Hacker News Reader

Comment by MBCook | Hacker News Reader

> For example, let's imagine you invite an external guest for a presentation inside your company. You offer to connect to a video-projector so he can show his slides. This is the perfect opportunity for the guest to hack the video-projector. Next time an employee connects to this projector, his laptop is hacked back.

Is there a single proof of concept of this out there? This seems wildly theoretical to me.

Seems like you have to know:

* the projector/TV model/firmware

* the employee laptop and firmware

* a bug in the projector/TV that would let you insert arbitrary data in a way that will stay around and be sent to other devices that connect to HDMI

* a bug in the laptop that would let you install something malicious with the data could get the projector to send

* your hack wont be detected by software on the laptop or the IDS/whatever on their network

That’s pretty heavy lifting. I mean is any of that reasonable outside of nation-state level attacks?

View on HN

Check out trmml's thunderstrike for an example of a working hardware worm.

Its not exactly what you are outlining, but close enough for me to think 'yeah, does not need a nation-state level actor to do'.

It would be a different exploit chain for HDMI, and I am no expert in either HDMI or thunderbolt to make a claim that its possible, but I've been surprised with the amount of complexity HDMI offers.

https://trmm.net/Thunderstrike/

Doesn't the T1/T2 chips on newer Macs prevent this from happening?

Not especially.

I mean, if part of what you're trying to do is deliver a persistent payload to the target machine then the T1/T2/SIP with the M1/2 will make your life more difficult after the machine reboots, but that is probably the least of your worries trying to chain off an attack like this.

not when the alternative is "hey disgruntled employee, i'll pay you 25k for these files" is the low hanging fruit

This is only low-hanging fruit if the company/engineer in question makes HDMI firmware.

I believe they meant the employee of the company you’re trying to hack, not a TV/laptop maker.

Yes, I know. The people best positioned to write an HDMI hack are the ones already working with HDMI, not your random webapp developer

No, the original comment meant: pay a disgruntled employee to get what you want instead of developing an HDMI exploit for your target.

the point is there's no sense in spending man-years building an hdmi hack and implementing it by going onsite when you can bribe an employee instead. it's low likelihood

You're missing the point of the person you responded to methinks.

I guess the "bug in the laptop" part would be the hardest at the time of auto-updates.

Assuming someone builds a database of vulnerable displays and related exploits, your software can choose the correct exploit because HDMI sends the display model. But if the display is not connected to the network, it would have to exploit an unpatched vulnerability over HDMI in a laptop that connects to it. Not entirely impossible but the time window might be slim if it's not a zero-day.

> Is there a single proof of concept of this out there?

At one point malicious USB charging cables that owned your machine were just the fever dreams of paranoid people thinking the NSA was out to get them. Now you can buy them for less than $200.

Will nation states launch this type of attack? They probably are.

Do you have to worry about this happening in your meeting rooms? Probably in 3-4 years.

Reply on news.ycombinator.com