Light

Episode #907 Quiz

Credential Reuse
Date: 2023-01-24 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Credential reuse attacks automate login attempts using breached username-password pairs, succeeding when users recycle credentials across sites. Bot fleets distribute attempts across IPs, time, and targets to evade throttling. Mitigations include delaying failures, tracking suspicious cookies, CAPTCHA, device fingerprinting, and strongest of all, multifactor authentication with time-based tokens or persistent cookies.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to Steve Gibson’s discussion of PayPal’s incident, what was the reported outcome after the credential stuffing attack was investigated?

Question 1

According to Steve Gibson’s discussion of PayPal’s incident, what was the reported outcome after the credential stuffing attack was investigated?

Almost 35,000 accounts were accessed, and several unauthorized transactions were confirmed. Almost 35,000 accounts were accessed, but no unauthorized transactions were found. No accounts were accessed, because PayPal blocked the attack before any credentials were accepted. About 3,500 accounts were accessed, but the attack was stopped before any logins succeeded.

Question 2: What specific obstacle did the CyberArk researchers report overcoming in order to get ChatGPT to produce functional malware code?

Question 2

What specific obstacle did the CyberArk researchers report overcoming in order to get ChatGPT to produce functional malware code?

They defeated the model by exploiting a memory corruption bug in the web interface. They bypassed the content filters by rephrasing the request more authoritatively and adding constraints. They used the API because it enforced stronger content filtering than the web version. They disabled the model’s safety system by uploading a malicious training set.

Question 3: In Check Point’s first case study, what did the ChatGPT-generated stealer do with files it found on the system?

Question 3

In Check Point’s first case study, what did the ChatGPT-generated stealer do with files it found on the system?

It emailed them to a command-and-control address using an attached archive. It copied them to a temp folder, zipped them, and uploaded them to a hardcoded FTP server. It disguised them as system logs and stored them in the Windows registry. It encrypted them locally and demanded payment before deleting the originals.

Question 4: What was Bitwarden’s announced short-term plan for Passwordless.dev in relation to passkeys?

Question 4

What was Bitwarden’s announced short-term plan for Passwordless.dev in relation to passkeys?

To freeze development until browser vendors standardized a new credential API. To replace FIDO2 WebAuthn with SMS-based login flows for easier adoption. To launch a beta program and bring passkey support forward in 2023. To sunset the product and fold its users into Bitwarden’s password vault only.

Question 5: When Steve compared the two strongest mitigations for credential reuse, what combination did he say gave the best of both worlds?

Question 5

When Steve compared the two strongest mitigations for credential reuse, what combination did he say gave the best of both worlds?

A CAPTCHA challenge plus device fingerprinting for every login. A longer password plus a higher PBKDF2 iteration count. An email-based username plus IP-based throttling after failed attempts. A required one-time password plus a pre-existing persistent browser cookie.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.