11–16 of 16 posts
A pretty good malware distribution method would be having people download a ‘demo’ of this, right?
Lets ignore the open source FUD in the diagram.
"Our delivery vehicle is FOSS" Yeah right, FOSS is famous for just accepting pull requests with exploits from randos. LGTM YOLO fuck it, ship it, move fast and break things — wait, that one isn't FOSS. Anyway .
It’s a bit ironic in the sense that the EXACT logic of what you’re saying here is precisely what makes it such an ideal thing to target.
I think sometimes people put way too much faith into the concept of open source as being some kind of meaningful shield against attacks like this. Like absolutely nobody in an intel background for example who does stuff like this for a living would agree with you.
It only ever needs to look plausible and I don’t think it’s all that complicated a problem to come up with a reason as to why you’re introducing some code that is suddenly very focused on reading mouse sensor data.
While I'm sure (by numbers) a lot of people play video games, I would bet percentage wise that a lot more people open webpages.
I've known that the correct pronunciation of "mic" was to sound like "mike" (because it's short for "microphone") for so long that the pun in the "Mic-E-Mouse" name escaped me until after I finished reading the article. (If you also didn't notice the pun, it would sound like "Mickey Mouse" if you pronounced "mic" the way it's written instead of the correct way).
Earlier quoted context omitted.
"Our delivery vehicle is FOSS" Yeah right, FOSS is famous for just accepting pull requests with exploits from randos. LGTM YOLO fuck it, ship it, move fast and break things — wait, that one isn't FOSS. Anyway .
This absolutely does however happen in practice. It’s a bit ironic in the sense that the EXACT logic of what you’re saying here is precisely what makes it such an ideal thing to target. I think sometimes people put way too much faith into the concept of open source as being some kind of meaningful shield against attacks like this. Like absolutely nobody in an intel background for example who does stuff like this for…
....and then what?
Reading the data alone does nothing.
Sending that data to your own servers would be a harder thing to obfuscate.