The Google plasma globe affair of 2012 • Hacker News Board

Re: The Google plasma globe affair of 2012

#71

Post by evan_ » Tue, Oct 11, 2022, 2:14 AM UTC

g_sch wrote: post #39

Watching the video, they mention that in order for the red team to reach their goal (downloading Google Glass schematics), they had to pivot from the users they compromised with the plasma globe (who were not working on the Glass project) to users on the Glass team. They seemingly did that using an image attached to an email that executed its payload when the email was opened. They didn't elaborate what the payload d…

I wondered about that too. My guess is that the image was just a trigger loaded off either a remote server or a local server installed by the exploit so they could know when the user was logged in to their Google account rather than a personal account, which would be off-limits for the exercise.

I’m guessing the documentary just glossed over it for brevity.

Re: The Google plasma globe affair of 2012

#72

Post by KennyBlanken » Tue, Oct 11, 2022, 3:20 AM UTC

NegativeLatency wrote: post #32

Bit of a weird opening with the car crash stuff considering that driving is one of the most dangerous actives people do every day, and lots of people still die or are hurt by/from vehicles every day. https://www.cdc.gov/vitalsigns/motor-vehicle-safety/index.ht...

Automotive safety has skyrocketed since the 50's, though road safety for non-occupants and motorcyclists has gone down significantly in recent years.

But...it's not weird, it's part of Gogole marketing's altruistic spin on this as "we're protecting everyone!"

Did anyone else notice that they very quickly glossed over "our red team isn't allowed to go after any user data"?

That's like saying "don't worry, our bank's red team isn't allowed to try and go after money."

The red team is only intended to protect their corporate IP/trade secrets and dirty laundry.

Re: The Google plasma globe affair of 2012

#73

Post by KennyBlanken » Tue, Oct 11, 2022, 3:21 AM UTC

tgsovlerkhgsel wrote: post #57

I'm surprised this works as described (especially with the speed mentioned). If I press CTRL+Alt+T on Ubuntu, I can release it and press T again (by hand!) without it hitting the Terminal window. Reliably, and repeatedly, even with the Terminal app certainly cached, on a modern device with an SSD and low load. That means an attacker would need to add a wait to risk losing half the payload to the launch animation or w…

The script triggers a cycling of the scroll lock indicator to indicate success. They only need try again at some point.

Re: The Google plasma globe affair of 2012

#74

Post by KennyBlanken » Tue, Oct 11, 2022, 3:23 AM UTC

w-ll wrote: post #17

Emulating keyboards pretty old technique. I feel like the rubber ducky stuff and the likes were around earlier. And they are still popular, the flipper zero has a mode of usb payloads but that's more useful if you have physical access.

Yep. Literally a bunch of corporate PR bullshit around a nearly two decade old technique. There's multiple pre-made firmwares for uCs to do this sort of thing.

The fact that they hit the MacOS keyboard wizard shows that apparently nobody on their team had experience with such a basic, ages-old technique.

Re: The Google plasma globe affair of 2012

#75

Post by KennyBlanken » Tue, Oct 11, 2022, 3:26 AM UTC

alexpotato wrote: post #11

Reading articles like this always causes me to think two things: 1. If this is what a couple of smart guys can do as, essentially, a side project then I can only imagine what nation states with teams of people like this can accomplish. 2. I get why some orgs pour wax into the USB ports of their desktop machines.

Well, the NSA was diverting shipments of Cisco networking gear to install custom firmware with back doors.

But...this sort of hack is around two decades old and doesn't represent anything new in the field. There are at least a dozen toolkits one can use to implement this on a number of USB-friendly microcontrollers.

I would expect someone working for Google's red team to be able to bang this device out, from scratch, in one day.

Google probably spent more on the voice actor and graphics for the video.

Re: The Google plasma globe affair of 2012

#76

Post by duped » Tue, Oct 11, 2022, 3:52 AM UTC

Scoundreller wrote: post #67

duped wrote: post #63

Earlier quoted context omitted.

An attacker can lie about what their device id is

How would it know the right device id to spoof? (Definitely doable in a MITM scenario, but more complicated in others).

Pick one of the most popular keyboards used by your target and reuse it. That's how I'd do it. It's not going to get everyone but I think it's a legitimate approach.

The alternative methods looking at the time between keystrokes seems more reliable.

Re: The Google plasma globe affair of 2012

#77

Post by peddling-brink » Tue, Oct 11, 2022, 4:01 AM UTC

g_sch wrote: post #39

Watching the video, they mention that in order for the red team to reach their goal (downloading Google Glass schematics), they had to pivot from the users they compromised with the plasma globe (who were not working on the Glass project) to users on the Glass team. They seemingly did that using an image attached to an email that executed its payload when the email was opened. They didn't elaborate what the payload d…

I have no insider knowledge, but SVGs can contain JS.

Re: The Google plasma globe affair of 2012

#78

Post by peddling-brink » Tue, Oct 11, 2022, 4:03 AM UTC

KennyBlanken wrote: post #72

NegativeLatency wrote: post #32

Bit of a weird opening with the car crash stuff considering that driving is one of the most dangerous actives people do every day, and lots of people still die or are hurt by/from vehicles every day. https://www.cdc.gov/vitalsigns/motor-vehicle-safety/index.ht...

Automotive safety has skyrocketed since the 50's, though road safety for non-occupants and motorcyclists has gone down significantly in recent years. But...it's not weird, it's part of Gogole marketing's altruistic spin on this as "we're protecting everyone!" Did anyone else notice that they very quickly glossed over "our red team isn't allowed to go after any user data"? That's like saying "don't worry, our bank's r…

I’d be pretty upset if my bank’s red team withdrew my money just to prove they could.

Re: The Google plasma globe affair of 2012

#79

Post by pabs3 » Tue, Oct 11, 2022, 4:25 AM UTC

godelski wrote: post #55

jimrandomh wrote: post #46

It seems pretty scandalous to me that most operating systems still haven't implemented any mitigation for pretend-to-be-a-USB-keyboard attacks. Fixing it isn't trivial, but it's hardly insurmountable. The solution is fairly simple: Whenever a new keyboard is plugged in or types its first keystroke, lock the screen, and don't accept key input to places other than the login form from a new keyboard until that keyboard…

I think it is a hard problem to solve BUT I think OSs should offer a compromise. That you are notified each time and can grant or deny. This should be an optional setting for those that want to easily add hardening (I think there's no excuse that linux distros don't have a "hardening" setting in their advanced or security settings). I don't know the answer to this, so I'll ask. Can USB ports be programmed to only out…

Grant/deny just leads to people clicking accept, you want something where the user has to choose what kind of device the plugged in and if it doesn't match what the device says it is then you reject the device or something.

On Linux GNOME already has USBGuard support btw.

Re: The Google plasma globe affair of 2012

#80

Post by nullc » Tue, Oct 11, 2022, 4:29 AM UTC

CamperBob2 wrote: post #3

wil421 wrote: post #2

This seems pretty cool. It reminds me of a story I heard recently. Crooks were knocking doorbell cameras off of wifi by an assumed deauth attack. I looked it up and there are “maker watches” that will do deauth “bombs” for you, no soldering required. A nefarious plasma globe could hide of lot of nasty stuff, you don’t even need to plug it in via USB to cause harm.

The other nifty thing about the plasma globe is that immediately after someone plugs it in, they are likely to be too distracted by the luminous fingers of writhing plasma to notice the shell window popping up briefly on the monitor. Nicely-executed hack on multiple levels. For the same reason, waiting a few minutes to pop up the shell, as the article says they did, actually seems counterproductive. It might have bee…

Plasma globe is also nice because it's so big. It could contain a camera, microphone, storage, LTE radio, GPS (for only turning malicious at the target location) ... a tiny drone that could be ejected at night to fly around the office.