Quote from: markjenkins on August 03, 2014, 02:07:55 AM

You only need to worry about the USB side of the signing machine. On reflection, that Wired article may have over-hyped the dangers. USB devices can't just arbitrarily read/write any system memory can they? I think a malicious USB device has to be more sneaky.

I'm not worried at the moment.

- USB has no evelated rights per se. Whatever you stick in, runs with user rights. No matter if legit or fake keyboard or cam or flash. Only with holes in the USB stack itself this isn't true any more, but then that's a whole different problem.

- Firewire, pcmcia-cards, pci* and the like have *real* access. Like, a firewire device can read and manipulate all content in RAM without asking the OS or the CPU or them even noticing. I deactivated Firewire years ago in bios.

- Every USB device needs a custom evil firmware. There never will be malware which can just infect all USB devices it can get hold of. Many devices will be "immune" because their firmware can't be rewritten reasonably, or because the firmware flash memory is already full with the original firmware, no space for evil enhancements. At worst, malware might know and try to re-flash a few of the most common devices. All "sandisk" drives for example. This probably will kill more devices than turn them evil.

- We are, hopefully, not connecting random USB devices to our airgapped system. My initial plan was one USB stick, going back and forth from online to offline system. So *exactly this* device would have to be reflashed, and then this evil device must somehow gain control of the offline system.

- There are "USB switcher" thingies. Connect two computers and one device, and you can switch that device back and forth between those computers. Via button or software. I don't think someone could reflash a USB stick which isn't connected to my (infected online) computer when there is that "USB switcher" in between. Not 100% sure of course.

The bottom line is that we need to get data back and forth between the online and offline system. So it's not *offline* in the strict sense.
Because of how Bitcoin, Armory and transactions work, we can't predict how much data there will need to be transferred, and that data isn't human-readable to check directly.
So, no matter how clever the setup, in the end the user can only tell that, and how much data there is transmitted, and in what direction.

And that's why now, scrapping my initial USB and "USB-switcher" plan, I like that "red and green blinking serial cable" idea.

Ente