Light

Episode #980 Quiz

The Mixed Blessing of a Crappy PRNG
Date: 2024-06-25 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Windows’ WiFi stack flaw in nwifi.sys enables remote code execution from nearby hostile radios, even via compromised routers using saved networks. Turning off WiFi fully mitigates unpatched systems. The U.S. banned Kaspersky updates and sales over national-security concerns. Recall raises local and third-party leakage risks. RoboForm’s time-based PRNG made passwords predictable.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What did Steve identify as the specific mitigation that would completely protect an unpatched Windows machine from the WiFi RCE discussed in the episode?

Question 1

What did Steve identify as the specific mitigation that would completely protect an unpatched Windows machine from the WiFi RCE discussed in the episode?

Enabling Windows Firewall on the WiFi interface Forcing the WiFi stack to ignore saved networks Disabling the machine’s WiFi adapter Changing the router’s SSID to a randomized value

Question 2: Why did the $5,000 exploit sale described in the episode materially change the threat model for the Windows WiFi flaw?

Question 2

Why did the $5,000 exploit sale described in the episode materially change the threat model for the Windows WiFi flaw?

It showed infected routers could be used to attack distant Windows systems over wireless It showed the flaw could only be triggered after physical access to the victim laptop It showed the flaw required direct authentication to the target access point It showed the flaw could be used only by nearby attackers

Question 3: According to the episode, what was the main basis of the Austrian complaint filed by noyb against Google’s Privacy Sandbox?

Question 3

According to the episode, what was the main basis of the Austrian complaint filed by noyb against Google’s Privacy Sandbox?

Google was collecting browsing data for storage outside the browser Google was hiding third-party cookies behind a consent banner Google was blocking advertisers from measuring ad conversion rates Google was using a privacy feature to perform browser-based tracking

Question 4: What did Steve say RoboForm’s password generator effectively used as its source of password variability in the affected versions?

Question 4

What did Steve say RoboForm’s password generator effectively used as its source of password variability in the affected versions?

The computer’s Unix time with a one-second resolution A keyed hash of the user’s master password and clock drift A per-installation secret salt combined with system time Hardware noise from the operating system’s entropy pool

Question 5: Which version did Steve identify as the RoboForm release that fixed the password-generation flaw?

Question 5

Which version did Steve identify as the RoboForm release that fixed the password-generation flaw?

Version 7.9.14 released on June 10, 2015 Version 7.9.0 released on June 26, 2013 Version 7.8.2 released before the 2013 password leak Version 8.0.0 released after 2017 discontinuation

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.