Light

Episode #889 Quiz

Spell-Jacking
Date: 2022-09-20 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Chrome and Edge enhanced spellcheck can exfiltrate form contents, including passwords, usernames, and sensitive PII, to Google or Microsoft whenever text is not in the local dictionary; clicking Show Password also leaks credentials. Mitigations include disabling enhanced spellcheck, adding spellcheck="false" to sensitive fields, and auditing affected sites.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific lockout-related lesson did Steve draw from the Uber incident involving multifactor authentication?

Question 1

According to the episode, what specific lockout-related lesson did Steve draw from the Uber incident involving multifactor authentication?

A few failed MFA attempts should still trigger a temporary lockout, just as password logins do. MFA approval prompts should be replaced by hardware tokens to avoid any need for lockout policies. Password resets should be required before any MFA challenge is issued to a user. MFA should be disabled after password compromise so attackers cannot trigger approval prompts.

Question 2: What did LastPass say separated its Development environment from Production, helping prevent customer vault exposure after the breach?

Question 2

What did LastPass say separated its Development environment from Production, helping prevent customer vault exposure after the breach?

The Development environment shared the same network but used separate encryption keys for Production. The Development environment allowed direct access, but only for the Build Release team. The Development environment was internet-isolated but still connected through an internal message bus. The Development environment had no direct connectivity to Production and was physically separated from it.

Question 3: What indicator of compromise did Wordfence say was the most common sign of the WPGateway exploit?

Question 3

What indicator of compromise did Wordfence say was the most common sign of the WPGateway exploit?

A plugin update notice failing to load after the exploit is triggered. A malicious administrator account named rangex appearing in the dashboard. A sudden increase in outbound traffic from the site’s login page. A new database table appearing with an unfamiliar WordPress prefix.

Question 4: Which performance regression did the VMware engineer report after Linux kernel 5.19 enabled the Retbleed mitigation?

Question 4

Which performance regression did the VMware engineer report after Linux kernel 5.19 enabled the Retbleed mitigation?

Compute performance fell 70%, network throughput fell 30%, and storage bandwidth fell 13%. Compute performance was unchanged, but network and storage both fell 70%. Compute performance fell 30%, network throughput fell 70%, and storage bandwidth fell 13%. Compute performance fell 13%, network throughput fell 30%, and storage bandwidth fell 70%.

Question 5: Which mitigation did Otto-js recommend to stop the browser spellcheck leak on sensitive form pages, and what example did Steve cite as already using it?

Question 5

Which mitigation did Otto-js recommend to stop the browser spellcheck leak on sensitive form pages, and what example did Steve cite as already using it?

Disable JavaScript on the page, as Google Cloud Secret Manager had done. Require the browser to clear cookies before every password entry, as Office 365 had done. Add spellcheck="false" to the page or form fields, as LastPass had done on its login page. Force all spellcheck requests through a local proxy, as AWS Secrets Manager had done.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.