Demonstrations

Twenty working demonstrations of what Attack the Glass looks like from the inside: not a description of a screen that lies to its reader, but a screen that does it while you use it. The last five are the operational surfaces — an election night results board, a harbour traffic console, an airspace picture, a command post display on exercise, and a trading desk watching a crash that is happening on no other screen in the market.

Before you start

Every organization here is invented. Acme Bank, Cascadia Elections, the Port of Westmarch and the rest do not exist. No real company, agency, jurisdiction, port, airport, unit, exchange or person is depicted, no grid, call sign or ticker is a real one, and none of these screens is a real interface.
You are shown the effect, not the method. The component that performs each swap is a labelled black box running on your own device. Nothing here is a recipe, and nothing here would help anyone build one.
Everything runs locally. Each demonstration is self-contained and reaches no other origin. Nothing is sent anywhere, no cookie is set, and nothing is stored on your device.
Nothing persists. Leaving a demonstration or reloading it returns it to its starting state, every time.
None of this touches nDiligence. No demonstration affects this site, and no part of this site was compromised to build them.

One thing here is not realistic, on purpose

Every demonstration below is slowed down. The screen is drawn, you are given a moment to read it, and only then is the content swapped, so that you can watch the change happen. That pause is a teaching device. It is the one part of these demonstrations that does not resemble a real attack.

A real attack has no reason to wait. The swap can run while the page is still being assembled, before anything has reached the screen at all. There is then no moment of change to catch, because nothing changes in front of anyone: the first version the reader ever sees is the altered one, and they have nothing to compare it against.

So do not take the visible swap as the thing to look for. Take it as the only way to show you something that would otherwise leave nothing to see.

Acme Press
The story changes while you read it
A trusted script rewrites the story on the page. The newsroom published one thing; the reader is shown another.
Acme Bank
The amount you approve is not the amount you send
A trusted script changes the amount. The figure the payer reads and the figure the payment carries are not the same figure.
Acme Credit Union
A notice the credit union never wrote
A trusted script adds a notice the credit union never wrote, carrying the credit union's own branding and tone.
Acme Verify
The photo on the record is not the photo on file
A trusted image component returns a different photograph. The record is right and the face is wrong.
Acme Health
The dose on the screen is not the dose that was prescribed
A trusted script changes the dose shown on a medication record. What was prescribed and what is read are different numbers.
Acme Power
The reading stops moving and nobody is told
A trusted widget freezes a live reading. The operator sees a steady system while the system is not steady.
Acme, Inc.
The chart is redrawn before you vote
A trusted chart component redraws the data. The numbers behind it are untouched, so nothing reconciles as wrong.
Acme Lending
The cost of the loan is not on the page
A trusted script removes the cost disclosure. Nothing appears wrong, because what is missing leaves no gap.
Acme Procurement
The bids are in a different order than they were scored
A trusted script reorders the table. Every row is accurate and the ranking is not.
Acme Software
The download button goes somewhere else
A trusted script redirects the download. The page, the name and the version are the vendor's own.
Acme Ethics
The report goes nowhere, and somewhere else first
A trusted script stops a confidential report from arriving, and takes a copy of it on the way.
Acme Card
The control you need is not there
A trusted script removes the dispute control. The right is intact and the means of using it is gone.
Acme Invest
The order is late and the price has moved
A trusted script slows the order down. Nothing fails, and the delay is enough to be expensive.
Acme Ops
The release went to the wrong system
A trusted script changes where a release is sent. The engineer chose staging and production received it.
Acme Benefits
The answer is wrong and the appeal is missing
A trusted script changes the decision and removes the way to challenge it. Two effects, one component.
Cascadia Elections
Every number was right, and the page still read the wrong winner
A results board where nothing is altered except which true number your eye lands on: type size, opacity, colour, visual order, and one notice moved out of sight.
Port of Westmarch
One track was changed and forty-seven movements moved
A whole-port traffic picture with one contact out of 148 redrawn, and a movement planner that correctly re-sequences the entire harbour around it.
Meridian Approach
Nine drones arrive, and one aircraft leaves the screen
A terminal airspace picture where nine phantom drones converge on the runway threshold from nine bearings while, in the same repaint, the one aircraft that mattered is removed from the display.
JTF Orion
Five changes on a board holding forty-three tracks
An exercise command post picture with a unit displaced, a hostile element reframed as neutral and stopped, a depleted platoon shown as green, a message nobody sent, and a troops-in-contact alert nothing generated.
Northgate Markets
A crash that only existed on one screen
A trading desk where one market-data component rewrites fifty values at once — the index chart, every quote, the desk's own P&L — and the trader's correct response to the false picture starts a real dislocation.