Light

Episode #823 Quiz

TLS Confusion Attacks
Date: 2021-06-15 | Length: 2 hrs | Episode page at twit.tv

About this episode

ALPACA describes TLS application-layer confusion: because TLS authenticates only the TCP session, not the intended service, attackers can MITM-redirect HTTPS to SMTP, IMAP, POP3, or FTP endpoints sharing certificates. Research found 1.4 million vulnerable web servers, enabling cookie theft or JavaScript injection. ALPN is the main mitigation.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In Kaspersky's reconstruction of the Chrome attack chain, which timeline detail most strongly suggested that the attackers were using the second Chromium bug rather than the Pwn2Own bug in the April 14–15 intrusions?

Question 1

In Kaspersky's reconstruction of the Chrome attack chain, which timeline detail most strongly suggested that the attackers were using the second Chromium bug rather than the Pwn2Own bug in the April 14–15 intrusions?

Kaspersky observed that Chrome 90 blocked all renderer-process exploits until the April 20 patch. The April 12 V8 commits were unrelated to the later in-the-wild attacks. Google's April 13 Chrome 89 update had already fixed the Pwn2Own vulnerability on some victim systems. Google's April 14 Chrome 90 release had already removed the regression test for the second bug.

Question 2: What was the main reason Steve gave for why the 1.4 million TLS-confusable web servers remained a practical cross-protocol attack surface despite ALPN being the recommended fix?

Question 2

What was the main reason Steve gave for why the 1.4 million TLS-confusable web servers remained a practical cross-protocol attack surface despite ALPN being the recommended fix?

ALPN can be deployed only by replacing TLS with a newer transport protocol. ALPN works only when the server certificate uses a unique hostname per service. ALPN must be supported and enforced by both clients and every relevant server. ALPN only protects HTTP/2 upgrades and has no role in TLS endpoint negotiation.

Question 3: Which browsers did the researchers say were vulnerable to all of the presented cross-protocol attacks because of content sniffing?

Question 3

Which browsers did the researchers say were vulnerable to all of the presented cross-protocol attacks because of content sniffing?

Edge Legacy and Firefox ESR Chrome and Firefox Internet Explorer and Edge Legacy Safari and Internet Explorer

Question 4: What exact combination of outcomes convinced Steve that the Lenovo laptop's NVMe drive itself was healthy, despite the WHEA error and failed laptop boot?

Question 4

What exact combination of outcomes convinced Steve that the Lenovo laptop's NVMe drive itself was healthy, despite the WHEA error and failed laptop boot?

The drive passed every BIOS test, including the laptop's NVMe read tests. The drive passed Windows startup repair, but only after BitLocker was disabled. The drive decrypted successfully on the original laptop after a BIOS update. The drive read cleanly in Linux, booted in another PC, and appeared readable over USB.

Question 5: According to the episode, what was the key architectural feature of ANOM that let law enforcement monitor all messages without needing remote access to the devices?

Question 5

According to the episode, what was the key architectural feature of ANOM that let law enforcement monitor all messages without needing remote access to the devices?

The proxy servers copied all messages to FBI-controlled servers. The phones synced their chats to a public cloud account that was later subpoenaed. The app used a master key embedded in every phone's SIM card. The devices silently forwarded all messages through a hidden cellular carrier APN.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.