Demonstrations
Twenty working demonstrations of what Attack the Glass looks like from the inside: not a description of a screen that lies to its reader, but a screen that does it while you use it. The last five are the operational surfaces: an election night results board, a harbour traffic console, an airspace picture, a command post display on exercise, and a trading desk watching a crash that is happening on no other screen in the market.
Before you start
- Every organization here is invented. Acme Bank, Acme Maritime, Cascadia Elections and the rest do not exist. No real company, agency, jurisdiction, port, airport, unit, exchange or person is depicted, no grid, call sign or ticker is a real one, and none of these screens is a real interface.
- You are shown the effect, not the method. The component that performs each swap is a labelled black box running on your own device. Nothing here is a recipe, and nothing here would help anyone build one.
- Everything runs locally. Each demonstration is self-contained and reaches no other origin. Nothing is sent anywhere, no cookie is set, and nothing is stored on your device.
- Nothing persists. Leaving a demonstration or reloading it returns it to its starting state, every time.
- None of this touches nDiligence. No demonstration affects this site, and no part of this site was compromised to build them.
One thing here is not realistic, on purpose
Every demonstration is slowed down. The screen is drawn, you get a moment to read it, and only then is the content swapped, so you can watch it happen. That pause is a teaching device, and the one part of these demonstrations that does not resemble a real attack.
A real attack has no reason to wait. The swap can run before anything reaches the screen, so the first version the reader ever sees is the altered one, and they have nothing to compare it against.
Do not take the visible swap as the thing to look for. It is the only way to show you something that would otherwise leave nothing to see.
Acme Press
The story changes while you read it
A trusted script rewrites the story on the page. The newsroom published one thing; the reader is shown another.
Acme Bank
The amount you approve is not the amount you send
A trusted script changes the amount. The figure the payer reads and the figure the payment carries are not the same figure.
Acme Credit Union
A notice the credit union never wrote
A trusted script adds a notice the credit union never wrote, carrying the credit union's own branding and tone.
Acme Verify
The photo on the record is not the photo on file
A trusted image component returns a different photograph. The record is right and the face is wrong.
Acme Health
The dose on the screen is not the dose that was prescribed
A trusted script changes the dose shown on a medication record. What was prescribed and what is read are different numbers.
Acme Power
The reading stops moving and nobody is told
A trusted widget freezes a live reading. The operator sees a steady system while the system is not steady.
Acme, Inc.
The chart is redrawn before you vote
A trusted chart component redraws the data. The numbers behind it are untouched, so nothing reconciles as wrong.
Acme Lending
The cost of the loan is not on the page
A trusted script removes the cost disclosure. Nothing appears wrong, because what is missing leaves no gap.
Acme Procurement
The bids are in a different order than they were scored
A trusted script reorders the table. Every row is accurate and the ranking is not.
Acme Software
The download button goes somewhere else
A trusted script redirects the download. The page, the name and the version are the vendor's own.
Acme Ethics
The report goes nowhere, and somewhere else first
A trusted script stops a confidential report from arriving, and takes a copy of it on the way.
Acme Card
The control you need is not there
A trusted script removes the dispute control. The right is intact and the means of using it is gone.
Acme Invest
The order is late and the price has moved
A trusted script slows the order down. Nothing fails, and the delay is enough to be expensive.
Acme Ops
The release went to the wrong system
A trusted script changes where a release is sent. The engineer chose staging and production received it.
Acme Benefits
The answer is wrong and the appeal is missing
A trusted script changes the decision and removes the way to challenge it. Two effects, one component.
Cascadia Elections
Every number was right, and the page still read the wrong winner
A results board where nothing is altered except which true number your eye lands on: type size, opacity, colour, visual order, and one notice moved out of sight.
Acme Maritime
One track was changed and forty-seven movements moved
A whole-port traffic picture with one contact out of 148 redrawn, and a movement planner that correctly re-sequences the entire harbour around it.
Acme Airport
Nine drones arrive, and one aircraft leaves the screen
A terminal airspace picture where nine phantom drones converge on the runway threshold from nine bearings while, in the same repaint, the one aircraft that mattered is removed from the display.
Acme Defense
Five changes on a board holding forty-three tracks
An exercise command post picture with a unit displaced, a hostile element reframed as neutral and stopped, a depleted platoon shown as green, a message nobody sent, and a troops-in-contact alert nothing generated.
Acme Market Watch
A crash that only existed on one screen
A trading desk where one market-data component rewrites fifty values at once — the index chart, every quote, the desk's own P&L — and the trader's correct response to the false picture starts a real dislocation.
