Light

Episode #1041 Quiz

Covering All the Bases
Date: 2025-09-02 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Security Now! Episode 1041 reviews caller authentication via SHAKEN & STIR protocols enforced by the FCC after slow adoption to combat robocalls.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the primary mechanism by which the SHAKEN & STIR protocols authenticate phone calls in VoIP systems?

Question 1

What is the primary mechanism by which the SHAKEN & STIR protocols authenticate phone calls in VoIP systems?

By using IP address filtering to block spoofed source addresses. By employing caller ID database lookups against known spam numbers. By attaching digital certificates to the SIP signaling messages to verify call origin. By encrypting the voice payload to ensure call integrity.

Question 2: How did attackers leverage AI during the supply chain attack involving the NX tool's compromised npm packages?

Question 2

How did attackers leverage AI during the supply chain attack involving the NX tool's compromised npm packages?

They used AI to create deepfake videos to distract security teams during the attack. They used AI to generate phishing emails to spread the NX malware further. They instructed local AI tools to scan the infected machine's filesystem for sensitive keys and upload encrypted data to GitHub repositories. They employed AI models hosted in the cloud to perform distributed denial-of-service attacks on security firms.

Question 3: What was the key enforcement action taken by the FCC in 2025 regarding the SHAKEN & STIR protocols?

Question 3

What was the key enforcement action taken by the FCC in 2025 regarding the SHAKEN & STIR protocols?

Passed legislation forcing consumers to manually verify caller identities using physical tokens. Terminated more than 1,200 voice service providers from the U.S. telephone network for failing to implement robocall mitigations. Mandated the shutdown of all VoIP providers that did not integrate STIR with blockchain for call verification. Required that all handset manufacturers embed STIR & SHAKEN validation chips in phones by 2025.

Question 4: What is the stated inherent difficulty in controlling AI output as described in the episode's analogy?

Question 4

What is the stated inherent difficulty in controlling AI output as described in the episode's analogy?

AI output control is trivial because rules can be hard-coded to block inappropriate responses. AI information is stored holographically, meaning knowledge is distributed and cannot be easily edited or removed from a single location. AI models use a centralized database which can be manually filtered to restrict undesirable content. AI knowledge is stored in discrete facts that are easy to locate and edit, like a text document.

Question 5: According to the episode, what vulnerability was exploited in WhatsApp that enabled delivery of the recent Apple zero-day exploit?

Question 5

According to the episode, what vulnerability was exploited in WhatsApp that enabled delivery of the recent Apple zero-day exploit?

WhatsApp used outdated SSL certificates that were easily spoofed to deliver malicious payloads. A buffer overflow in WhatsApp's audio message processing allowed remote code execution. Incomplete authorization of linked device synchronization messages allowed unsolicited content processing from arbitrary URLs. WhatsApp failed to encrypt message contents, allowing man-in-the-middle injection of malicious code.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.