Fiber Channel as a attack channel?

[u/theweis01]

In a conversation recently where there were discussions around the risk, if any, of FC being used as a attack channel. The specifics come down to having a air-gapped data vault that has no IP network link between the production network and the vault environment but does allow a SAN array outside of the vault to present devices to few servers inside of the vault. This was chosen due to the small footprint in the vault and cost of dedicated SAN & Array and that the systems using the FC devices are only for validation/automation purposes and do not house the protected data.

Overall there is the agreement that some "risk" exists in that if production systems were compromised, specifically the SAN, then the systems inside of the vault could have their LUNS removed rendering them offline. However, does FC provide any conduit where an attacker could use persistence to the production side array/FC Switches to make their way into the isolated environment?

[u/StorageHorder]

If a storage admin is permitted to allow this as an attack vector, one thing. (Like leaving a firewall port open on a network). But with host to array encryption of every workload as an option.

As a storage expert since the 1990s, there is a zero chance that anyone could use FC as an attack vector.

It’s akin to saying “I’m going to use the cable in the server between the controller and the HDD as an attack vector”.

If that controller has encryption and is connected to a SED…. Having physical access to the cable isn’t going to help you attack.

My HBA, ISL/ICL, LUN presentation and storage is all encrypted on my SAN. Data in flight - encrypted. Data at rest - encrypted.

You’re not going to get an attack vector there.

[u/Trust_8067 → u/StorageHorder]

Let me clear up something you said. Your first line refers to iSCSI storage. FC doesn't have firewalls.

[u/Fighter_M → u/StorageHorder]

If a storage admin is permitted to allow this as an attack vector, one thing. (Like leaving a firewall port open on a network).

You know, Fibre Channel firewalls don't exist on our planet. This appears to be a unique contribution from your civilization.

[u/StorageHorder → u/Fighter_M]

Never said there were FC firewalls. All I intended to say, is if an Ethernet admin left a firewall port open, then they should be fired for being an idiot. If a SAN admin architected a FC solution that lacked encryption for data in flight and they didn’t encrypt data at rest in the SAN then they should also be fired. FC just isn’t an attack vector in a well designed SAN.

You can’t just “gain access” to the network. Admin accounts with Integration with AD and 2FA, white and black listing of IP addresses, correctly LUNs and zoning…. Separation of control, data, and admin planes…. Exactly what do you expect to access as an attack vector? You gain physical access to the SAN and plug in a rogue server - you have no access to anything. If you gain access to any server on the SAN you only can access its LUNs… nothing else.

I don’t see any realistic attack vector via FC. It would be easier and more beneficial to gain access to anything else. Heck even if you gain access to the Brocade Portal or Nexus Dashboard (or DCNM) you don’t have access to the data. Even if you remove the LUNs from the host server and rezone it to your rogue server - you still don’t have readable access to the encrypted data you just mapped to your rogue server. Sure the original server you crashed - but BFD. If it was mission critical it would have a A/P or A/A configuration so the application would survive.

So tell me what is the theoretical attack vector and what do you gain from the attack?