Light

Episode #1040 Quiz

Clickjacking "Whac-A-Mole"
Date: 2025-08-26 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

This episode analyzed a recent DEFCON 33 revelation of DOM-based clickjacking vulnerabilities in browser extensions for password managers like 1Password and Bitwarden, demonstrating how malicious sites trick users into autofilling sensitive data via hidden overlays. Despite patches, complete mitigation remains elusive due to usability-security trade-offs, underscoring inherent risks in browser-based autofill amid complex web interactions.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What legal argument is being used by Axel Springer in Germany's Federal Supreme Court case against Eyeo's Adblock Plus?

Question 1

What legal argument is being used by Axel Springer in Germany's Federal Supreme Court case against Eyeo's Adblock Plus?

That ad blockers cause unfair competition under antitrust laws by depriving publishers of revenue. That ad blockers violate consumer privacy laws by collecting personal data without consent. That ad blockers use patented technology owned by Axel Springer without licensing. That the website's HTML/CSS is a protected computer program, and modifying it via ad blockers infringes on exclusive copyright rights.

Question 2: According to the episode, why is the recent clickjacking zero-day vulnerability affecting browser password managers considered an ongoing "Whac-A-Mole" problem?

Question 2

According to the episode, why is the recent clickjacking zero-day vulnerability affecting browser password managers considered an ongoing "Whac-A-Mole" problem?

Because the vulnerability exploits unknown hardware flaws that cannot be patched by software updates. Because it requires all users to switch to non-browser-based password managers, which is impractical. Because password managers have refused to address any known vulnerabilities despite repeated warnings. Because new clickjacking techniques continually emerge without comprehensive, practical fixes due to browser architecture and usability trade-offs.

Question 3: Why did Bluesky suspend its service in Mississippi as discussed in the episode?

Question 3

Why did Bluesky suspend its service in Mississippi as discussed in the episode?

Because of repeated hacking attempts targeting Bluesky users in Mississippi exploiting vulnerabilities in the app. Because Bluesky wanted to protest the lack of online child safety regulations in Mississippi. Because Mississippi blocked Bluesky's IP addresses due to misconfigured geolocation policies. Because Mississippi's age verification law mandates all users perform age checks and data collection, imposing costly compliance burdens unsuited to Bluesky's small team.

Question 4: What is the core reason the episode gives for the criticality of the recently patched Apple vulnerability CVE-2025-43300?

Question 4

What is the core reason the episode gives for the criticality of the recently patched Apple vulnerability CVE-2025-43300?

A denial-of-service vulnerability that causes Apple's devices to crash when loading certain images. An authentication bypass vulnerability in iCloud that leaks user passwords to attackers over the network. A privilege escalation bug affecting the MacOS file system drivers allowing local users to gain root access. A zero-click remote code execution flaw in Apple's JPEG Lossless Decompression code allowing silent compromise when processing malicious images.

Question 5: What key security practice does the episode emphasize based on the Docker Desktop escape vulnerability CVE-2025-9074?

Question 5

What key security practice does the episode emphasize based on the Docker Desktop escape vulnerability CVE-2025-9074?

Use an outdated Docker version where no such vulnerabilities were discovered yet. Use only containers running on non-Windows hosts to avoid Docker escape vulnerabilities. Disable Docker's HTTP API completely to prevent any external container communications. Authenticate all control-plane API endpoints and enforce network segmentation; never trust internal interfaces by default.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.