The air-gap system in question is a cryptocurrency vault system that is responsible for generating addresses and signing transactions while it keeps the sensitive information air-gapped.
[ Vault app ] <====[QR]====> [ Wallet app]
Data to protect: Private keys and similar sensitive string values stored in memory, on air-gapped system.
Vault's app architecture:
Once the vault app's OS is shutdown, the entire state of the OS is reset. This happens by ejecting of the bootable media once the OS boots itself and is ready to run completely from RAM. Only when there is no storage medium available, the vault app runs and keys are typed into the program. It has no storage media to write information to. And when powered off, the RAM contents fade away fast. So for a successful attack, the entire process must happen in the same boot cycle.
Communication:
Now the data that needs to be communicated with vault is infrequent and is essentially small JSON payloads, QR codes seem to be a valid medium to communicate between the air-gapped and hot (connected to internet) system. After decoding information in QR code, it will be presented to the user for confirmation before proceeding to act on it.
As far as the hot system goes, it could be a mobile or a desktop that can be assumed as infected. What are the attack vectors I need to consider in my approach?
Threat #1 - Remote Code Execution
Since the vault opens up the webcam feed to seek QR code, one possible vector attack that I can imagine is to trick the vault's webcam (system driver) to execute some arbitrary code. Either by showing a malicious QR code that I cover in next threat (#2) or by some other means (background? screen flickering to show data that's not easily caught by human eye?)
The screen and cameras are not kept continuously in line of sight, so I can imagine the bandwidth constraint to transfer data works in favor of keeping the security tight.
Threat #2 - Replacement of QR code with another QR code
- If a lot of data is being encoded in QR code, then visual inspection of QR code will give out a visual hint for the cautious user towards the fact that QR contain a lot more data than usual.
- If its a swap of recipient address to another address (essentially hijacking the crypto transaction) then that can be ruled out by manual confirmation required from user by vault app & the user gets a chance to inspecting details before indicating the approval for signing of transaction.
- If its not a JSON payload meant to be consumed by the vault app, and some other information, parsing that into JSON would fail and system can act accordingly. It could be meant to exploit an issue with how I decode QR code and parse that into JSON. Essentially the ability to execute some arbitrary code only, right?
And once a malicious program does reach the air-gapped system, it has no easy means of getting out, other than relying on the wallet app to scan QR code from vault app's screen.
I am aware of some proof of concept air-gap attacks, but I am setting this air-gapped vault app on a Raspberry Pi, so no networking hardware is available, no fans & no speakers.
Even if a model of Raspberry Pi which has networking hardware (WiFi & Bluetooth) was used, absence of the drivers would eliminate the possibility of leak of information, right? Though I understand its better to use the models that don't even have the networking hardware, but they are super hard to find. I was only able to find one for myself. Others wanting to have the same setup won't be in the same boat as me.
Would love to hear your thoughts on how secure this setup is :)