Light

Episode #1078 Quiz

DigiCert Does It Right
Date: 2026-05-12 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

Security Now! episode 1078 covers critical security developments including the FCC’s extension of firmware update allowances for routers until 2029 and Netgear’s full FCC approval for unrestricted updates. AISLE Security’s AI tools uncovered a 21-year-old RCE in FreeBSD’s DHCP client enabling local network root exploits.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the crucial security flaw that allowed the attacker to obtain valid EV Code Signing certificates in the DigiCert breach?

Question 1

What was the crucial security flaw that allowed the attacker to obtain valid EV Code Signing certificates in the DigiCert breach?

Access to initialization codes in the internal support portal, combined with approved orders, allowed certificate issuance. Exploitation of a zero-day vulnerability in DigiCert's website certificate validation process. Compromise of DigiCert's hardware security modules (HSMs) enabling private key extraction. Phishing attacks targeting DigiCert executives to steal root certificates.

Question 2: According to the episode, what specific endpoint security failure contributed to the prolonged undetected compromise during the DigiCert incident?

Question 2

According to the episode, what specific endpoint security failure contributed to the prolonged undetected compromise during the DigiCert incident?

Endpoint firewalls were disabled, allowing external attacker access. CrowdStrike sensor was not installed on one analyst's machine, preventing detection. Use of unpatched Windows versions on all support analysts' endpoints. Antivirus signatures on all endpoints were outdated and ineffective.

Question 3: Why did Microsoft Defender initially remove DigiCert root certificates from affected Windows systems, according to the episode?

Question 3

Why did Microsoft Defender initially remove DigiCert root certificates from affected Windows systems, according to the episode?

A malware attack corrupted the Windows certificate store, causing certificate removal. Because malicious certificates from a DigiCert breach were mistakenly identified by Defender as malware. Due to a Windows update that deleted expired root certificates to improve system security. Microsoft Defender was updated to block all DigiCert certificates after a new CA compromise.

Question 4: What architectural design issue in DigiCert's EV Code Signing certificate issuance process contributed to the attacker's ability to misuse initialization codes?

Question 4

What architectural design issue in DigiCert's EV Code Signing certificate issuance process contributed to the attacker's ability to misuse initialization codes?

Certificate requests bypassed multi-factor authentication controls during processing. Initialization codes were not protected as bearer credentials and treated as intermediate workflow data. Private keys were generated on insecure external servers before hardware token installation. Initialization codes were encrypted with weak cryptography, allowing decryption by attackers.

Question 5: What AI-specific supply chain attack technique discussed in the episode allows remote code execution upon deserialization of malicious models?

Question 5

What AI-specific supply chain attack technique discussed in the episode allows remote code execution upon deserialization of malicious models?

Sending exploits via malicious JavaScript payloads embedded within AI model metadata files. Injection of SQL commands into AI model configuration files to compromise databases. Manipulating AI model gradient descent parameters to cause buffer overflows during training. Embedding malicious Python code at the start of a pickle byte stream compressed with 7z to evade scanning.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.