlying hardware (and its backdoors) -- the CPU, firmware, controllers, and more. So continuing to be in a paranoid overkill frenzy with the top layers of the stack (software or hardware) is completely meaningless when the threat model includes trust assumptions at the lower layers.

Security should be reasonable, practical, and tailored to the value that it is protecting and the targets  it is protecting against. Otherwise you can spend an enormous amount of time trying to improve the setup to gain negligible security improvements, if any improvements at all -- depending on the threat model.

[LoyceV]

Still trusting the CPU, its firmware, various firmwares for other on-board components and peripherals (memory controller, keyboard, USB, graphics, touchpad, i2c, battery, battery charge controller, etc).

I've never seen a reason not to trust my CPU.

Can the components store data or input?

Even if they can: that's irrelevant on an offline air-gapped laptop.

An insane person would set about extracting, reversing and replacing all firmware.

Try to be realistic.

Will the CPU generate keys?

If that's your concern, use a coin or dice. This is my plan for my next seed phrase:

For my next seed phrase, I'm going to add my own entropy to Trezor's entropy. I'm not planning to do this any time soon, as it's going to be time-consuming to do safe (offline, on an air-gapped system running from RAM without storage, closed curtains and no recording devices phones nearby).
My (current) plan: get a new seed phrase from Trezor, convert it to binary:
1011011010101 etcetera.
Flip a coin 256 times:
0101101101010 etcetera.
Add the digits together:
1. 1+0=1
2. 0+1=1
3. 1+0=1
4. 1+1=0
5. 0+1=1
6. 0+1=1
7. 1+1=0
....
255. 1+1=0
256. 0+0=0
I'll create my new seed phrase from this. I'll use and compare different pieces of software to make sure both create the same seed phrase from the binary input.
This way, even if one of the random inputs is compromised, adding them together ensures it's still completely random.
Real random + flawed random = real random.
Real random + real random = real random.

Being paranoid doesn't mean they're not trying to get your coins!

Finally, is there a way to permanently handcuff to the hardware?

A permanent "nuclear football" on your wrist is the opposite of a low-profile system.