Light

Episode #840 Quiz

0-Day Angst
Date: 2021-10-12 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Microsoft will disable Excel 4.0 XLM macros by default only for Microsoft 365, despite their abuse by malware; admins can disable them via group policy or Excel Trust Center. Google is auto-enrolling 150 million accounts into two-step verification. Apple patched an exploited iOS kernel framebuffer flaw.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: Which registry value did Steve describe as Microsoft's official way to allow Windows 11 upgrades on machines with unsupported TPM or CPU checks?

Question 1

Which registry value did Steve describe as Microsoft's official way to allow Windows 11 upgrades on machines with unsupported TPM or CPU checks?

BypassUnsupportedTPMAndCPU AllowUpgradesWithUnsupportedTPMOrCPU SkipTPMandCPUCompatibilityCheck EnableWindows11OnLegacyHardware

Question 2: What was the key configuration detail of Google's first two-step verification rollout for the 150 million accounts it planned to auto-enroll?

Question 2

What was the key configuration detail of Google's first two-step verification rollout for the 150 million accounts it planned to auto-enroll?

It targeted only accounts using hardware security keys and desktop browsers It targeted all Gmail users regardless of device or recovery settings It targeted accounts with modern Android phones and existing backup mechanisms It targeted only users who had already enabled app-based TOTP authentication

Question 3: According to the episode, what did Google tell the 14,000 Gmail users it warned about the spear-phishing campaign?

Question 3

According to the episode, what did Google tell the 14,000 Gmail users it warned about the spear-phishing campaign?

Government-backed attackers may be trying to steal your password Your account has already been compromised by Fancy Bear A malicious attachment has been quarantined from your inbox Your recovery phone number is no longer valid for sign-in

Question 4: What technical condition made the Apache 2.4.49 flaw especially dangerous on affected servers?

Question 4

What technical condition made the Apache 2.4.49 flaw especially dangerous on affected servers?

HTTP/2 enabled and server-side includes active Reverse proxying enabled and weak ciphers accepted TLS 1.3 enabled and directory listings exposed mod-cgi enabled and require all denied absent

Question 5: What specific source of data did the Twitch leaker say was the first batch of the breach?

Question 5

What specific source of data did the Twitch leaker say was the first batch of the breach?

A public S3 bucket at twitch-assets.amazonaws.com A compromised CDN log archive at logs.twitchcdn.net A leaked employee mailbox backup at mail.twitch.internal An internal Git server at git-aws.internal.justin.tv

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.