Light

Episode #1017 Quiz

Is YOUR System Vulnerable to Rowhammer?
Date: 2025-03-18 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Episode 1017 explores the ongoing threat of Rowhammer attacks, highlighting a new large-scale testing framework from the Chaos Computer Club that uses an Arch Linux ISO to assess system vulnerability.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the primary reason the cryptographers described Telegram's key exchange protocols as requiring unstudied cryptographic assumptions in their security proofs?

Question 1

What is the primary reason the cryptographers described Telegram's key exchange protocols as requiring unstudied cryptographic assumptions in their security proofs?

Telegram avoided the use of any cryptographic primitives, relying on plain text messaging. Telegram's protocols rely solely on public-key cryptography without any symmetric encryption components. Telegram implements a proprietary, well-studied key exchange algorithm proven secure by modular design. Telegram uses the outdated and collision-prone SHA-1 hash function and lacks proper key derivation functions.

Question 2: Why does Comcast's router prevent users from accessing local servers by name due to disabling hairpin NAT?

Question 2

Why does Comcast's router prevent users from accessing local servers by name due to disabling hairpin NAT?

Because Comcast's router firmware is outdated and simply cannot resolve any hostnames for internal servers. Because Comcast requires all devices to use IPv6 addressing, which breaks legacy name resolution. Because Comcast disables hairpin NAT to prevent internal network traffic from looping back through the external IP, blocking name-based access internally. Because Comcast enforces strict DNS filtering that resolves local server names only externally, blocking all internal requests.

Question 3: What key finding regarding Windows' Unicode "Best-Fit" conversion contributed to the PHP-CGI remote code execution vulnerability CVE-2024-4577?

Question 3

What key finding regarding Windows' Unicode "Best-Fit" conversion contributed to the PHP-CGI remote code execution vulnerability CVE-2024-4577?

PHP-CGI was insecure only on Linux systems, as Windows handles Unicode differently and safely. Windows' Best-Fit conversion was disabled by default, preventing PHP from executing arbitrary code remotely. Windows' Best-Fit Unicode conversion translates crafted characters to bypass a 2012 fix, enabling argument injection attacks on PHP-CGI. The vulnerability was due to a recently introduced Windows Unicode feature unrelated to Best-Fit conversion.

Question 4: What is the main purpose of the open source flippyr.am Rowhammer testing framework introduced at the Chaos Communication Congress?

Question 4

What is the main purpose of the open source flippyr.am Rowhammer testing framework introduced at the Chaos Communication Congress?

To replace the existing DRAM refresh standard with a new hardware-based Rowhammer mitigation technique. To provide a commercial tool for repairing DDR5 DRAM modules vulnerable to Rowhammer attacks. To demonstrate a browser-based JavaScript exploit against Rowhammer attack mitigation. To enable large-scale, real-world testing and data collection on the prevalence of Rowhammer vulnerability across many systems.

Question 5: According to the episode, what challenge does Google's refusal to confirm or deny receipt of UK government Technical Capability Notices (TCNs) pose?

Question 5

According to the episode, what challenge does Google's refusal to confirm or deny receipt of UK government Technical Capability Notices (TCNs) pose?

It implies Google has received such secret orders and prevents congressional oversight of foreign government demands. It enables Google to operate independently of UK law and refuse any technical capability demands. It allows Google to publicly discuss the details and legal arguments about complying with UK encryption orders. It confirms that Google has not received any TCNs, thereby assuring user privacy in the UK.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.