Light

Episode #1012 Quiz

Hiding School Cyberattacks
Date: 2025-02-11 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

Episode Security Now! #1012 highlights the discovery of the SparkCat trojan in official app stores, which steals cryptocurrency wallet data by using optical character recognition on photos, illustrating evolving malware risks.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the Security Now! episode, how does the SparkCat malware primarily steal cryptocurrency wallet data from infected smartphones?

Question 1

According to the Security Now! episode, how does the SparkCat malware primarily steal cryptocurrency wallet data from infected smartphones?

By requesting permissions to access users' photo galleries and using OCR to find valuable text like seed phrases in images. By scanning the clipboard for copied wallet addresses and replacing them with attacker addresses. By monitoring network traffic for unencrypted wallet data being transmitted from the device. By exploiting vulnerabilities in legitimate wallet apps to extract stored keys from app memory.

Question 2: What is the central reason cited in the episode for K-12 schools in the U.S. frequently hiding details of ransomware cyberattacks from students, parents, and staff?

Question 2

What is the central reason cited in the episode for K-12 schools in the U.S. frequently hiding details of ransomware cyberattacks from students, parents, and staff?

To limit legal exposure and financial liability through attorney-client privilege and insurance negotiations facilitated by breach coaches and lawyers. Because law enforcement advises schools to remain silent to avoid compromising ongoing investigations. To protect sensitive student information from being leaked to cybercriminals. Because federal laws prohibit schools from revealing any cybersecurity incidents.

Question 3: In the episode, what technical reason was given for why Microsoft Sysinternals utilities are vulnerable to DLL hijacking attacks?

Question 3

In the episode, what technical reason was given for why Microsoft Sysinternals utilities are vulnerable to DLL hijacking attacks?

They rely on Windows' default DLL search order, which prioritizes loading DLLs from the application's directory, allowing malicious DLLs placed there to be loaded first. They dynamically download DLLs from the internet at runtime without verification, exposing attack surface. They load required system DLLs exclusively from secure system directories, preventing injection. They ship bundled malicious DLLs with the utilities, causing built-in security flaws.

Question 4: What did the Security Now! episode describe as a promising technological alternative to government-mandated encryption backdoors for combating child abuse material (CSAM) without weakening end-to-end encryption?

Question 4

What did the Security Now! episode describe as a promising technological alternative to government-mandated encryption backdoors for combating child abuse material (CSAM) without weakening end-to-end encryption?

Employing mandatory keyword-based client-side scanning that matches against known hash libraries stored on devices. Forcing companies to build universal backdoors into encryption protocols accessible by law enforcement and governments. Using on-device AI systems to locally detect and block transmission of abusive content without decrypting or accessing stored data in the cloud. Requiring users to upload all their encrypted data to government servers for scanning and verification.

Question 5: Regarding the UK's 2025 legal demand to Apple described in the episode, what is the nature and scope of the 'technical capability notice' issued under the UK Investigatory Powers Act?

Question 5

Regarding the UK's 2025 legal demand to Apple described in the episode, what is the nature and scope of the 'technical capability notice' issued under the UK Investigatory Powers Act?

It requires Apple to provide access to decrypted data only for specific UK user accounts upon local warrants. It compels Apple to create a universal backdoor allowing UK authorities to access fully encrypted cloud data of any Apple user globally without user consent or knowledge. It mandates Apple to stop offering any encryption services in the UK and delete all encrypted user data from UK users' accounts. It orders Apple to disclose the technical design of its end-to-end encryption mechanisms to the UK government for audit purposes only.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.