Light

Episode #966 Quiz

Morris the Second
Date: 2024-03-19 | Length: 2 hrs | Episode page at twit.tv

About this episode

Voyager 1 may still be recoverable after a memory "poke" forced readable Flight Data Subsystem output. Tim Berners-Lee condemned web centralization and data brokering. Passkeys reduce server-stored secrets, but browser or password-manager storage raises portability and compromise concerns. Cornell researchers showed Morris the Second, a zero-click GenAI worm exploiting prompt replication.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the key reason the Cornell researchers described Morris the Second as a zero-click worm?

Question 1

What was the key reason the Cornell researchers described Morris the Second as a zero-click worm?

Because the GenAI service’s automatic inference triggers replication without user interaction Because the worm depended on an unpatched kernel vulnerability in the host operating system Because the worm spread only after a user manually forwarded infected messages to contacts Because the worm required a victim to open an attached executable before propagation

Question 2: In the episode, which pair of use cases did the Morris the Second paper demonstrate against GenAI-powered email assistants?

Question 2

In the episode, which pair of use cases did the Morris the Second paper demonstrate against GenAI-powered email assistants?

Spamming and exfiltrating personal data Browser hijacking and crypto-mining installation Phishing webpage generation and DNS poisoning Credential stealing and ransomware deployment

Question 3: Why did Steve say Passkeys are particularly appealing for shared-computer environments when used from a phone rather than stored in the browser?

Question 3

Why did Steve say Passkeys are particularly appealing for shared-computer environments when used from a phone rather than stored in the browser?

Because the phone can export Passkeys only after each successful login Because the site stores a second copy of the Passkeys only for shared sessions Because shared computers automatically isolate every browser extension by user profile Because the browser and computer never receive the Passkeys themselves

Question 4: What privacy practice by automakers did the New York Times story highlight as being nearly invisible to drivers?

Question 4

What privacy practice by automakers did the New York Times story highlight as being nearly invisible to drivers?

Sending only aggregate annual mileage to insurers after explicit monthly opt-in prompts Encrypting driving data and releasing it only when a court order is presented Sharing detailed driving data with data brokers and insurers through fine print and murky policies Posting all trip details in a public DMV-style database accessible to anyone

Question 5: According to Steve’s discussion of the vulnerability-reporting controversy, what made a report eligible for bounty at the HackerOne program Gabe described?

Question 5

According to Steve’s discussion of the vulnerability-reporting controversy, what made a report eligible for bounty at the HackerOne program Gabe described?

A working proof of concept that demonstrates the issue A vendor version string that appears older than the current release A public blog post that names the affected company and its executives A signed statement from the reporter that the issue is exploitable in theory

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.