Light

Episode #939 Quiz

LastMess
Date: 2023-09-12 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

The episode covers the UK’s Online Safety Bill retreat from mandatory encrypted-message scanning, Microsoft’s Storm-0558 investigation showing a consumer signing key leaked via crash-dump race condition, insecure transfer, and missed validation, Mozilla’s finding that all 25 car brands over-collect, share, and sell driver data, and evidence LastPass vaults are being cracked and exploited.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to Microsoft’s postmortem on the Storm-0558 incident, what sequence most likely let the attacker obtain the signing key used to forge login tokens?

Question 1

According to Microsoft’s postmortem on the Storm-0558 incident, what sequence most likely let the attacker obtain the signing key used to forge login tokens?

A corporate backup appliance restored the key into the Internet-facing network, the attacker intercepted the backup traffic, and the dump scan missed the transfer A mail-system library validated the wrong issuer, the attacker guessed the key from token metadata, and no internal account was involved A consumer signing system crash produced a dump with the key, the dump was moved to a corporate debugging environment, and the attacker compromised an engineer’s corporate account to reach it A production HSM exported the key during failover, the key was copied into an internal wiki, and the attacker phished the wiki administrators

Question 2: What did Microsoft say about why a consumer signing key could be used to access enterprise email in the Storm-0558 case?

Question 2

What did Microsoft say about why a consumer signing key could be used to access enterprise email in the Storm-0558 case?

The attacker replaced Microsoft’s enterprise metadata endpoint with the consumer endpoint through DNS poisoning The mail systems accepted tokens signed with the consumer key because issuer-scope validation had not been added to the libraries The enterprise and consumer keys were intentionally made interchangeable to support unified login across services The enterprise mail service had been configured to trust all keys published to the common metadata endpoint without any signature checks

Question 3: What was the key privacy finding in Mozilla’s car research that made Steve say he was glad his car is 19 years old?

Question 3

What was the key privacy finding in Mozilla’s car research that made Steve say he was glad his car is 19 years old?

Most car brands refused over-the-air updates, which Mozilla said made their privacy practices unusually transparent Only Tesla and Nissan failed Mozilla’s privacy review, while the other 23 brands met the minimum standards All 25 car brands reviewed earned Mozilla’s privacy warning label and were described as the worst product category reviewed so far Mozilla found that connected services were private by default but became risky only when drivers linked Sirius XM accounts

Question 4: What detail did Steve give about browser extensions and sensitive browsing that reflects the practical mitigation discussed in listener feedback?

Question 4

What detail did Steve give about browser extensions and sensitive browsing that reflects the practical mitigation discussed in listener feedback?

Use a separate browser for highly sensitive tasks and keep extensions to a minimum there Trust the browser’s built-in security model to prevent extensions from seeing passwords and cookies Rely on browser incognito mode to block every extension automatically on all sites Disable JavaScript entirely so extensions cannot inject code into the page DOM

Question 5: According to the episode, what was the core reason Steve thought many LastPass users might still be safe even after the vault theft?

Question 5

According to the episode, what was the core reason Steve thought many LastPass users might still be safe even after the vault theft?

The attackers were using the data only for public shaming, not for financially motivated thefts The stolen vaults contained only usernames, while passwords were stored separately in a different service LastPass automatically re-encrypted every vault with a hardware token before the breach was disclosed Attackers must still decrypt targeted vaults, so high-iteration vaults with strong passphrases are likely uneconomical to crack

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.