I'm the sysadmin for a university academic department, and I have a user who is receiving confidential information from the federal government.
The terms of the contract are that the data must be worked on with a standalone PC that has the NIC disabled in the BIOS, and the data must be stored encrypted. No problem; this is all easy. The user may export data to CD or print it for use, but must shred the CD or paper when finished. No problem.
She'd also like to be able to print documents. Again, no problem...printer connected via USB.
The office housing this standalone PC has a network printer in it. When one prints from the network-connected PC in that room, they just use IP printing.
I'm eyeing the unused USB port on the printer. If I were to connect the printer's USB port to the standalone PC, and the printer is connected to the network at large, I would be technically satisfying the contract, but there would not be a true airgap.
Has anyone out there ever heard of a successful attack on a PC being carried by network <-Ethernet-> network printer <-USB-> standalone PC? I'm conceptually thinking about someone flashing the printer's firmware to turn the printer into a USB rubber ducky or USB docking station.
I'm assuming here that the attacker would not have physical access to the printer.
Thanks!
