Light

Episode #1018 Quiz

THE QUANTUM THREAT
Date: 2025-03-25 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Security Now! Episode 1018 addresses critical security topics including a Windows zero-day exploited by 11 APT groups, a severe remote code execution in Apache Tomcat via session persistence and partial PUT requests, and a maximum severity bypass in ASUS, ASRock, and HPE BMCs.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the primary reason Microsoft has not fixed the exploitation method involving Windows LNK (link) files, despite it being abused by 11 APT groups?

Question 1

What is the primary reason Microsoft has not fixed the exploitation method involving Windows LNK (link) files, despite it being abused by 11 APT groups?

Because the LNK files are rarely used, and the Windows team considers the risk minimal and acceptable. Because Microsoft has already patched the flaw in Windows 11, but threat actors are still exploiting outdated versions. Because the LNK file functionality is essential and cannot be removed without breaking numerous Windows features, so Microsoft maintains the design but advises caution. Because the LNK file format is proprietary and controlled by a third party, so Microsoft cannot make changes to it.

Question 2: What key characteristic of the Apache Tomcat 2025-24813 vulnerability makes it exceptionally dangerous and easy to exploit remotely?

Question 2

What key characteristic of the Apache Tomcat 2025-24813 vulnerability makes it exceptionally dangerous and easy to exploit remotely?

It only requires a single unauthorized PUT request to upload a malicious session file that triggers remote code execution upon deserialization. It exploits a buffer overflow in Tomcat's HTTP GET request parser to execute arbitrary code. It requires prior administrator credential access to enable partial PUT support to upload malicious files. It depends on an undocumented backdoor implemented by a Chinese forum user.

Question 3: According to Espressif's response, why are the so-called 'backdoor' debug commands in the ESP32 chips not considered a security risk?

Question 3

According to Espressif's response, why are the so-called 'backdoor' debug commands in the ESP32 chips not considered a security risk?

The debug commands are encrypted using post-quantum cryptography, preventing unauthorized use. Espressif chips do not contain any debug commands; the diagnosis was a misinterpretation of a hardware fault. The debug commands are present on all versions of the ESP32 and are regularly activated by standard applications without issue. The debug commands are only accessible internally for testing purposes and cannot be triggered remotely via Bluetooth or internet.

Question 4: What approach does Hewlett-Packard propose for addressing the quantum threat to cryptography in embedded devices such as PCs and printers?

Question 4

What approach does Hewlett-Packard propose for addressing the quantum threat to cryptography in embedded devices such as PCs and printers?

Implementing quantum-resistant firmware integrity protection at the hardware level as a foundational defense against future quantum attacks. Deferring migration until quantum computers definitively break current cryptography to avoid premature costs and disruptions. Disabling all asymmetric cryptography in hardware and moving exclusively to symmetric keys managed in software. Replacing all firmware with open-source classical cryptography to enable faster patching in case of quantum breakthroughs.

Question 5: What is the planned timeline in the United States for fully migrating federal systems away from quantum-vulnerable asymmetric cryptography, according to the 2025 executive order and NIST guidance?

Question 5

What is the planned timeline in the United States for fully migrating federal systems away from quantum-vulnerable asymmetric cryptography, according to the 2025 executive order and NIST guidance?

Migration is planned to be completed by 2027 to coincide with upcoming quantum computer breakthroughs. All new government acquisitions must be quantum-resistant from 2027 onward, with all non-migrated products phased out by the end of 2030, and classical asymmetric cryptography disallowed after 2035. There is no formal timeline; migration is encouraged but left to individual agency discretion with no mandatory deadlines. Quantum-vulnerable cryptography may continue indefinitely in federal systems if necessary due to cost and complexity considerations.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.