Light

Episode #1002 Quiz

Disconnected Experiences
Date: 2024-11-26 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

This episode details the "nearest neighbor" attack where Russian APT28 pivots through a compromised adjacent organization's WiFi-connected device to breach a target's enterprise wireless network, bypassing MFA. It highlights malware's living-off-the-land techniques, extensive logging's importance, and security risks of Chinese-made port cranes.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What is the "Nearest Neighbor" attack as described in Security Now! episode 1002, and how was it executed by the Russian APT group APT28?

Question 1

What is the "Nearest Neighbor" attack as described in Security Now! episode 1002, and how was it executed by the Russian APT group APT28?

An attack where an attacker compromises the WiFi network of a physically adjacent building to pivot into the target's enterprise WiFi remotely. A man-in-the-middle attack on the enterprise WiFi by spoofing access points within the target building. An attack involving social engineering of employees to gain credentials for the enterprise WiFi network. A supply chain attack where malware was pre-installed on networking hardware inside the victim's building.

Question 2: What critical vulnerability was exploited by APT28 within the victim's network to escalate privileges during the "Nearest Neighbor" attack?

Question 2

What critical vulnerability was exploited by APT28 within the victim's network to escalate privileges during the "Nearest Neighbor" attack?

A zero-day in the Windows Print Spooler service identified as CVE-2022-38028. A SQL injection flaw in the victim organization's web application infrastructure. A buffer overflow vulnerability in the enterprise WiFi access point firmware. An unpatched Adobe Acrobat Reader exploit used to gain initial access.

Question 3: Regarding the 2024 security concerns discussed about Chinese-built ship-to-shore (STS) cranes, what is the principal issue identified by the U.S. Coast Guard?

Question 3

Regarding the 2024 security concerns discussed about Chinese-built ship-to-shore (STS) cranes, what is the principal issue identified by the U.S. Coast Guard?

The cranes physically malfunction causing container ships to be damaged routinely. The cranes have built-in vulnerabilities potentially enabling remote access and control by the Chinese government. The cranes emit signals that interfere with other wireless networks in port areas. The cranes are incompatible with U.S. port infrastructure, causing logistic delays.

Question 4: What is the critical security problem found in the six older D-Link SSL VPN routers, and what is D-Link’s response to the discovery?

Question 4

What is the critical security problem found in the six older D-Link SSL VPN routers, and what is D-Link’s response to the discovery?

A terminally serious unauthenticated remote code execution vulnerability with no planned fix as devices are past end of life. A simple password brute-forcing vulnerability easily patched by a firmware update available immediately. A default open Telnet port exposing router configuration but with ongoing patches rolling out. Susceptibility to WiFi deauthentication attacks causing denial of service but with vendor support ongoing.

Question 5: What are "Microsoft Connected Experiences" in Office apps as detailed in this episode, and what is the privacy implication discussed?

Question 5

What are "Microsoft Connected Experiences" in Office apps as detailed in this episode, and what is the privacy implication discussed?

A telemetry logging system that tracks software crashes but does not access users’ document content. Offline local-only spell-check and grammar tools that do not transmit document content externally. A legacy feature that was removed and replaced by Windows Recall with no privacy concerns. Features that analyze your document content by sending it to Microsoft cloud services, enabled by default, with data retained to personalize and improve AI-powered experiences.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.