I wondered about that too. My guess is that the image was just a trigger loaded off either a remote server or a local server installed by the exploit so they could know when the user was logged in to their Google account rather than a personal account, which would be off-limits for the exercise.
Iām guessing the documentary just glossed over it for brevity.
Re:The Google plasma globe affair of 2012
by peddling-brink on Tuesday October 11, 2022 @12:01AM
(#33159382)
I have no insider knowledge, but SVGs can contain JS.
Although it sounds much less exciting, this sounds like a much more serious exploit than a compromised USB plasma globe - embedded in an image and requiring minimal user interaction to execute. I wonder whether they identified a novel 0day in a common image parser or something.