News for hackers. Stuff that matters.
Re:The Google plasma globe affair of 2012 by g_sch on Monday October 10, 2022 @05:03PM (#33156363)
Watching the video, they mention that in order for the red team to reach their goal (downloading Google Glass schematics), they had to pivot from the users they compromised with the plasma globe (who were not working on the Glass project) to users on the Glass team. They seemingly did that using an image attached to an email that executed its payload when the email was opened. They didn't elaborate what the payload did, but mentioned that it "captured the user's fingerprint" and enabled them to use that to access the Glass schematics.

Although it sounds much less exciting, this sounds like a much more serious exploit than a compromised USB plasma globe - embedded in an image and requiring minimal user interaction to execute. I wonder whether they identified a novel 0day in a common image parser or something.

Re:The Google plasma globe affair of 2012 by evan_ on Monday October 10, 2022 @10:14PM (#33158709)
I wondered about that too. My guess is that the image was just a trigger loaded off either a remote server or a local server installed by the exploit so they could know when the user was logged in to their Google account rather than a personal account, which would be off-limits for the exercise.

I’m guessing the documentary just glossed over it for brevity.

Re:The Google plasma globe affair of 2012 by peddling-brink on Tuesday October 11, 2022 @12:01AM (#33159382)
I have no insider knowledge, but SVGs can contain JS.
Re:The Google plasma globe affair of 2012 by ygra on Wednesday October 12, 2022 @04:11AM (#33174224)
Not when rendered in an img element. Well, they can still contain it, but it won't run.