Ask Slashdot: How Do You Best Protect Client Files From Wireless Hacking?

dryriver writes: A client has given you confidential digital files containing a design for a not-yet-public consumer product. You need to work on those files on a Windows 10 PC that has a wireless chipset built into it. What can you do, assuming that you have to work under Windows 10, that would make 3rd party wireless access to this PC difficult or impossible? I can imagine that under a more transparent, open-source, power-user OS like Linux, it would be a piece of cake to kill all wireless access completely and reliably even if the system contains wireless hardware. But what about a I-like-to-phone-home-sometimes, non open-source OS like Windows 10 that is nowhere near as open and transparent? Is there a good strategy for making outside wireless access to a Windows 10 machine difficult or impossible?

Comments

Don't use wireless

[Anonymous Coward]

First post

move the PC

[turkeydance]

to an area without any possibility of a signal.

Re:move the PC

[fahrbot-bot]

to an area without any possibility of a signal.

Like Green Bank, WV:

Green Bank is located within the National Radio Quiet Zone, which means that radio transmissions are heavily restricted by law.

Virtualization

[hcs_$reboot]

Make a Linux partition via VirtualBox (...), put the encrypted data there through ssh / rsync, encrypt it and keep it encrypted when on disk.

Re:Virtualization

[TWX]

I was thinking about recommending something like this but realized that Windows 10 might be a prerequisite because of some application needed to work with the files. That would then mean finding a way to provide the host OS access to the guest OS's filesystem in order to access those files.

I would be much more inclined to run Windows as a VM on a Linux box as the host OS, and to restrict stuff before Windows ever boots up.

Re:Virtualization

[whoever57]

So do it the other way round. Have the host run Linux and run the application in a Windows VM that doesn't have access to the wireless device.

Re:Virtualization

[scdeimos]

I was going to suggest VirtualBox as well.

I routinely install Windows into VirtualBox guests that have no virtual LAN adapters configured (i.e.: no network access). The guests can only access: inserted optical discs and/or .iso files; authorized USB sticks; persistent/non-persistent VirtualBox shares.

The big downside, though, is accelerated graphics:

• You pay a significant penalty for DirectX under VirtualBox.
• The video drivers installed with VirtualBox Guest Additions have OpenGL support limited to API Level 2.1, so you can't run anything that requires OpenGL 3 or better.
• The VBGA OpenGL driver implementation is also really quite flakey. e.g.: Blender won't work with it, but can be made to work if you download the OpenGL Software Driver from the Blender FTP site. Of course this horribly slow because, you know, no hardware acceleration.
• Also the VBGA OpenGL drivers are disabled by default for Windows 8 or later guests. You can enable them by running the Guest Additions installer from the command line with switches and/or Registry hacks.

Re:Virtualization

[AntiSol]

Yep, you run win10 in virtualbox on a linux host. You can then disable networking completely or use iptables to restrict access to only the things you need:

(copy-pasted from a thing I wrote a while back)

How to make a Windows 10 VM secure with a Linux host

Simple! Restrict all intarwebs access to everything that you don’t absolutely need:

1. run virtualbox with the vboxusers group:

sudo -g vboxusers virtualbox

2. allow access to the site you want:

sudo iptables -A OUTPUT -m owner --gid-owner vboxusers -d [ip address] -j ACCEPT

3. block everything else:

sudo iptables -A OUTPUT -m owner --gid-owner vboxusers -j DROP

4. In windows you’ll need to edit c:\windows\system32\drivers\etc\hosts to add an entry for the sites you want, since DNS won’t work. Or you could
look at allowing DNS with more iptables rules. But I wouldn’t.

If you follow these simple steps, you never have to worry about your testing VM reporting everything you do back to Microsoft.

For extra security, i recommend disconnecting the virtual network cable before you close the VM. That way if you accidentally start it without the vboxusers group it still won’t be able to access the internet.

If you’re running windows on bare metal in 2015 I have no advice for you, you deserve whatever happens.

Re:Virtualization

[whoever57]

I am not sure why you appear to think that Virtualbox is the only solution.

With a SPICE display, KVM/QEMU gives very good performance, without the need for closed-source plugins just to get support for basic things like USB2.

Re:Virtualization

[AntiSol]

Sorry if I offended your inner zealot. I never said or thought virtualbox was the only solution. It's the one I used when I needed to do this. You can use any virtualisation tool you want, even completely proprietary ones like vmware.

Re: Virtualization

[AntiSol]

Nah, you can use the modern.ie VMs for something like 30 days without phoning home to MS. And when that time limit is up you can just revert to the snapshot you took before booting for the first time (you did take a snapshot before booting for the first time, right? ;) ).

Personally, 30 days using windows sounds like 30 days too long. It was certainly long enough for me to do compatibility testing for Edge.

Two options immediately suggest themselves:

[Chris Mattern]

1) Don't set up an access point. If you still need an access point, set up a encrypted one (which you should do anyways) and don't give the isolated PC the keys. WiFi isn't magic; if there's no place for it to go, it's not going to go anywhere.

2) Put a Faraday cage around the antenna. This could be as simple as wrapping it in foil.

Re:Two options immediately suggest themselves:

[jonwil]

Shielding the WiFi antenna (or the whole device) is the only way to be sure its secure.

You cant trust any software solutions or any hardware on-off switches installed by the manufacturer.

Re:Two options immediately suggest themselves:

[bughunter]

You cant trust any software solutions or any hardware on-off switches installed by the manufacturer.

Especially if today's Wikileaks dump is true.

Re:Two options immediately suggest themselves:

[buss_error]

WiFi isn't magic Incorrectly assumes someone doesn't have a system in place that you don't know about, which is likely in any sort of espionage peril.

Put a Faraday cage around the antenna. This could be as simple as wrapping it in foil. Which may or may not work for most wireless APs, but absolutely will not for any sort of serious espionage peril.

Re:Two options immediately suggest themselves:

[David_Hart]

1) Don't set up an access point. If you still need an access point, set up a encrypted one (which you should do anyways) and don't give the isolated PC the keys. WiFi isn't magic; if there's no place for it to go, it's not going to go anywhere.

2) Put a Faraday cage around the antenna. This could be as simple as wrapping it in foil.

Better option, buy a Lenovo M900 mini PC without WiFi and use it exclusively to work on your client files. It's small enough to move around and should be powerful enough (i5 / i7) for most tasks...

Re:Two options immediately suggest themselves:

[peragrin]

Exactly. My Samsung smart TV would randomly turn on the wireless and try to communicate outside. When I first set it up I used wifi, realized how stupid it was and switched it to the wired connection, which then was left unplugged.

I upgraded my router and was screwing around when I noticed a new device was connecting( I used the same SSID and WPA key in both). After shutting everything down I turned on the TV and checked, wifi off,. I turned on wifi and bam. Same Mac address as my mystery guest. That was promptly banned. No wifi for you sneaky TV.

So even if you give a device access the only way to be sure is to disconnect it thoroughly.and software can be sneaky.

Re:Two options immediately suggest themselves:

[MikePikeFL]

Yes do what you can on the device, but don't trust the device. Additional controls like banning the MAC at the network level are essential.

Bios settings

[smylie]

Most (all excluding Apple?) laptops wil allow you to turn off / disable the wireless chipset in the bios. Many also have a physical kill switch on the side of the case.

Barring some wikileaks sort of tomfoolery from the CIA, this should stop any network access (assuming you also don't plug in a network cable).

Re:Bios settings

[AHuxley]

Re 'Barring some wikileaks sort of tomfoolery from the CIA"
Thats really the question every small or larger brand should be asking.
Is the US government interested in the work been done?
Can a competitor afford to hire a person who worked for the US gov or with the US gov tools to access the files?
Is the competitor another nation, government, with CIA like skill sets or that has a copy of the CIA like tools?
A private detective with friends who worked for the US gov or some other government the US trusted with its tools?
If your brand is understood to be working on products that will out pace, be more secure than or will see a drop in profit for existing US brands expect someone to be looking.
Create a list of all direct competitors and see who has staff who worked for different nations clandestine services or their front companies.

Re:Bios settings

[dwywit]

Lots of windows laptops have this, also. BIOS or hardware switch.

Also, depending on the situation, you could:

1. only one AP in range? i.e. are you working from home, and out of range of other APs?. Blacklist your laptop's MAC address at the AP.

2. turn off DHCP on the laptop, set static IP to 169.254.xxx.xxx

3. not sure about this one, but: arp -s 127.0.0.1 your-mac-address

Re:Bios settings

[allo]

Just be sure. Your approach is prone to forget something or somebody or just miscalculate the risk and then the cia(contractor) or somebody using the same security hole still accesses your stuff. Better safe than sorry

Re:Bios settings

[beckett]

for OSX you can remove IO80211Family.kext from /System/Library/Extensions to stop the wifi drivers from loading.

However, Typically i'd just go into system preferences and remove the wifi interface from the network settings. OSX will make no attempt to land there if it doesn't have a network interface.

Re:Bios settings

[AHuxley]

Thats why the smarter people use couriers, trusted face to face meetings. A world wide faith or cult is great cover too. Trusted, on the move and in every community.
Re ' somebody using the same security hole still accesses your stuff. Better safe than sorry"
The Soviet Union had that issue. By the 1950's they had the final proof that the US and UK had broken many of its codes, one time pad re use.
The option was to stop all chatter on all networks and only use one time pads. That totally locked the NSA and GCHQ out but it was a slow network that needed a lot more new codes to be ready every day.
It also made the Soviet Union unable to advance it communications. Finally new encoded networks allowed vast amounts of communications data to flow all over the Soviet Union. The NSA and GCHQ collected it all.
Did the Soviet Union know it would lose control of its crypto again? Soviet spies in the West reported the results in real time but the need for any communications was greater.
With ever more advanced communications networks, the NSA and GCHQ learned more about the Soviet Union.
Chatter, gossip, voice prints all added to a vast database of once hidden command and control structures.
Lots of nations and the private sector face the same CIA question. Safe with the slow privacy of a bulky one time pad system? A week for a message with a human on holiday? The number station is fast but one way https://en.wikipedia.org/wiki/....
Or risk it all and expand with the CIA/NSA/GCHQ in on every communication.

Disable the interface

[TWX]

Disable the wireless interface in the device manager. Or, look for the switch on the side of the computer that turns of the wireless, if it still has such a thing.

Re:Disable the interface

[msauve]

This, but with the knowledge that malware on the PC could potentially turn it back on without your knowledge. If that's still a concern, the wireless card can be removed from many systems - it's often an m.2 or PCI-e card which is plugged into a socket.

Re:Disable the interface

[TWX]

It might also be possible to disable it in the BIOS.

Or if you're going through the effort to remove it, you might just unhook the tiny little connectors that connect the antennas to it.

Re:Disable the interface

[duke_cheetah2003]

Or if you're going through the effort to remove it, you might just unhook the tiny little connectors that connect the antennas to it.

Frankly, this is probably the only way to be sure. Newer laptops I'm not sure about, but many older ones, the wifi mini-board is easily accessable. Less than 5 minutes to pop it in or out.

Alternatively, if you trust Windows.. airplane mode perhaps?

Air gap it when data is connected

[Yoik]

Put all the critical files on an external drive that is only plugged in when the system is isolated. Not perfect, but with good higene and an innocuous configuration on the base it should be fine.

Re:Air gap it when data is connected

[TWX]

Sounds like this is a developer. Good hygiene may be a problem.

Re:Air gap it when data is connected

[thegarbz]

Or just encrypt the machine, take standard security precautions, realise that no one is going to magically remotely configure your machine to turn on wifi and act as an access point, and keep the tin foil for baking lasagne.

Seriously. State secrets are not protected against the type of mythical attack being proposed here. And lets face it, getting a windows PC to connect via WiFi as an access point is hard enough to do when you want to and have full administrator privileges on a machine.

If you're really that worried, I'd be more concerned with whatever network you're connecting to, and that shady guy with a tireiron who has been stalking me since I left home this morning.

If you're that paranoid..

[nawcom]

.. and disabling the device in Windows 10 or the BIOS isn't enough, then just remove the wireless card. If by PC you mean desktop PC, unless it's a USB wifi chip soldered onto the motherboard, it'll be a typical miniPCIe or M.2 card. Remove it. For laptops a physical switch or hotkey for disabling the wifi card at the firmware level is common, but the same goes for that. They're not soldered onto the board (with some very rare exceptions) - they're miniPCIe or M.2 cards that are removable. Whether they're easily accessible varies by laptop model, but they're still removable.

Re:If you're that paranoid..

[Anonymous Coward]

Just more as an FYI and less as relating to the question asked, but there does seem to be a number of motherboards available now with wifi built in and not in a removable form.

Now to be clear, the only two I've seen so far were clearly marketed as "gaming" computer motherboards and for the DIY demographic, so there is next to no chance of finding this in any company setting.

But I previously had a MSI X99 board in a system that was physically damaged (crap water cooler block) so I salvaged what parts I could and went shopping for replacement bits.
This one had antenna terminals on the back panel, but inside it was basically a jumper cable over to a miniPCIe slot intended for cards like you mentioned.

I found a similar Gigabyte branded X99 "gaming" board with pretty much matching specs, but right below in the listing was a similar "gaming wifi" board that included both wifi and an on-board RAID controller.

Being all of $20 more and wanting a mirrored drive setup anyway, I figured what the hell I could just not use the wifi.
To my surprise there was no jumper cable at the back panel antenna connectors, and a chip on the board clearly marked "Qualcomm Atheros"

Personally I have no concerns over the existence of wifi on this system, and it is very likely able to be disabled in the BIOS settings, but there it is.

There was also some other motherboard in the Amazon listing that at least from the pictures looked similar. No jumper cable from the back antenna ports running to a miniPCI slot (card or no) yet labeled as a "gaming wifi" board. Sorry I don't remember the brand or model or anything.

Like I said, I'm not saying your mistaken or I disagree with your answer to the post. Hell "2" certainly qualifies as "rare situations" at that.
Just one more thing the paranoid need to check for I guess.

Re:If you're that paranoid..

[darkmeridian]

Yep. Not sure what's so hard about it. Pull the physical card out of the laptop and be done with it.

Re:If you're that paranoid..

[entropy01]

^ So much this. The only way to be 100% sure that nothing leaks out is to remove the Wi-Fi module. Plug in an Alfa USB wireless adapter when you want it to communicate.

Re:Disable in BIOS

[jfdavis668]

But what if he's a pinball wizard?

Probelm identifaction

[buss_error]

on a Windows 10 PC First problem

that has a wireless chipset built into it Second problem.

1. Don't work on sensitive issues using Windows of any version. Explore a windows VM under a more secure hypervisor where the guest cannot override the host on hardware or network issues.

2.Don't work on sensitive issues using a system with communications ability that does not use a verified hardware kill switch. EG: Avoid systems that use software to check the hardware switch to disable. Use hardware that uses a hardware switch to either kill power to that subsystem or uses an NMI to prevent function.

3. Build a Faraday cage room for sensitive work stations. There are government manuals on how to create TEMPEST spaces.

Sound hard? Somewhat. But then again, security, real security, isn't trivial.

Not enough info

[whitlocktj]

1) Disable NIC in Windows
2) Disable NIC using the hardware switch
3) Disable NIC via BIOS
4) Remove NIC from PC
5) Use WPA2-Enterprise
6) Turn off PC

IDK, what are your constraints?

Re:Disable in BIOS

[TWX]

I donno, there has to be a twist...

Re:Trump

[TWX]

Okay, I'll take a shot...

Maybe that orange mass on his head isn't hair. Maybe it's a finely woven copper Faraday cage.

Relax and disable the wireless

[chispito]

If you believe Windows 10 is going to spy on you via wireless after you disable it, then you likely don't really understand how to practice good security under any OS.

Use more ethernet

[AHuxley]

Stop trusting wifi on any network or device. Its not just the CIA, NSA but also local governments, competitors, random people that are looking for files.
Use ethernet for internal networks.
Ethernet for any internet connected computer.
Buy laptops or desktops with ethernet. If you need wifi for some new device, use it with caution and limit any files that get moved by wifi.
If you need "I-like-to-phone-home-sometimes" turn on wifi for that, let a device do its connection. No need to connect all your files to wifi due to one brand of smart phone. Have a work and home wifi smart phone. Files on both can be kept limited when using wifi.
The main risk with wifi is travel, new cities and other nations security services, competitors, criminal groups getting access to a wifi computer in another nation.
Or the request to open and share the files on a smartphone when entering another nation or returning.
Travel with a very average, trendy looking smart phone that can be replaced without any issue.
Wifi at work can be just for that file, project network, no need to keep the entire history of all work ever done on the same wifi network.

airplane mode

[lophophore]

turn on airplane mode.

Some PCs have a physical switch that turns off all the wireless. If you have one of those, switch it off. Files can be transferred over bluetooth, as well.

unplug the antenna

[Doke]

Most PCs with built in wifi have a couple antennas in the top of the case, connected by wires to a wireless card in a pci-e slot. That's so the antennas get better signal than they could deep inside on the card. It's usually on a card, because wifi standards vary across countries, so it's easier to put in the right card, than to make a new motherboard per region. Open it up, unplug the antenna, and remove the card. If the wireless is actually built in to the motherboard, then unplug the antennas, and wrap insulated tin foil around the card.

Disconnect the antenna, disable the interface

[Proudrooster]

Just Google the model of the laptop in question and teardown, example, "thinkpad yoga teardown"

Many laptops still use WIFI+Bluetooth cards which can be physically removed. The antenna wire runs directly to the module and can be removed disabling the antenna if you don't want to pull the module.

Even the newer Yoga's have WIFI modules which can be physically removed.

So if you want to make outside WIFI access difficult or impossible, remove the module and it will be impossible. Plug the laptop into physical wiring only and secure your network.

As for running Windows 10, that OS has a mind of it's own and the only way you can stop the madness is at the network level.

Re:Disconnect the antenna, disable the interface

[ImprovOmega]

Came in here to say this. Glad somebody was thinking straight.

access control

[Nex6]

First make sure the windows firewall is enabled, and the inbound is set to block. you can also use device manager to disable the wireless devices if you want. but
that wont stop malware from doing an outbound connection.

but here the short list:
1 use ciscos opendns and configure the web security rules.
2 decent AV/security software
3 malwarebytes
4 chrome
5 block flash and ads, use WOT plugin
6 UAC set to full do not run as admin

-Nex6

The Sensible option.

[Anonymous Coward]

Fully disable the onboard chip: Remove the PCI-E Wifi card or remove the antenna's from the card. If the WIFI chip and\or antenna's lead wires are soldered in, cut them in such a way they can be re-soldered later and ensure the metal contacts are electrical taped over so they cannot come into contact with anything inside. Same goes for blue tooth. If the antenna is built into the laptop, find a new laptop. From there, Go into device manager and disable the wifi card, then turn it off via a function key shortcut, then go into the BIOS and turn it off. You then need to repeat 3 steps to turn back on the embedded chip.

Use burner USB Wifi adapters: Purchase an inexpensive commercial grade USB Wireless adapter from a reputable name-brand company, use that for any wireless access. Preferably go with a USB 2.0 card to limit transmission bandwidth and range due to the voltage limitations of the standard. This way if you are on the machine and think you are being hacked, unplugging is a 2 second ordeal. If you need to remain anonymous on a large network, you can switch out and dispose of the adapters as needed.

Use an Enterprise grade WAP with key rotation: If you are going to connect to a controlled AP, make sure beaconing is turned off, and make sure to use WPA2-Personal with AES-256 and CBAC turned on with a 128 digit wifi encryption key, and secure the management plane of the device. Cycle this key every few weeks. Most AP's will accept the entire UTF-16 spectrum as a password, as will windows. Setting your password to "ANGRYDUDEÒ_Ó" is way more secure than a 24char alphanumeric; 66536^13 is way more secure than 108^24. Use alt codes to get the extra chars, if your password contains hieroglyphics, you have done it right. If you need better security, buy an enterprise grade WAP that has a certificate then use WPA2-Enterprise which uses the encyrption key to effectively salt the password. Most should also support key rotation, set this to as aggressive as needed. If you are paranoid about your burner adapters having crappy security, change out between different vendors. If done right, thousands of nvidia tegra cards running hashcat will not be able to crack your password in time before the key change.

Encrypt and secure the device properly: Harden the device against the disk being attacked, the network port being attacked, and the interfaces on the laptop being attacked. Full disk encryption, Implement a firewall and A/V Package that will protect the unit against network recon. Disable USB ports except the one you're going to use, and make sure autoplay is turned off. Use Secure boot, set a BIOS password. There are models of laptop where resetting the CMOS Battery will not let you get into the BIOS, get one of these. Set a windows password that has 24 characters minimum, make sure to edit LOCSEC.msc so the password is stored in MD5 and if possible, salted.

Implement an always-on VPN software: This way if the machine is stolen and then reconnected clumsily to the network you want it to phone home. Also, if you connect to a network, keeping the network stack from communicating with the outside world except for through the VPN ensures the data is filtered going to and from that machine. Lo-jack is another option.

Finally, Back up the machine. It's great to put in security, but if you secure the data from yourself, you are totally foobar'd. Encrypt onto a flash drive, store in a safe, and keep the password in your wallet.

Re:Employ a conflicting WiFi device

[MerlynEmrys67]

Don't forget the biggest draw on 2.4GHz Obligatory XKCD

Two ways come to mind...

[bobbied]

1. Don't turn on wireless when your sensitive data files are laying around on your device...Simple, effective, but not likely what the user wants. You can augment this a bit by encrypting the data when at rest and trying to have a policy that users are NOT allowed to have their wireless on when the data is unencrypted. (I.E. Do individual file/directory encryption and only decrypt when the network is turned off).

2. Only do you work on VM's which are NOT run locally on the portable device but in a secure physical location which is only accessed by a secure VPN tunnel which is encrypted. Not so simple, Very effective, but always requires a network connection to "access" the data in question.

Personally I like #2 for a couple of reasons... 1. It's very secure if you have good VPN. 2. It allows editing and sharing of files on a common file system and avoid the "how do I merge this change" issue. 3. If your mobile device gets stolen or searched, your valuable data isn't on it (Just make sure to have some kind of token for the VPN connections)

Turn on Windows firewall

[mysidia]

As bad as it seems.... turn on Windows Firewall with Advanced security, and make sure the computer is not joined to a domain, And None of the firewall exceptions are turned on. Open Computer Management, make sure the only enabled users have strong passwords, and set a Setup Password, User Password, and Hard Drive Unlock password in the BIOS/CMOS,
turn on the computer's TPM Function, and setup BitLocker drive encryption. Shutdown the PC fully when you are not physically present at the keyboard.

What reason in particular do you have to be concerned with 'Hacking over the wireless' again?

How about you Disable all Wireless NICs, then open Services.msc and set all Wireless-related services to Disabled, then reboot.

Re:Turn on Windows firewall

[mysidia]

That means you need to consider an adversary with physical access (break-in or evil maid) as part of the far end of the threat model.

No way, because that's a basically impossible threat model to secure against. You need a physically secure space to keep the machine at all times (E.g. a Bank-vault grade storage location, with a high-security transport box), and a physically secure space in which to work (Area with entrances under lock and key and 24x7 CCTV + multiple armed guard security watch). If those aren't assumed, then the device won't be secure against the attacks that TPM system measurements, HDD Password, and Encryption do not protect against.

OP needs a multi-layered solution: the laptop needs all RF Tx/Rx hardware verifiably removed. I

Your laptop's monitor is Tx hardware. All it takes is the adversary to hide a camera, OR: If you include Physical attacks in your model, the attacker covertly opens your PC while you are not there and installs Inside the internals of the laptop A Snoop device to capture or re-Transmit your video lines' output, And a Keylogger on the USB bus, interposing the normal keyboard to record the kb and mouse actions.

Ideally all USB ports would be physically unplugged or epoxied shut or both.

This isn't a useful security measure against a phys attacker. A physical attacker can open the PC and install an internal PCI device with an option ROM.
These are security measures to prevent abuse by end-users, In the context of an organization.

A client has given you confidential digital files containing a design for a not-yet-public consumer product.

In other words, you probably have a company laptop with a Client's confidential files, and nobody else except you shall ever touch it.
You're not in the position of an Employer trying to prevent employees from stealing files by plugging in a USB stick.
The difference is YOU can be trusted to follow your own procedures (Hopefully, maybe....)

If we assume the authorized user is not the espionage person, and follows procedures, then we don't need to worry about I/O ports, because they will not use any, and will not let anyone else touch the machine and not let the machine out of their site, until it is turned off physically locked up fully and securely in the Bank, or handcuffed to their wrist, while they are walking with their armed security detail to the vault location.

First ask yourself, what are you guarding against?

[PhunkySchtuff]

First ask yourself, what are you guarding against?

What guidelines has the client given you, what expectations do they have?
There's no point in you being so secure that the machine is virtually useless if the client happily stores these files on Dropbox/Google Drive etc.

Are you guarding against random drive-by hacking, script kiddies and the like, or are you guarding against an advanced persistent threat?
If you're guarding against the US Govt then your threat model is very different to if you're simply protecting yourself against casual hacking.

If you're concerned about an APT, then what level of threat do you expect to face? Is this a competitors company that has some guy who knows computers? Is it a multinational corporation with a large budget and a cybersecurity team? Is it a nation state? Is it the US Government?

The answers to those questions will heavily influence the appropriate course of action to take. If you're worried about casual hacking and the client has provided the files to you via Dropbox, then simply don't connect to any open wifi networks and don't connect to any wifi networks you don't know are secure. Make sure the wifi networks use WPA2.
If however you are concerned that the Govt. is likely out to get to your secrets, and they're specifically targeting you (as opposed to you being caught in a drift net) then you will want to physically disable the wifi, probably by taking the wifi card out of the laptop - it's likely on a small mezzanine card that is usually easily removed with a small Philips head screwdriver.

Select "Turn Wi-Fi Off" from menu bar ...

[perpenso]

Most (all excluding Apple?) laptops wil allow you to turn off / disable the wireless chipset in the bios.

The Apple macOS menu bar has status indicators. One is for wifi. Select it and a dropdown menu appears. One of the options is "Turn Wi-Fi Off".

Re:Select "Turn Wi-Fi Off" from menu bar ...

[smylie]

Yeah - that's just a software control though and (i imagine) trivially turned on programatically.

Re:Select "Turn Wi-Fi Off" from menu bar ...

[perpenso]

Yeah - that's just a software control though and (i imagine) trivially turned on programatically.

BIOS is software control too. :-)

Re:Select "Turn Wi-Fi Off" from menu bar ...

[smylie]

yup. but the bios settings are typically a lot harder to change from userland than, well, userland settings (if it's even possible at all - normally it's not)

Re:Select "Turn Wi-Fi Off" from menu bar ...

[perpenso]

yup. but the bios settings are typically a lot harder to change from userland than, well, userland settings (if it's even possible at all - normally it's not)

You don't need to change BIOS settings from userland. From userland to kernel to hardware works just as well, the hardware does not care what is configuring and initializing it.

Re:Select "Turn Wi-Fi Off" from menu bar ...

[smylie]

Sure. In theory - I've not heard of it being done in practise other than wrt to specific bios settings like clock speed.

As far as I know, this isn't possible in Windows (or linux) - happy to be proven wrong though. Do you have any links with further info? My cursory 30 seconds of googling seemed to suggest was still not possible.

Re:Select "Turn Wi-Fi Off" from menu bar ...

[perpenso]

Sure. In theory - I've not heard of it being done in practise other than wrt to specific bios settings like clock speed. As far as I know, this isn't possible in Windows (or linux) - happy to be proven wrong though. Do you have any links with further info? My cursory 30 seconds of googling seemed to suggest was still not possible.

Drivers interact with the hardware all the time. So too could malware as long as it is running in privileged mode, like drivers and other low level OS code. The hardware I am speaking of are the chipsets for the various types of I/O, not the BIOS itself. BIOS is largely irrelevant once the host OS is running. The host OS may look at current BIOS setting and respect a user setting but it is under no obligation to do so, BIOS can not enforce any limitations on the host OS. So if you can get malware running in privileged mode you could configure and provide drivers for a wifi chipset that both BIOS and the host OS ignored and never configured themselves.

Start buying copper wire and staples.

[fyngyrz]

Here you go: Faraday cage.

Re:Start buying copper wire and staples.

[ArmoredDragon]

Or just disconnect the antenna plugs from the wireless card. It's not going to be able to talk to any networks if you reduce its effective range to less than 6 inches. You can always plug them back in when you're finished.

Re:Start buying copper wire and staples.

[fyngyrz]

That can be difficult with some hardware designs; it also doesn't address various non-wifi signal capture methods.

If you're really concerned, then a properly built Faraday cage combined with excellent physical security is the best answer there is.

several options

[epyT-R]

1. disable with physical switch on side of machine if possible.
2. disable in bios if possible
3. go to device manager and remove the device. remove driver from driver store. go to \windows\system32\drivers and delete any remaining relevant .sys files.
4. go to device manager/network manager. Right click wireless adapter, hit disable.
5. remove all entries in windows firewall, set it to block in/out by default, and whitelist required applications. This is the least secure but most convenient of the options besides default.

If your client's truly that paranoid (justifiably or not), just operate on the data from a hardwired/airgapped machine and charge him for the inconvenience.

Toggle WiFi off from task bar ...

[perpenso]

Most (all excluding Apple?) laptops wil allow you to turn off / disable the wireless chipset in the bios.

The Apple macOS menu bar has status indicators. One is for wifi. Select it and a dropdown menu appears. One of the options is "Turn Wi-Fi Off".

And if you prefer to run Windows 10 directly on Apple hardware (Boot Camp rather than emulation) then select the wifi status indicator on the task bar and use the WiFi on/off toggle button.

Virtual Machines to the Rescue

[nns6561]

Use a virtual machine to contain Windows 10. Install an operating system and virtual machine software you trust. Disable any wireless interface for that operating system. Put the files in a Windows 10 virtual machine. Do not give the virtual machine access to any wireless interfaces.

How do you protect yourself from wireless hacking

[Gumbercules!!]

By using a wire.

I know this sounds redundant and trite but I'm serious. The question asks about how to not use wireless on Windows 10, yet few people seem to be giving the stunningly obvious advice of not using wireless on Windows 10. Disable the wireless NIC. Don't use wireless. Don't join a wireless network. Tada! You're not using wireless!

That one is really, really easy

[gweihir]

Either get a laptop with a physical RF-off switch, or remove the wireless card. If you bought a really crappy one, you can still almost always disconnect the antenna.

False problem

[YrWrstNtmr]

"You need to work on those files on a Windows 10 PC that has a wireless chipset built into it."

Why must it be on a system with wireless circuitry? Can't be away from your laptop for 5 minutes?

Re:Do nothing.

[Zaelath]

Best answer yet. If the client is really that concerned they should be building a shielded facility to work in.

Turn the router off and any cell tower devices

[TheOuterLinux]

When working, unplug the router, Airport your phones, and turn off your Bluetooth on the computer. Turn off any IoT devices. Do not use wireless keyboards or mouse. Buy a faraday phone bag on Amazon because iPhones never fully turn off. Some refrigerators work too if you don't want a paper trail. They make software that you can use to scan for radio signals, which is what wifi and Bluetooth are, just to be sure. Keep one original copy (for emergencies) of the file on one flash drive and the modified, edited one on another. When satisfied, boot up a light version of Linux. Use the Linux OS in Live session from a CD to use GParted to format the flash drives. They also make tools such as "shred" and "srm" to wipe and load zeros as many times as you want for a file to prevent recovery. Though to make things easier, Windows 10 will run on VirtualBox with Linux as the main OS. If the Linux machine isn't connected, than neither is Windows in this case. If there's a trial period, you can just save your VirtualBox session as a snapshot after setting the Windows install. When it comes time for the trial to be over, just keep loading the saved snapshot and open the files you need from a flash drive. I've never used Windows 10 (or will ever), but this method definitely worked when I needed Windows 7 because some software devs are dumbasses. Also, Linux has software called WINE to run Windows applications that works well enough to run Office 2013 and some modern games (PlayOnLinux). There is also another way to run Windows apps via ReactOS. It's like Windows but open source, except for real open source. The developers are really friendly if you have any questions. Everyone needs a tin foil hat plan whether you think you need it or not. Future wars will be cyber wars and no smart person fights with a dirty gun.

Re: Turn the router off and any cell tower devices

[TheOuterLinux]

Actually, if a router has a power button, skip it and just unplug.

I like the position of this article

[paai]

I like the position of this article directly below the exposition of the CIA hacks...

Paai

What are you even asking?

[thegarbz]

Are you assuming some exploit that allows someone to connect to your computer and start downloading files just because you have a wireless chipset?

Are you assuming someone snooping sensitive information while you are using a wireless connection?

The way the article is worded I'm going to say it's the former. Ignore it. Focus on actual risks which will come from the other end of your network connection. Don't assume someone can magically and silently convince your computer to act as an access point, connect to it, and then just hand over files. That's bloody difficult enough to do when you specifically want it to happen.

If you're really super paranoid, enable flight mode. That will disable your wireless altogether.

You've Already Lost

[StormReaver]

You need to work on those files on a Windows 10 PC that has a wireless chipset built into it.

You have already lost. You have an NSA/CIA-controlled operating system with wireless communications. The NSA/CIA most likely already have your client files.

move the PC to a virtual area

[DrYak]

As suggested by other discussion threads here around :

You can also achieve the same virtually :
"virtually move" the image to an area without any signal.

I.e.:
Windows 10 goes into a VirtualBox VM.
VM has no network.
VM has only CD-ROM (so can read from .iso files you mount) and shared folder (VirtualBox sharing doesn't go through network, so it's not opening windows 10 to remote access, at least not without a collaborating host OS).

You can pass the files and necessary application through shared folders and .ISO respectively.

I would suggest avoiding USB pass-through because it's complex to configure it in a secure way (defaults VBox scripts just make all device visible to any application running with VBox's goup credentials).

You achieve the same as moving a Windows 10 laptop to an area without any signal.
(i.e.: No network for Windows 10, no matter what)

But you still get to have an actual connection on your host OS (say a well secured and well kept Linux host).

Re:move the PC to a virtual area

[syntotic]

WHERE do you find an area with no signal? It happens this laptop has wider radio capabilities than wi fi and there is no interface to see what the laptop radio is saying over what frequency, other than conformant http protocols. The radio buttons never goes out but it was off when the laptop was brand new. The point is to be able to be online without danger, not to be completely isolated. Maybe Win 3.1 was fully isolated, but these new windows do not seem to be able to stop being in permanent conference.

Missing the forest for a tree?

[zopper]

If turning off wifi in the system is not secure enough for you (that is, if you are afraid of a targetted attack), don't ask here, but go to some security consultant. There are other attack vectors that you might forget, like a good telescope and a camera in the building over the street. Hint: goverment contracts in one company I know are handled in a windowless, steel lined room without any network access on a certified HW.

Re:Disable in BIOS

[jfdavis668]

How do you think he does it? I don't know!

Watch out for USB

[DrYak]

authorized USB sticks

Pay attention that the current default behavious of VBox scripts might open a different kind of vulnerability :

USB-pass-though requires that the VBox process has access to the raw USB device.
This is done by the script "/usr/lib/virtualbox/VBoxCreateUSBNode.sh"
it creates the appropriate entries in "/dev/vboxusb/"
granting them full group access for "vboxusers"
Currently this script is called by default by "/etc/udev/rules.d/90-vbox-usb.rules" for any plugged-in device.

That means the raw USB device of *any* USB gizmo is available for *ANY* process that runs with VBox's group credential.
This opens quite a big hole.
(Virtual Box it self then use a white list so *NOT ALL* device will be available to the Windows 10 VM, only those that you grant access to.
But it means potentially any USB device could be hacked by any process running with "vboxusers" group privileges).

A better way is to comment out the insersion rules, and only create the devices for device that you want to be visible to virtual box.
Example of a configuration file that only grants access to a few of my devices that rely on windows-only software for firmware updates :

# TomTom Live
ATTRS{idVendor}=="1390",ATTRS{idProduct}=="5454", ACTION=="add", RUN+="/usr/lib/udev/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass} vboxusers"

# iRobot Scooba 450
ATTRS{idVendor}=="27a6",ATTRS{idProduct}=="0001", ACTION=="add", RUN+="/usr/lib/udev/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass} vboxusers"

# UE MEGABOOM
ATTRS{idVendor}=="046d",ATTRS{idProduct}=="0a53", ACTION=="add", RUN+="/usr/lib/udev/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass} vboxusers"

#SUBSYSTEM=="usb_device", ACTION=="add", RUN+="/usr/lib/virtualbox/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass}"
#SUBSYSTEM=="usb", ACTION=="add", ENV{DEVTYPE}=="usb_device", RUN+="/usr/lib/virtualbox/VBoxCreateUSBNode.sh $major $minor $attr{bDeviceClass}"
SUBSYSTEM=="usb_device", ACTION=="remove", RUN+="/usr/lib/virtualbox/VBoxCreateUSBNode.sh --remove $major $minor"
SUBSYSTEM=="usb", ACTION=="remove", ENV{DEVTYPE}=="usb_device", RUN+="/usr/lib/virtualbox/VBoxCreateUSBNode.sh --remove $major $minor"

Re:Virtualization virtual box shared folders

[Hognoxious]

Guest Additions are great when they work, but I find sometimes they just don't.

Turn the wireless off?

[Ayanami_R]

Right?

Ask the client...

[sh00z]

• for a copy of their IT Security and Risk Management Plans, and do what those say
• If they don't have them, offer to develop those products for them (with appropriate cost and schedule impacts)
• Profit!

Start with a good password

[NewYork]

https://www.random.org/passwor...

Virtual.

[DrYak]

WHERE do you find an area with no signal?

The whole point is *VIRTUAL*.

The host's virtual manager (e.g.: Virtual Box running on the Host GNU/Linux distro of your choice) is in charge of what happens.
Windows 10 is installed on a virtual machine, that machine has no network device simulated at all, only a shared directory (Note: Under VirtualBox, shared directory don't work over the network, but use a dedicated separate API offered by VirtualBox. No need to expose the virtual image to the network in order to exchange data. Windows 10 can't phone home.)

It happens this laptop has wider radio capabilities than wi fi and there is no interface to see what the laptop radio is saying over what frequency,

Again, I'm speaking about a virtual machine. A VM will only have as much functionnality as your decide to make available to it.
If that machine has no access to Wifi, nor Bluetooth (well technically to the USB bus on which a Bluetooth device is available. But in practice the result is the same : if you're not passing it to the VM, then the Windows 10 running on the VM can't do much).

The point is to be able to be online without danger, not to be completely isolated. Maybe Win 3.1 was fully isolated, but these new windows do not seem to be able to stop being in permanent conference.

Hence the idea :
- use a normal decent OS to do the actual online work and which has an access to the internet.
- for the things where you absolutely need Windows 10, keep a copy inside a VM that is completely isolated.

Whenever you need *that weird piece of software* that absolutely refuse to work under anything but Windows 10, then you can fire up the Windows 10 VM and run the software.
For everything else, use a "Real Operating System (tm) "
(most Unices will do)

Simple solution

[LienRag]

1 - Format PC disk

2 - Install real OS