Light

Episode #961 Quiz

BitLocker: Chipped or Cracked?
Date: 2024-02-13 | Length: 2 hrs | Episode page at twit.tv

About this episode

BitLocker’s TPM can leak its decryption key when discrete chips communicate over accessible board traces, enabling physical eavesdropping attacks. Modern Intel, AMD, and Pluton fTPMs mitigate this by integrating TPM logic into the processor. Best protection is BitLocker plus a strong startup PIN, configured via Group Policy and manage-bde.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the key technical reason the reported BitLocker TPM attack works against some systems with discrete TPM chips?

Question 1

What was the key technical reason the reported BitLocker TPM attack works against some systems with discrete TPM chips?

The TPM exposes its key through the Windows Security Center API before login begins The TPM decrypts the disk itself and writes plaintext blocks to the SSD controller The TPM and CPU communicate over accessible external pins that a probe can monitor during boot The TPM stores its key inside the BitLocker recovery partition that can be read from any disk image

Question 2: According to the VulnCheck analysis, which additional filter most sharply reduced the apparent number of real Confluence hosts after the initial Shodan query?

Question 2

According to the VulnCheck analysis, which additional filter most sharply reduced the apparent number of real Confluence hosts after the initial Shodan query?

Requiring the Set-Cookie: JSESSIONID= header to be present Requiring the X-Frame-Options header to be present Requiring the Server: Atlassian header to be present Requiring the Cache-Control: no-store header to be present

Question 3: What final adjustment led VulnCheck to estimate roughly 4,187 probably authentic publicly exposed Confluence servers?

Question 3

What final adjustment led VulnCheck to estimate roughly 4,187 probably authentic publicly exposed Confluence servers?

Filtering for a non-default TCP port used by Confluence clusters Filtering for a specific Java version disclosed in the HTTP banner Filtering for a spoofed JSESSIONID value that appeared identical across many hosts Filtering for a unique TLS certificate serial number on each host

Question 4: What did Steve recommend for someone who wants to use a cable-provider app while traveling without exposing their home router to the Internet?

Question 4

What did Steve recommend for someone who wants to use a cable-provider app while traveling without exposing their home router to the Internet?

Use an overlay network such as Tailscale, Nebula, or ZeroTier Rely on the Synology router’s built-in VPN client as the remote access endpoint Use UPnP to create a temporary inbound mapping for the travel client Expose a home VPN server on a static port and forward it through the router

Question 5: What was Steve’s conclusion about using email-only login with a one-time code instead of email plus password?

Question 5

What was Steve’s conclusion about using email-only login with a one-time code instead of email plus password?

It is only secure if the code is exactly six digits and manually transcribed by the user It is just as secure, because the real security check is control of the registered email account It is only secure if the login token is generated from the user’s password hash It is less secure, because removing passwords eliminates the factor that prevents account takeover

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.