Light

Episode #874 Quiz

Passkeys, Take 2
Date: 2022-06-07 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

ServiceNSW denied its Digital Driver’s License could be tampered with, claiming police scans verify backend DRIVES data and that edits are illegal. ExpressVPN withdrew India servers over mandatory five-year retention of names, contact details, and assigned IPs, plus six-hour breach reporting. Follina exploitation, search-ms abuse, and UEFI firmware attacks deepen Windows risk.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode’s discussion of the ServiceNSW response, what did the agency claim would happen if a tampered Digital Driver’s License were scanned by NSW Police?

Question 1

According to the episode’s discussion of the ServiceNSW response, what did the agency claim would happen if a tampered Digital Driver’s License were scanned by NSW Police?

The backend would be altered and expose customer records to the police device. The tampering would remain invisible because the license is fully offline and self-contained. The real-time check would call DRIVES and show the correct personal information. The scanner would refuse the card because the local device hash would no longer validate.

Question 2: What new requirement from India’s CERT led ExpressVPN to remove its India-based VPN servers?

Question 2

What new requirement from India’s CERT led ExpressVPN to remove its India-based VPN servers?

Limiting all VPN logs to a maximum retention period of six hours after collection. Routing all India traffic only through government-approved domestic data centers. Storing subscribers’ real names, contact details, and assigned IP addresses for five years. Publishing all VPN session metadata to a public transparency portal within 24 hours.

Question 3: How did the Syria exam blackouts described in the episode actually remove the country from the Internet during exams?

Question 3

How did the Syria exam blackouts described in the episode actually remove the country from the Internet during exams?

By disabling mobile towers and leaving fixed broadband untouched. By encrypting all national traffic and requiring a decryption key from schools. By shutting off submarine cables feeding the country during test hours. By removing Syria’s routing from the global Internet using BGP.

Question 4: What was the key mechanism behind the new Windows/Word attack involving the search-ms:// handler?

Question 4

What was the key mechanism behind the new Windows/Word attack involving the search-ms:// handler?

A PDF viewer bug caused remote files to be mounted as local executables automatically. A browser sandbox escape let the document overwrite search results in Explorer. A macro execution bug launched PowerShell directly from the document without user interaction. An OLEObject flaw suppressed Word’s confirmation dialog and opened a remote search results window.

Question 5: What did the Conti-related leaked chats say the group had achieved with Intel Management Engine and motherboard firmware?

Question 5

What did the Conti-related leaked chats say the group had achieved with Intel Management Engine and motherboard firmware?

Code execution in the Management Engine and rewriting of the SPI flash memory. A reliable kernel exploit that required no access beyond a browser session. A signed update process that could only modify user-space applications. A method to break disk encryption without touching the firmware layer.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.