Light

Episode #892 Quiz

Source Port Randomization
Date: 2022-10-11 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Linux adopted RFC 6056 source-port randomization, replacing sequential ephemeral ports with double-hash selection to reduce blind spoofing and hijacking. Researchers found the new algorithm leaks a per-device collision pattern, enabling cross-browser, container, IPv4/IPv6, and VPN tracking until reboot. Linux patched the flaw in May 2022.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what did the Linux kernel’s newer TCP source-port selection algorithm unintentionally enable attackers to do?

Question 1

According to the episode, what did the Linux kernel’s newer TCP source-port selection algorithm unintentionally enable attackers to do?

Enumerate remote services by predicting ephemeral destination ports on servers Force DNS resolvers to leak cached answers by skipping recursion checks Hijack TLS sessions by reusing predictable certificate serial numbers Track devices across browsers and networks using per-device hash collisions

Question 2: What practical detail about the Celsius bankruptcy filing did Steve highlight as the reason customer data became public?

Question 2

What practical detail about the Celsius bankruptcy filing did Steve highlight as the reason customer data became public?

The bankruptcy disclosure included names and recent transactions in a 14,532-page filing A breach notice required publishing all account balances to creditors A regulator ordered the exchange to post full customer records on its website The company accidentally published a customer ledger in a public Git repository

Question 3: Which app category was by far the largest among the more than 400 malicious mobile apps Meta identified as stealing Facebook credentials?

Question 3

Which app category was by far the largest among the more than 400 malicious mobile apps Meta identified as stealing Facebook credentials?

Photo editors claiming to add cartoon-style effects VPN apps claiming to accelerate browsing and unlock content Business utilities claiming hidden features from official apps Health apps claiming to improve fitness and horoscope results

Question 4: What was the specific mechanism Steve said the ZimaBoard made practical for his SpinRite development workflow?

Question 4

What was the specific mechanism Steve said the ZimaBoard made practical for his SpinRite development workflow?

A silent, fanless platform with BIOS support for FreeDOS and direct drive testing A cloud-managed ARM appliance intended only for container workloads A USB-only dongle that boots SpinRite without any local storage A rackmount server designed to host Windows Server and Hyper-V

Question 5: What did IBM’s survey of 1,100 incident responders find about mental health support and help-seeking?

Question 5

What did IBM’s survey of 1,100 incident responders find about mental health support and help-seeking?

Most lacked support, and fewer than 10% had ever sought assistance Most reported adequate support, but nearly 65% had sought mental health assistance Support was universal, and no responders reported stress-related consequences Support was rare, but more than 80% had avoided any need for assistance

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.