Light

Episode #1103 Quiz

Exposing Bad Consumer Crypto
Date: 2026-11-03 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

The episode highlights a local-network PXE boot vulnerability in EDK2 UEFI firmware: a 504-byte ICMP buffer overflow can corrupt pre-boot code, potentially bypassing Secure Boot and enabling ring-0 payloads before TPM defenses load. Mitigations include firmware updates, disabling PXE, filtering ICMP, and monitoring logs for exploitation attempts.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the PXE/UEFI vulnerability discussion, what specific limit in the PXE Base Code driver is identified as being exceeded by the malformed ICMP error message?

Question 1

In the PXE/UEFI vulnerability discussion, what specific limit in the PXE Base Code driver is identified as being exceeded by the malformed ICMP error message?

A fixed 256-byte field in the TPM event log A fixed 504-byte field in Mode.IcmpError A fixed 1024-byte field in the Secure Boot policy table A fixed 1500-byte field in the IPv6 packet cache

Question 2: According to the episode, what is the key operational condition required for exploiting CVE-2026-97631?

Question 2

According to the episode, what is the key operational condition required for exploiting CVE-2026-97631?

A compromised Secure Boot signing key in the dbx database Control over a local network during a PXE boot sequence Unauthenticated access from the public Internet to any UEFI device Physical access to the motherboard after the operating system has loaded

Question 3: What did the Binance reporting say about the relationship between the compromised laptop and the final theft mechanism?

Question 3

What did the Binance reporting say about the relationship between the compromised laptop and the final theft mechanism?

It allowed access to a service container that submitted unauthorized withdrawal transactions It injected malware into the public blockchain to reverse confirmed transactions It disabled a hot wallet address by revoking its authorization only after the theft ended It exposed a private key that directly signed all stolen withdrawals

Question 4: What new robots.txt-related mechanism did the major AI vendors agree to adopt for publishers?

Question 4

What new robots.txt-related mechanism did the major AI vendors agree to adopt for publishers?

A mandatory deny-all HTTP header for every AI crawler request A new TLS extension that requires crawler identity attestation A signed DNS record that blocks AI training at the domain level A shared policy token using the User-Agent value __usage_ai-training

Question 5: In the consumer encrypted USB drive analysis, what did the researcher say about the NetacFileLock product’s core cryptographic design flaw?

Question 5

In the consumer encrypted USB drive analysis, what did the researcher say about the NetacFileLock product’s core cryptographic design flaw?

It used per-file ephemeral keys generated from a hardware random source It used a fixed 32-byte AES key embedded in the executable It derived the AES key from the user password with PBKDF2 and a random salt It stored the decrypted master key only inside a TPM-backed hardware enclave

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.