Light

Episode #899 Quiz

Freebie Bots & Evil Cameras
Date: 2022-11-29 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

The episode covered takedown of the iSpoof caller-ID spoofing service, abused for more than one million spoofed calls monthly; “freebie bots” exploiting retail mispricing at scale; and a cryptocurrency phishing chain using chat, TeamViewer, and device-authorization bypasses. It also noted Boa’s obsolete, non-TLS IoT web server and malicious Docker Hub images.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific chain of actions did the cryptocurrency phishing group use when the victim's initial login attempts were blocked by an "authorized device" check?

Question 1

According to the episode, what specific chain of actions did the cryptocurrency phishing group use when the victim's initial login attempts were blocked by an "authorized device" check?

They abandoned the account and moved on to a different exchange because the authorized-device check could not be bypassed They exploited a browser vulnerability on the exchange page to silently bypass the device verification step They reset the victim's password through the exchange's automated recovery portal and then withdrew the funds They switched to a live chat, then used TeamViewer to control the victim's device and approve their own browser as trusted

Question 2: What was the key operational detail behind the so-called Freebie Bots described in the episode?

Question 2

What was the key operational detail behind the so-called Freebie Bots described in the episode?

They scraped retail sites for mispriced goods and rapidly bought them before the pricing error was corrected They exploited loyalty-program bugs to redeem reward points for discounted merchandise They altered checkout carts to apply coupon codes that legitimate users had not been able to obtain They mass-cancelled customer orders to trigger price corrections and force refunds on retailers

Question 3: What did the episode say was the core problem with the Boa web server in the IoT/ICS context?

Question 3

What did the episode say was the core problem with the Boa web server in the IoT/ICS context?

It required a proprietary plugin that prevented patching after 2005 It depended on an external database that had gone unsupported in 2005 It was written in 1995 and had its last source update in February 2005 It was built in 2005 and had not been ported to 64-bit systems

Question 4: Why did Steve say the Carnival Cruises Passkey implementation did not provide the normal phishing resistance promised by Passkeys?

Question 4

Why did Steve say the Carnival Cruises Passkey implementation did not provide the normal phishing resistance promised by Passkeys?

It outsourced authentication to OwnID and used a QR flow that let a spoofed page still drive the login It stored the passkey on the browser and exposed it to the phishing site in plaintext It required a hardware token that could be cloned by the attacker once the QR code was displayed It used passwords only for the first login and disabled Passkeys after enrollment

Question 5: What was the practical interaction Steve described for using his EV code-signing hardware module?

Question 5

What was the practical interaction Steve described for using his EV code-signing hardware module?

The signing client exported the private key to disk, then re-imported it after each signing operation The hardware module decrypted the executable, signed it, and then re-encrypted the whole file Windows sent the file hash into the USB token, which signed it internally and returned the signed blob The USB device generated a one-time code that was manually pasted into the signing command

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.