The Google plasma globe affair of 2012
lcamtuf.coredump.cx
The Google plasma globe affair of 2012
1–10 of 103 posts
Re: The Google plasma globe affair of 2012
#2This seems pretty cool. It reminds me of a story I heard recently. Crooks were knocking doorbell cameras off of wifi by an assumed deauth attack. I looked it up and there are “maker watches” that will do deauth “bombs” for you, no soldering required.
A nefarious plasma globe could hide of lot of nasty stuff, you don’t even need to plug it in via USB to cause harm.
Re: The Google plasma globe affair of 2012
#3This seems pretty cool. It reminds me of a story I heard recently. Crooks were knocking doorbell cameras off of wifi by an assumed deauth attack. I looked it up and there are “maker watches” that will do deauth “bombs” for you, no soldering required. A nefarious plasma globe could hide of lot of nasty stuff, you don’t even need to plug it in via USB to cause harm.
The other nifty thing about the plasma globe is that immediately after someone plugs it in, they are likely to be too distracted by the luminous fingers of writhing plasma to notice the shell window popping up briefly on the monitor. Nicely-executed hack on multiple levels.
For the same reason, waiting a few minutes to pop up the shell, as the article says they did, actually seems counterproductive. It might have been better to pop up the window intentionally -- launch the browser to display an ad from the company that made the gadget, maybe, or a 'user's manual', or something like that. Something that would appear innocuous and expected, while providing cover for the payload.
Re: The Google plasma globe affair of 2012
#4>Another critical optimization boiled down to realizing that the response packet allows up to six keycodes to be reported at once. This might have seemed like a straightforward 6x speed gain, but not so: on MacOS, the keystrokes were dequeued not in the order they appeared in the packet, but from the numerically lowest scancode to the highest. This mind-boggling quirk [...]
Reporting multiple keys down in the same packet is meant to be used for when the user actually has those keys down simultaneously, so it's not unusual that MacOS decided to act on them in order of scan code, because the expected effect would be the same.
Re: The Google plasma globe affair of 2012
#5> The solution proved to be simple: we "borrowed" the USB vendor and product ID sent by an Apple-made keyboard taken from a coworker's desk. Looking at the prototype plasma globe sitting in my "old projects" box, it seems that we picked 05ac:024f.
I'm a bit put out that that worked, although I'm struggling to think of a solution that doesn't involve going full-crypto (including a proper PKI to let vendors sign devices) on all USB devices. But if anyone can set any vendor+product ID, it's not really a useful security measure.
Re: The Google plasma globe affair of 2012
#6> The solution proved to be simple: we "borrowed" the USB vendor and product ID sent by an Apple-made keyboard taken from a coworker's desk. Looking at the prototype plasma globe sitting in my "old projects" box, it seems that we picked 05ac:024f. I'm a bit put out that that worked, although I'm struggling to think of a solution that doesn't involve going full-crypto (including a proper PKI to let vendors sign device…
You have to realize that it was never meant to be a security measure. It's only there to identify the device to the host system.
Re: The Google plasma globe affair of 2012
#7This seems pretty cool. It reminds me of a story I heard recently. Crooks were knocking doorbell cameras off of wifi by an assumed deauth attack. I looked it up and there are “maker watches” that will do deauth “bombs” for you, no soldering required. A nefarious plasma globe could hide of lot of nasty stuff, you don’t even need to plug it in via USB to cause harm.
The other nifty thing about the plasma globe is that immediately after someone plugs it in, they are likely to be too distracted by the luminous fingers of writhing plasma to notice the shell window popping up briefly on the monitor. Nicely-executed hack on multiple levels. For the same reason, waiting a few minutes to pop up the shell, as the article says they did, actually seems counterproductive. It might have bee…
A power user wouldn't (shouldn't) expect a device merely using USB for power to pop up anything on the PC it's plugged into. That would be a dead giveaway that it's doing something it shouldn't be doing.
Re: The Google plasma globe affair of 2012
#8[deleted]
Re: The Google plasma globe affair of 2012
#9I wonder if it might be reasonable to break up the attack over time.
Slowly populate a script with contents so that instead of writing a lot of characters that a user might see, just populate a few.
Re: The Google plasma globe affair of 2012
#10Similar to the Mr. Robot episode where Elliot hacks a laptop using a Bluetooth keyboard from a nearby vehicle after an accomplice helps approve a pairing request on the device.