Light

Episode #1007 Quiz

AI Training & Inference
Date: 2025-01-07 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

This Security Now! episode #1007 covers risks from compromised Chrome browser extensions via phishing attacks injecting malicious code that exfiltrates Facebook tokens and session data, highlighting the threat of extension supply chain attacks despite multifactor authentication.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the primary security risk demonstrated by the December 24th phishing attack on the Cyberhaven Chrome extension developer's account?

Question 1

What was the primary security risk demonstrated by the December 24th phishing attack on the Cyberhaven Chrome extension developer's account?

A phishing email mimicking Chrome Web Store policy led the developer to authorize a malicious OAuth app, allowing attackers to publish a malicious extension update. The attacker exploited a zero-day vulnerability in the Chrome browser to silently inject malicious extension code during runtime. The attacker bribed a Chrome Web Store employee to approve a backdoored extension version bypassing review processes. A network-level man-in-the-middle attack intercepted the extension update process allowing the attacker to modify an existing extension package.

Question 2: Regarding the SonicWall vulnerability CVE-2024-40766, what proportion of victim organizations of the ransomware groups Akira and Fog were found to be running SonicWall devices vulnerable to this exploit?

Question 2

Regarding the SonicWall vulnerability CVE-2024-40766, what proportion of victim organizations of the ransomware groups Akira and Fog were found to be running SonicWall devices vulnerable to this exploit?

Approximately 46% of victim organizations were running vulnerable SonicWall devices, significantly higher than the ~5% baseline among other ransomware victims. Only about 5% of victim organizations were using SonicWall devices, consistent with the overall industry baseline. Less than 1% of victim organizations had vulnerable SonicWall devices, indicating SonicWall was not a major attack vector. Nearly all victim organizations (>90%) were found to have unpatched SonicWall firewalls exploitable via CVE-2024-40766.

Question 3: What is the fundamental challenge identified that has prevented widespread adoption of TLS encryption among email servers?

Question 3

What is the fundamental challenge identified that has prevented widespread adoption of TLS encryption among email servers?

Email client software universally disables encrypted connections for compatibility reasons. Email servers refuse to implement TLS because it conflicts with existing user authentication mechanisms like OAuth. The absence of an ACME protocol variant or automation mechanism to easily obtain and deploy TLS certificates for email servers. The protocol specifications for SMTP, POP3, and IMAP do not support TLS encryption at all.

Question 4: What security threat does a compromised browser extension primarily pose, based on the example of the Cyberhaven incident?

Question 4

What security threat does a compromised browser extension primarily pose, based on the example of the Cyberhaven incident?

Browser extensions commonly install root certificates that allow attackers to decrypt all network traffic including HTTPS. Malicious code inserted into a browser extension can exfiltrate sensitive session tokens and user data from targeted websites, enabling impersonation attacks. Compromised extensions propagates ransomware directly onto the operating system's file system. Malicious extensions force browsers to redirect all visited URLs to phishing pages immediately.

Question 5: Which technological breakthrough made feasible the efficient training of massive neural networks underlying modern AI models?

Question 5

Which technological breakthrough made feasible the efficient training of massive neural networks underlying modern AI models?

The development of quantum computing hardware dedicated to AI calculations. Replacing all neural networks entirely with symbolic logic-based expert systems to speed training. The introduction of the 'Transformer' architecture, which enabled more efficient parallel training by prioritizing attention to important input tokens. Abandoning GPUs for CPUs in training to leverage general-purpose multiprocessing capabilities.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.