Light

Episode #1079 Quiz

Daybreak and Codename MDASH
Date: 2026-05-19 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Security Now! #1079 covers Microsoft Edge’s initial insecure design of storing plaintext passwords in RAM, later fixed to reduce exposure. It details a local BitLocker bypass named YellowKey exploiting Windows Recovery environment loading to access encrypted drives without credentials, mitigated by BitLocker PIN and BIOS passwords.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the initial Microsoft Edge behavior regarding password storage in RAM, and how did Microsoft respond upon media exposure?

Question 1

What was the initial Microsoft Edge behavior regarding password storage in RAM, and how did Microsoft respond upon media exposure?

Edge never stored passwords in RAM; the claim was refuted by Microsoft and no changes were made. Edge stored all saved passwords in cleartext RAM on startup as intended behavior, but Microsoft quickly updated Edge to stop this after public scrutiny. Edge encrypted passwords in RAM by default, and Microsoft confirmed this was the correct behavior after researcher reports. Edge stored passwords in RAM but only for the current user session; Microsoft justified this as a secure practice and still maintains it.

Question 2: Regarding the BitLocker bypass vulnerability (YellowKey) disclosed by Chaotic Eclipse, what is the primary mitigation recommended by security researchers?

Question 2

Regarding the BitLocker bypass vulnerability (YellowKey) disclosed by Chaotic Eclipse, what is the primary mitigation recommended by security researchers?

Encrypting the EFI partition with a secondary key to block YellowKey exploit that targets EFI partition files. Relying on TPM-only BitLocker configurations without a PIN, as these are less vulnerable to the bypass. Disabling TPM integration to eliminate automatic unlocking and force manual password entry every boot. Using a BitLocker PIN combined with a BIOS password lock to prevent unauthorized access via the recovery environment.

Question 3: What distinguishes Microsoft’s multi-model agentic scanning harness (Codename MDASH) from single-model AI vulnerability scanners?

Question 3

What distinguishes Microsoft’s multi-model agentic scanning harness (Codename MDASH) from single-model AI vulnerability scanners?

MDASH relies solely on a single advanced large language model trained on Windows kernel source code for vulnerability discovery. MDASH orchestrates over 100 specialized AI agents across multiple models for discovery, debate, validation, and exploitation proof, improving coverage and precision. MDASH performs only static analysis without executing or dynamically validating found vulnerabilities. MDASH only scans user mode applications, ignoring kernel and network stacks to reduce false positives.

Question 4: How does Microsoft’s threat modeling for Edge relate to the password storage vulnerability discovered by Tom Rønning?

Question 4

How does Microsoft’s threat modeling for Edge relate to the password storage vulnerability discovered by Tom Rønning?

Microsoft’s threat model assumes any user account, even non-admin, cannot access Edge passwords in memory. Microsoft considers attacks requiring capturing passwords from RAM as within the threat model only if the attacker already has administrative control. Microsoft’s threat model excludes scenarios where an attacker has administrative control and focuses on network remote attacks. Microsoft initially considered saving passwords in RAM a vulnerability outside their expected threat model.

Question 5: According to the episode, what risk arises from using AI to generate production websites without security expertise?

Question 5

According to the episode, what risk arises from using AI to generate production websites without security expertise?

AI-generated sites are more secure because they avoid human coding errors and reduce attack surface. AI always applies strict security controls automatically, so site creators without background are not at risk of exposure. AI-created websites inherently use outdated cryptography that is easily broken by attackers. AI-generated sites may inadvertently expose secret API keys in publicly accessible JavaScript, enabling attackers to hijack services or run up costs.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.