Light

Episode #1071 Quiz

Bucketsquatting
Date: 2026-03-24 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

This episode investigates H&R Block’s tax software installing a long-lived root CA with its private key exposed, enabling global TLS man-in-the-middle attacks and code-signing spoofing.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What critical security flaw did H&R Block's 2026 tax preparation software introduce by installing a root CA certificate named "WK ATX ServerHost 2024" on users' machines?

Question 1

What critical security flaw did H&R Block's 2026 tax preparation software introduce by installing a root CA certificate named "WK ATX ServerHost 2024" on users' machines?

The software installed a self-signed certificate to intercept local HTTPS traffic but hid the certificate's private key securely in hardware. The software installed a root CA certificate that only triggered warnings when interacting with external servers, ensuring local traffic remained secure. The software installed a root CA certificate with a private key publicly embedded in a DLL, allowing any attacker to issue trusted TLS and code signing certificates on affected machines for 23 years. The software used a temporary root certificate that expired after 90 days but failed to securely generate the private key, leading to potential key leakage.

Question 2: What is the main operational reason H&R Block's tax software included a private key to the root CA locally on the user's machine?

Question 2

What is the main operational reason H&R Block's tax software included a private key to the root CA locally on the user's machine?

To encrypt users' tax data locally using certificates signed by their own CA before uploading. To enable its built-in local web server to mint TLS certificates on-the-fly that browsers would trust for a localhost or custom domain interface. To facilitate secure communication with H&R Block remote servers requiring client certificate authentication. To allow offline self-signed software updates without involving H&R Block servers.

Question 3: What vulnerability does the "bucketsquatting" issue with Amazon S3 buckets exploit?

Question 3

What vulnerability does the "bucketsquatting" issue with Amazon S3 buckets exploit?

Man-in-the-middle attacks on encrypted S3 URL connections due to lack of proper TLS certificate validation. Re-creation of previously deleted, once-used S3 bucket names by attackers to intercept or serve malicious updates to clients still requesting from those bucket URLs. Exploitation of S3 bucket misconfigurations allowing anonymous global read/write access to active buckets containing sensitive data. Cross-site scripting attacks via bucket name collisions affecting web apps integrating S3 buckets with user input.

Question 4: How did Amazon's introduction of "account regional namespaces" aim to mitigate the bucketsquatting problem going forward?

Question 4

How did Amazon's introduction of "account regional namespaces" aim to mitigate the bucketsquatting problem going forward?

By restricting S3 bucket creation to administrator-approved whitelisted names only within organizations. By encrypting bucket contents and requiring multi-factor authentication for all bucket access requests. By appending a unique regional account suffix to bucket names, enforcing uniqueness within an account namespace and preventing collisions across accounts. By automatically archiving and locking deleted buckets for a 5-year retention period to prevent recreation.

Question 5: According to Amazon Threat Intelligence's findings about the Cisco Secure Firewall Management Center vulnerability CVE-2026-20131, what was a key factor that allowed the Interlock ransomware to exploit it before disclosure?

Question 5

According to Amazon Threat Intelligence's findings about the Cisco Secure Firewall Management Center vulnerability CVE-2026-20131, what was a key factor that allowed the Interlock ransomware to exploit it before disclosure?

The attackers exploited an authentication bypass zero-day vulnerability allowing unauthenticated remote code execution as root, unnoticed for over 36 days before the patch. Misconfiguration of firewall rules allowed attackers to brute force credentials and gain administrative access. An insider leaked the admin credentials and provided access to attacker-controlled servers inside the network. A phishing campaign tricked administrators into running malicious Java code inside the firewall interface.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.