Light

Episode #1067 Quiz

KongTuke's CrashFix
Date: 2026-03-03 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

Episode 1067 covers an AI-driven hacking campaign exploiting Fortinet firewalls due to weak configurations without zero-day vulnerabilities, highlighting AI's neutral tool role aiding both attackers and defenders.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the Security Now! episode 1067, what was the primary vulnerability exploited in the AI-driven hacking campaign against Fortinet devices?

Question 1

According to the Security Now! episode 1067, what was the primary vulnerability exploited in the AI-driven hacking campaign against Fortinet devices?

Publicly exposed management ports combined with weak passwords and no multifactor authentication Phishing campaigns targeting Fortinet users Exploitation of zero-day vulnerabilities in Fortinet firewalls Use of AI-generated brute force scripts against strong passwords

Question 2: What key problem did the Federal Trade Commission (FTC) address regarding COPPA and emerging age verification technologies?

Question 2

What key problem did the Federal Trade Commission (FTC) address regarding COPPA and emerging age verification technologies?

COPPA was repealed entirely to allow free age data collection COPPA prohibits any age data collection, preventing age verification The FTC issued a statement allowing age verification data collection without parental consent temporarily under conditions The FTC mandated all sites must use facial recognition for age verification despite privacy concerns

Question 3: In the episode's discussion of the KongTuke 'CrashFix' exploit, what user action initiates the malicious PowerShell command execution?

Question 3

In the episode's discussion of the KongTuke 'CrashFix' exploit, what user action initiates the malicious PowerShell command execution?

Clicking a malicious link in an email Opening a PDF attachment that exploits a vulnerability in Adobe Reader Installing a malicious browser extension that silently runs commands Following instructions to paste clipboard contents into the Windows Run dialog and press Enter

Question 4: Why does Steve Gibson argue that self-signing code is not a practical replacement for code signing certificates from certificate authorities?

Question 4

Why does Steve Gibson argue that self-signing code is not a practical replacement for code signing certificates from certificate authorities?

Self-signing introduces inherent cryptographic weaknesses making signatures invalid Self-signed certificates are illegal under current cybersecurity laws Self-signed certificates only work on machines where the corresponding root certificate has been manually installed Because self-signed certificates cannot be used with any software development tools

Question 5: What unusual aspect did the UK government report about their vulnerability monitoring service that confused Steve Gibson?

Question 5

What unusual aspect did the UK government report about their vulnerability monitoring service that confused Steve Gibson?

They claimed to have fixed over a million DNS misconfigurations immediately after discovery They used AI to eliminate all vulnerabilities automatically without human intervention They stated they used offensive cyber tools to hack attacker infrastructure They reported reducing median fix times for DNS-related vulnerabilities but described 'weaknesses in government DNS records' that don't exist

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.