Light

Episode #979 Quiz

THE ANGLE OF THE DANGLE
Date: 2024-06-18 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Microsoft patched CVE-2024-30078, a Wi‑Fi-range Windows RCE in the native stack requiring no authentication or user interaction, affecting all supported versions. Recall was delayed to Insider testing after security concerns. Apple’s Private Cloud Compute uses attestation, sealed hardware, stateless reboots, blind signatures, and OHTTP relays. WGET’s semicolon bug was noncritical.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what is the key proximity condition that keeps CVE-2024-30078 from scoring a full 10.0, and what kind of attack does Microsoft say it enables?

Question 1

According to the episode, what is the key proximity condition that keeps CVE-2024-30078 from scoring a full 10.0, and what kind of attack does Microsoft say it enables?

The attacker must be within WiFi radio range, and a malicious networking packet can enable remote code execution. The attacker must be on the same VPN segment, and a forged DHCP lease can enable credential theft. The attacker must be inside the same browser session, and a malicious HTML page can enable file overwrite. The attacker must have local admin rights, and a crafted USB device can enable kernel memory disclosure.

Question 2: Why did Microsoft remove Recall from the June 18, 2024 Copilot+ release, and where would it first be made available instead?

Question 2

Why did Microsoft remove Recall from the June 18, 2024 Copilot+ release, and where would it first be made available instead?

It was replaced by a local-only index because Microsoft decided cloud processing was impossible. It was moved to the Windows Insider Program after feedback from the Insider community. It was delayed for a hardware redesign and will first ship only on Intel-based Copilot+ PCs. It was canceled entirely because the feature failed certification and will not return.

Question 3: What two technical protections did Matthew Green highlight as central to Apple’s Private Cloud Compute design?

Question 3

What two technical protections did Matthew Green highlight as central to Apple’s Private Cloud Compute design?

Kernel-level sandboxing with mandatory code signing and per-user VPN tunneling. Encrypted disk snapshots with offline backup verification and per-session biometrics. Third-party endpoint scanning with client-side key escrow and rotating IP allowlists. Hardware attestation with Secure Boot and per-request storage wiping with rekeying.

Question 4: Why did Steve dismiss the reported CVSS 10.0 claim for the WGET issue, and what was the actual flaw described?

Question 4

Why did Steve dismiss the reported CVSS 10.0 claim for the WGET issue, and what was the actual flaw described?

It was an authentication bypass in FTP proxy mode, not a client-side parsing problem, and it required a login. It was a buffer overflow in TLS certificate validation, not a parsing issue, and it affected only servers. It was a URL parser bug in semicolon handling in the userinfo portion, not a remotely exploitable wormable service flaw. It was a DNS cache poisoning bug in resolver fallback, not a URL syntax bug, and it scored 10.0 because it was wormable.

Question 5: What action did the Paris court order Google, Cloudflare, and Cisco to take after Canal+’s lawsuit?

Question 5

What action did the Paris court order Google, Cloudflare, and Cisco to take after Canal+’s lawsuit?

They must selectively edit DNS resolutions to block about 117 pirate sports domains for French users. They must forward the domains to Canal+ warning pages and log every visitor’s source IP address. They must de-index the domains from search results and suspend their TLS certificates globally. They must revoke the domains’ registrant access and transfer control to French ISPs.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.