| > Anti-cheat software seems like a great platform to launch targeted malware in-order to achieve a beachhead on a computer network: highly targeted, and effectively undetectable. > I would expect most software developers don't sandbox their gaming machines from their work-from-home environments. I have been worried about this for some time. In my country we have a lot of issues with metadata retention so I set something up like this[0]. I have separate VLANs: • VLAN 1: Management (no tag, null route) • VLAN 2: Untrusted (routes direct to ISP via ppp0) • VLAN 3: Trusted (routes direct to ISP via ppp0) • VLAN 4: Trusted (routes via tun0 - VPN connection for private browsing etc) • VLAN 5: Null route for devices that do not require internet access of any kind, desk phones printers etc. (Doesn't have to be a Raspberry Pi, you can use anything that Alpine Linux runs on which is x86_64, x86, ppc64le, s390x, armhf, aarch64 (ARM8 like Raspberry Pi 3), armv7 (Raspberry Pi 2, and friends).[1] [0] https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... [1] https://alpinelinux.org/downloads/ The idea is that anything on VLAN2 is completely segregated at the switch and router level from the rest of my network. |
There are essentially just two segments / types of switch ports (I may have stuck with the many-vlans thing if switch ports had RGB LEDs showing what zone they were in...). First, the "trusted" network, which does switch management, servers, reasonably-behaved hosts, etc.
Then, a second "access" segment. Ports in this segment are setup to not be able to talk to one another through the switching fabric at all - the only thing they can talk to is the router. Ports on the same switch are prohibited from talking by the switch's config, and different switches are given different associated VLANs. This is good for visitors, Android, Internet of Trash, etc.
For routing, the horizon seen by each device is controlled directly by its own macaddr on the router itself. Two hosts on the same segment can see drastically different routing tables and Internet connections. This isn't perfect, as it can be easily spoofed unless I start pushing the switchport-mac mapping out to the switches. But it works for now.
But I believe "sandboxing" in the original comment was talking about the machine itself, not network access. So PC gaming means being disciplined about getting another machine, or at least a second GPU for PCIE passthrough in a VM. In general I think we're in a time of decommodification. The easiest way to sandbox between security boundaries is separate machines, of which there is an inexpensive surplus of. No need to have banking and games on the same tablet, when a second hand nexus7 (flo) is $40 on fleabay.