Light

Episode #1016 Quiz

The Bluetooth Backdoor
Date: 2025-03-11 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Security Now! Episode 1016 discusses Apple’s upcoming Declared Age Range API for age verification, balancing privacy by sharing age ranges with parental control rather than exact birthdates, addressing legislative pressure.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What primary reason does Steve Gibson give for why undisclosed commands found in the ESP32 Bluetooth chip do not constitute a true backdoor vulnerability?

Question 1

What primary reason does Steve Gibson give for why undisclosed commands found in the ESP32 Bluetooth chip do not constitute a true backdoor vulnerability?

The chip has a hardware firewall preventing any unauthorized use of undocumented commands, blocking exploitation. The undocumented commands only affect WiFi functionality, not Bluetooth, so risk is minimal. The commands are fully documented and openly available, so they cannot be secret. The commands are not remotely accessible and require physical hardware access to be used, limiting threat feasibility.

Question 2: According to the episode, what age verification approach is Apple proposing to enhance privacy while still allowing app developers to enforce age-appropriate content?

Question 2

According to the episode, what age verification approach is Apple proposing to enhance privacy while still allowing app developers to enforce age-appropriate content?

Disabling any age verification and using IP-based geolocation to infer age restrictions. Requiring all users to upload government-issued IDs at the App Store level for universal verification. A Declared Age Range API that shares only an age range, controlled by parents, instead of exact birthdates. Using an external third-party verifier that collects and stores exact birthdates and distributes them to apps.

Question 3: In the investigation of fake North Korean remote programmers, what was a primary method used to differentiate these fake employees during interviews?

Question 3

In the investigation of fake North Korean remote programmers, what was a primary method used to differentiate these fake employees during interviews?

Conducting simultaneous background checks on real-time web browsing activity. Requiring live code demonstrations under time constraints to verify skill. Requesting government-issued ID verification during the interview digitally. Asking culturally specific questions that a local resident would easily answer, but a foreigner might fail.

Question 4: What vulnerability allowed the North Korean hackers to infiltrate the Safe{Wallet} multi-signature wallet provider, leading to the Bybit heist?

Question 4

What vulnerability allowed the North Korean hackers to infiltrate the Safe{Wallet} multi-signature wallet provider, leading to the Bybit heist?

A zero-day flaw in Safe{Wallet}'s underlying blockchain protocol allowing unauthorized transfers. Compromised Ledger hardware wallets due to outdated firmware allowing silent key extraction. Exploitation of a buffer overflow vulnerability in Safe{Wallet}'s web user interface. A social engineering attack that caused a developer to run a malicious Docker file which stole AWS credentials.

Question 5: Regarding the ransomware attack studied involving the Akira group, how did the attackers successfully deploy ransomware despite the presence of strong endpoint detection and response (EDR) on Windows machines?

Question 5

Regarding the ransomware attack studied involving the Akira group, how did the attackers successfully deploy ransomware despite the presence of strong endpoint detection and response (EDR) on Windows machines?

They deployed Linux-based ransomware on unprotected IoT devices such as webcams which had known vulnerabilities. They used stolen administrator credentials to disable all antivirus and EDR modules on the network. They exploited a zero-day vulnerability in the Windows EDR to bypass detection and execute the ransomware directly. They physically accessed the Windows servers and planted hardware keyloggers to facilitate infection.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.