Light

Episode #879 Quiz

The Rolling Pwn
Date: 2022-07-12 | Length: 2 hrs | Episode page at twit.tv

About this episode

OpenSSL 3.0.4 had a remote heap memory corruption bug on x64 systems with AVX-512-IFMA, potentially enabling RCE during RSA private-key operations; upgrade to 3.0.5. NIST selected Kyber, Dilithium, Falcon, and SPHINCS+ for post-quantum encryption and signatures. Apple added Lockdown Mode, blocking risky attachments, JIT, requests, profiles, and USB data.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the OpenSSL 3.0.4 issue discussed in the episode, what combination of conditions had to be present for the bug to matter on a server platform?

Question 1

In the OpenSSL 3.0.4 issue discussed in the episode, what combination of conditions had to be present for the bug to matter on a server platform?

A 32-bit ARM system with NEON and a 4096-bit RSA private key An x86_64 system with AVX-512-IFMA and a 2048-bit RSA private key An x86_64 system with AVX-512 and a DSA private key An x86_64 system with AVX2 and an ECDSA private key

Question 2: Why did NIST say it was selecting the first four post-quantum algorithms in two stages instead of all eight at once?

Question 2

Why did NIST say it was selecting the first four post-quantum algorithms in two stages instead of all eight at once?

To avoid publishing any algorithm until all finalists had been eliminated To provide a robust variety of defense tools for different use cases To keep lattice-based schemes separate from signature schemes for legal reasons To delay publication until quantum computers became commercially available

Question 3: Which post-quantum signature algorithm did NIST recommend as the primary choice, according to the episode?

Question 3

Which post-quantum signature algorithm did NIST recommend as the primary choice, according to the episode?

SPHINCS+ CRYSTALS-Kyber CRYSTALS-Dilithium FALCON

Question 4: How did the ANOM app conceal the FBI's presence in users' contact lists, according to the episode?

Question 4

How did the ANOM app conceal the FBI's presence in users' contact lists, according to the episode?

It embedded a visible support contact that users were told to message directly It added a hidden ghost contact named bot that received copies of messages It used a locally generated alias that disappeared after each reboot It relied on a server-side proxy that encrypted messages twice before delivery

Question 5: What mitigation did the researchers say was the common recommended solution for the Rolling-Pwn Honda issue?

Question 5

What mitigation did the researchers say was the common recommended solution for the Rolling-Pwn Honda issue?

Install a new rolling-code module inside the vehicle's door handle Upgrade the vulnerable BCM firmware through over-the-air updates if possible Replace the key fob batteries and re-pair the fobs at the dealership Disable remote unlock and rely only on physical key insertion

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.