New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add AUDIO_EFFECTS to distinguish from others #10744

Merged
merged 3 commits into from Oct 5, 2018

Conversation

Projects
None yet
5 participants
@wvu-r7
Contributor

wvu-r7 commented Oct 4, 2018

Constant Description
SCREEN_EFFECTS Module may show something on the screen (Example: a window pops up)
AUDIO_EFFECTS Module may cause a noise (Examples: audio output from the speakers or hardware beeps)
PHYSICAL_EFFECTS Module may produce physical effects (Examples: the device makes movement or flashes LEDs)

Updates #10707.

@wvu-r7 wvu-r7 requested review from bcoles and wchen-r7 Oct 4, 2018

@jrobles-r7

This comment has been minimized.

Show comment
Hide comment
@jrobles-r7

jrobles-r7 Oct 4, 2018

Contributor

wasn't there physical effects?

Contributor

jrobles-r7 commented Oct 4, 2018

wasn't there physical effects?

@bcoles

This comment has been minimized.

Show comment
Hide comment
@bcoles

bcoles Oct 4, 2018

Contributor

Looks good to me.

I think a separate constant for AUDIO is beneficial, but do we need/want this distinction between software/hardware audio?

This line gets blurry, as some systems will emit a beep from the internal speaker if no audio device is configured.

# Module may cause software to output audio from the speakers (Example: the app plays music)
AUDIO_EFFECTS          = 'audio-effects'
# Module may produce physical effects in hardware (Examples: LED or LCD changes or hardware beeps)
PHYSICAL_EFFECTS       = 'physical-effects'
Contributor

bcoles commented Oct 4, 2018

Looks good to me.

I think a separate constant for AUDIO is beneficial, but do we need/want this distinction between software/hardware audio?

This line gets blurry, as some systems will emit a beep from the internal speaker if no audio device is configured.

# Module may cause software to output audio from the speakers (Example: the app plays music)
AUDIO_EFFECTS          = 'audio-effects'
# Module may produce physical effects in hardware (Examples: LED or LCD changes or hardware beeps)
PHYSICAL_EFFECTS       = 'physical-effects'
@wvu-r7

This comment has been minimized.

Show comment
Hide comment
@wvu-r7

wvu-r7 Oct 4, 2018

Contributor

I made the distinction because I assumed we wanted to be clear and break down the constants, since we've been going that route. Hardware vs. software was one such distinction. I have a proposed compromise that I think works better.

Contributor

wvu-r7 commented Oct 4, 2018

I made the distinction because I assumed we wanted to be clear and break down the constants, since we've been going that route. Hardware vs. software was one such distinction. I have a proposed compromise that I think works better.

@bcoles

bcoles approved these changes Oct 4, 2018

@h00die

This comment has been minimized.

Show comment
Hide comment
@h00die

h00die Oct 4, 2018

Contributor

Out of curiosity is there any modules which currently have an audible effect?

Contributor

h00die commented Oct 4, 2018

Out of curiosity is there any modules which currently have an audible effect?

@wvu-r7

This comment has been minimized.

Show comment
Hide comment
@wvu-r7

wvu-r7 Oct 4, 2018

Contributor

Probably. https://holeybeep.ninja/ comes to mind as a vuln. That's a hardware beep, but it's all hardware in the end, usually with some software component. The line is indeed blurry.

Contributor

wvu-r7 commented Oct 4, 2018

Probably. https://holeybeep.ninja/ comes to mind as a vuln. That's a hardware beep, but it's all hardware in the end, usually with some software component. The line is indeed blurry.

@wvu-r7

This comment has been minimized.

Show comment
Hide comment
@wvu-r7

wvu-r7 Oct 4, 2018

Contributor

I updated the constant descriptions (though they're only comments right now), and I think I am happy with them now.

Contributor

wvu-r7 commented Oct 4, 2018

I updated the constant descriptions (though they're only comments right now), and I think I am happy with them now.

@bcoles

This comment has been minimized.

Show comment
Hide comment
@bcoles

bcoles Oct 4, 2018

Contributor

@h00die The lastore_daemon_dbus_priv_esc.rb module installs a system package, resulting in an audible sound.

As per the documentation:

It may cause audio and/or graphical signals confirming the installation of the payload package.
Contributor

bcoles commented Oct 4, 2018

@h00die The lastore_daemon_dbus_priv_esc.rb module installs a system package, resulting in an audible sound.

As per the documentation:

It may cause audio and/or graphical signals confirming the installation of the payload package.
@@ -82,7 +82,9 @@ module Msf
ACCOUNT_LOCKOUTS = 'account-lockouts'
# Module may show something on the screen (Example: a window pops up)
SCREEN_EFFECTS = 'screen-effects'

This comment has been minimized.

@wvu-r7

wvu-r7 Oct 4, 2018

Contributor

@wchen-r7, @bcoles: Where do we want to draw the line with screen effects vs. visual effects vs. what is physical?

@wvu-r7

wvu-r7 Oct 4, 2018

Contributor

@wchen-r7, @bcoles: Where do we want to draw the line with screen effects vs. visual effects vs. what is physical?

This comment has been minimized.

@h00die

h00die Oct 4, 2018

Contributor

Screen being pop up boxes, relics displayed in a browser
Physical being cdrom ejection, scada valve movement
Visual being changing an external LED number display

That's how I'd think, but visual vs screen took a little bit of thinking about

@h00die

h00die Oct 4, 2018

Contributor

Screen being pop up boxes, relics displayed in a browser
Physical being cdrom ejection, scada valve movement
Visual being changing an external LED number display

That's how I'd think, but visual vs screen took a little bit of thinking about

This comment has been minimized.

@wvu-r7

wvu-r7 Oct 4, 2018

Contributor

So are we adding another constant?

@wvu-r7

wvu-r7 Oct 4, 2018

Contributor

So are we adding another constant?

This comment has been minimized.

@wchen-r7

wchen-r7 Oct 5, 2018

Contributor

So for me that means:

SCREEN_EFFECTS: Something the user can see on the screen that allows them to realize the machine is being exploited.
PHYSICAL_EFFECTS: It involves a moving object.
AUDIO_EFFECTS: A noise or sound that allows the user to realize the machine is being exploited.
VISUAL_EFFECT: Kind of sounds like a sub-category of screen_effects. A little hard to draw the line for me.

@wchen-r7

wchen-r7 Oct 5, 2018

Contributor

So for me that means:

SCREEN_EFFECTS: Something the user can see on the screen that allows them to realize the machine is being exploited.
PHYSICAL_EFFECTS: It involves a moving object.
AUDIO_EFFECTS: A noise or sound that allows the user to realize the machine is being exploited.
VISUAL_EFFECT: Kind of sounds like a sub-category of screen_effects. A little hard to draw the line for me.

This comment has been minimized.

@h00die

h00die Oct 5, 2018

Contributor

I'd also add that physical could be a temperature as well. Like a Crock-Pot :)

@h00die

h00die Oct 5, 2018

Contributor

I'd also add that physical could be a temperature as well. Like a Crock-Pot :)

This comment has been minimized.

@bcoles

bcoles Oct 5, 2018

Contributor

I like sinn3r's summary of constants. I think these are solid (note: small edits):

# Module may show something on the screen (Example: a window pops up)
SCREEN_EFFECTS   = 'screen-effects'
# Module may cause a noise (Example: output audio from the speakers or hardware beep)
AUDIO_EFFECTS    = 'audio-effects'
# Module may produce physical effects (Example: the device moves)
PHYSICAL_EFFECTS = 'physical-effects'

The question remains whether an external LED or LCD falls within SCREEN_EFFECTS or a new VISUAL_EFFECTS category.

@bcoles

bcoles Oct 5, 2018

Contributor

I like sinn3r's summary of constants. I think these are solid (note: small edits):

# Module may show something on the screen (Example: a window pops up)
SCREEN_EFFECTS   = 'screen-effects'
# Module may cause a noise (Example: output audio from the speakers or hardware beep)
AUDIO_EFFECTS    = 'audio-effects'
# Module may produce physical effects (Example: the device moves)
PHYSICAL_EFFECTS = 'physical-effects'

The question remains whether an external LED or LCD falls within SCREEN_EFFECTS or a new VISUAL_EFFECTS category.

This comment has been minimized.

@wvu-r7

wvu-r7 Oct 5, 2018

Contributor

Yeah, hardware beeps should go in AUDIO_EFFECTS. We're trying to be specific and at the same time not confusing, heh.

I think I'll change "the device moves" to "the device makes movement," since the implication is that there is movement, not necessarily locomotion.

@wvu-r7

wvu-r7 Oct 5, 2018

Contributor

Yeah, hardware beeps should go in AUDIO_EFFECTS. We're trying to be specific and at the same time not confusing, heh.

I think I'll change "the device moves" to "the device makes movement," since the implication is that there is movement, not necessarily locomotion.

This comment has been minimized.

@wvu-r7

wvu-r7 Oct 5, 2018

Contributor

Pushed. Thoughts?

@wvu-r7

wvu-r7 Oct 5, 2018

Contributor

Pushed. Thoughts?

This comment has been minimized.

@wvu-r7

wvu-r7 Oct 5, 2018

Contributor

@h00die: I removed that because it potentially puts us in hot water. No pun intended.

@wvu-r7

wvu-r7 Oct 5, 2018

Contributor

@h00die: I removed that because it potentially puts us in hot water. No pun intended.

This comment has been minimized.

@wvu-r7

wvu-r7 Oct 5, 2018

Contributor

We've decided to leave VISUAL_EFFECTS out for now. It's a bit too nuanced to be useful right now, IMHO. I think we are in alignment with the current designations.

@wvu-r7

wvu-r7 Oct 5, 2018

Contributor

We've decided to leave VISUAL_EFFECTS out for now. It's a bit too nuanced to be useful right now, IMHO. I think we are in alignment with the current designations.

@bcoles

bcoles approved these changes Oct 5, 2018

@wchen-r7

This comment has been minimized.

Show comment
Hide comment
@wchen-r7

wchen-r7 Oct 5, 2018

Contributor

Nice. Ok this looks good. It looks like this PR has everyone's blessing, so I will go ahead and land this. I'll also remember to document what everyone says here so we're all happy with the definitions. Thank you everyone!

Contributor

wchen-r7 commented Oct 5, 2018

Nice. Ok this looks good. It looks like this PR has everyone's blessing, so I will go ahead and land this. I'll also remember to document what everyone says here so we're all happy with the definitions. Thank you everyone!

@wchen-r7 wchen-r7 merged commit 6efadb5 into rapid7:master Oct 5, 2018

3 checks passed

Metasploit Automation - Sanity Test Execution Successfully completed all tests.
Details
Metasploit Automation - Test Execution Successfully completed all tests.
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details

wchen-r7 added a commit that referenced this pull request Oct 5, 2018

@wchen-r7

This comment has been minimized.

Show comment
Hide comment
@wchen-r7

wchen-r7 Oct 5, 2018

Contributor

Release

This adds the AUDIO_EFFECTS label to keep track of side effects such as audio output from the speakers, or hardware beeps, etc.

Contributor

wchen-r7 commented Oct 5, 2018

Release

This adds the AUDIO_EFFECTS label to keep track of side effects such as audio output from the speakers, or hardware beeps, etc.

@wvu-r7

This comment has been minimized.

Show comment
Hide comment
@wvu-r7

wvu-r7 Oct 5, 2018

Contributor

Thank you, lovely pedants, myself included. :-)

Contributor

wvu-r7 commented Oct 5, 2018

Thank you, lovely pedants, myself included. :-)

@wvu-r7 wvu-r7 deleted the wvu-r7:feature/traits branch Oct 5, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment