Add AUDIO_EFFECTS to distinguish from others

[wvu]

Constant	Description
SCREEN_EFFECTS	Module may show something on the screen (Example: a window pops up)
AUDIO_EFFECTS	Module may cause a noise (Examples: audio output from the speakers or hardware beeps)
PHYSICAL_EFFECTS	Module may produce physical effects (Examples: the device makes movement or flashes LEDs)

Updates #10707.

[jrobles-r7]

wasn't there physical effects?

[bcoles]

Looks good to me.

I think a separate constant for AUDIO is beneficial, but do we need/want this distinction between software/hardware audio?

This line gets blurry, as some systems will emit a beep from the internal speaker if no audio device is configured.

# Module may cause software to output audio from the speakers (Example: the app plays music)
AUDIO_EFFECTS          = 'audio-effects'
# Module may produce physical effects in hardware (Examples: LED or LCD changes or hardware beeps)
PHYSICAL_EFFECTS       = 'physical-effects'

[wvu]

I made the distinction because I assumed we wanted to be clear and break down the constants, since we've been going that route. Hardware vs. software was one such distinction. I have a proposed compromise that I think works better.

[h00die]

Out of curiosity is there any modules which currently have an audible effect?

[wvu]

Probably. https://holeybeep.ninja/ comes to mind as a vuln. That's a hardware beep, but it's all hardware in the end, usually with some software component. The line is indeed blurry.

[wvu]

I updated the constant descriptions (though they're only comments right now), and I think I am happy with them now.

[bcoles]

@h00die The lastore_daemon_dbus_priv_esc.rb module installs a system package, resulting in an audible sound.

As per the documentation:

It may cause audio and/or graphical signals confirming the installation of the payload package.

[wvu]

@wchen-r7, @bcoles: Where do we want to draw the line with screen effects vs. visual effects vs. what is physical?

[h00die]

Screen being pop up boxes, relics displayed in a browser
Physical being cdrom ejection, scada valve movement
Visual being changing an external LED number display

That's how I'd think, but visual vs screen took a little bit of thinking about

[wvu]

So are we adding another constant?

[wchen-r7]

So for me that means:

SCREEN_EFFECTS: Something the user can see on the screen that allows them to realize the machine is being exploited.
PHYSICAL_EFFECTS: It involves a moving object.
AUDIO_EFFECTS: A noise or sound that allows the user to realize the machine is being exploited.
VISUAL_EFFECT: Kind of sounds like a sub-category of screen_effects. A little hard to draw the line for me.

[h00die]

I'd also add that physical could be a temperature as well. Like a Crock-Pot :)

[bcoles]

I like sinn3r's summary of constants. I think these are solid (note: small edits):

# Module may show something on the screen (Example: a window pops up)
SCREEN_EFFECTS   = 'screen-effects'
# Module may cause a noise (Example: output audio from the speakers or hardware beep)
AUDIO_EFFECTS    = 'audio-effects'
# Module may produce physical effects (Example: the device moves)
PHYSICAL_EFFECTS = 'physical-effects'

The question remains whether an external LED or LCD falls within SCREEN_EFFECTS or a new VISUAL_EFFECTS category.

[wvu]

Yeah, hardware beeps should go in AUDIO_EFFECTS. We're trying to be specific and at the same time not confusing, heh.

I think I'll change "the device moves" to "the device makes movement," since the implication is that there is movement, not necessarily locomotion.

[wvu]

Pushed. Thoughts?

[wvu]

@h00die: I removed that because it potentially puts us in hot water. No pun intended.

[wvu]

We've decided to leave VISUAL_EFFECTS out for now. It's a bit too nuanced to be useful right now, IMHO. I think we are in alignment with the current designations.

[wchen-r7]

Nice. Ok this looks good. It looks like this PR has everyone's blessing, so I will go ahead and land this. I'll also remember to document what everyone says here so we're all happy with the definitions. Thank you everyone!

[wchen-r7]

Release Notes

This adds the AUDIO_EFFECTS label to keep track of side effects, such as audio output from speakers or hardware beeps.

[wvu]

Thank you, lovely pedants, myself included. :-)