Light

Episode #831 Quiz

Apple's CSAM Mistake
Date: 2021-08-10 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Bishop Fox found many IoT devices mishandle hardware RNG APIs by ignoring failure codes when entropy is exhausted, yielding zeroes or uninitialized memory and breaking TLS keys. Separate flaws affected Pulse Secure and Cisco VPN appliances. Forescout/JFrog exposed 14 NicheStack bugs enabling RCE, DoS, spoofing, and cache poisoning.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the episode’s description of the IoT RNG flaw, what specific failure mode did the researchers identify in many SDKs and IoT OSes when calling the hardware RNG API?

Question 1

In the episode’s description of the IoT RNG flaw, what specific failure mode did the researchers identify in many SDKs and IoT OSes when calling the hardware RNG API?

The API generated weak output only after a device reboot The API returned a failure status that was routinely ignored by callers The API always blocked until enough entropy accumulated The API produced duplicate output because the whitening stage was disabled

Question 2: What did the episode identify as the primary exploitable reason the Pulse Secure Connect Secure flaw could fail open into remote code execution?

Question 2

What did the episode identify as the primary exploitable reason the Pulse Secure Connect Secure flaw could fail open into remote code execution?

A buffer overflow in the remote login banner parser A malformed certificate chain that bypassed mutual TLS verification A SQL injection in the appliance’s reporting database An uncontrolled archive extraction that could overwrite arbitrary files

Question 3: For the Cisco VPN router vulnerabilities discussed in the episode, what was the default state of the remote management WAN interface?

Question 3

For the Cisco VPN router vulnerabilities discussed in the episode, what was the default state of the remote management WAN interface?

It was disabled by default It was only reachable after local console authentication It required manual certificate enrollment before becoming reachable It was enabled by default

Question 4: In the NicheStack / INFRA:HALT discussion, what did the episode say about the DNS packet parsing flaw involving compression pointers?

Question 4

In the NicheStack / INFRA:HALT discussion, what did the episode say about the DNS packet parsing flaw involving compression pointers?

It failed to verify that the pointer stayed within the packet bounds It failed to verify that the response used a valid EDNS0 extension It failed to verify that the query name was lowercase before parsing It failed to verify that the packet used IPv6 compression correctly

Question 5: Which statement best captures the distinction Steve drew between Apple’s two newly announced systems in this episode?

Question 5

Which statement best captures the distinction Steve drew between Apple’s two newly announced systems in this episode?

CSAM Detection scans iCloud-bound photos against a local hash database, while Communication Safety filters messaging images for child accounts CSAM Detection only examines images after Apple decrypts them on its servers, while Communication Safety only examines text messages CSAM Detection filters messaging images for child accounts, while Communication Safety scans iCloud-bound photos against a local hash database CSAM Detection is opt-in for family-sharing child accounts, while Communication Safety is mandatory for all users

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.