Light

Episode #801 Quiz

Out With the Old
Date: 2021-01-12 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Firefox and Chromium received critical remote-code-execution patches; Firefox’s SCTP use-after-free likely required a malicious server, while Chromium’s V8 out-of-bounds write was exploitable via web content. Firefox 86 will disable Backspace navigation, configurable via about:config. Ryuk and REvil remain profitable, while Intel’s hardware ransomware detection claim was dismissed as marketing hype.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In Firefox’s SCTP-related use-after-free issue, what attack shape did Steve conclude was most likely required to exploit the bug against a browser user?

Question 1

In Firefox’s SCTP-related use-after-free issue, what attack shape did Steve conclude was most likely required to exploit the bug against a browser user?

A cross-site scripting payload that rewrote the browser’s back-navigation history A drive-by download from any site embedding the malicious COOKIE-ECHO chunk A watering-hole visit to a malicious site serving an evil SCTP server response A local privilege escalation from a malformed file opened by the browser

Question 2: What specific justification did Mozilla give for removing Backspace-as-Back navigation in Firefox?

Question 2

What specific justification did Mozilla give for removing Backspace-as-Back navigation in Firefox?

It conflicted with the browser’s new tab-search shortcut behavior It caused browser crashes when pressed inside form fields It duplicated the Alt+Left Arrow shortcut already used by Chromium It overloaded a common user action with a destructive navigation action

Question 3: According to Steve’s critique of Intel’s CES announcement, why did he say the PMU-based ransomware detection claim was fundamentally unconvincing?

Question 3

According to Steve’s critique of Intel’s CES announcement, why did he say the PMU-based ransomware detection claim was fundamentally unconvincing?

It depended on a cloud service that could not operate offline It required signature files that vendors had to manually update before each attack It lacked the context needed to distinguish ransomware from ordinary software activity It only monitored encrypted network traffic and ignored CPU state changes

Question 4: What did the Kaspersky post identify as the notable overlap between Sunburst and Kazuar?

Question 4

What did the Kaspersky post identify as the notable overlap between Sunburst and Kazuar?

Shared use of the same ransomware locker, payment portal, and decryptor service Shared victim UID generation, sleep logic, and FNV-1a hash usage Shared RC4 session keys, identical DNS exfiltration domains, and a common packer Shared exploit chains against Exchange, SMB worming, and embedded Tor routing

Question 5: What did Steve say was the practical purpose of turning the old SpinRite code “out with the old” rather than preserving its historical compatibility layers?

Question 5

What did Steve say was the practical purpose of turning the old SpinRite code “out with the old” rather than preserving its historical compatibility layers?

To eliminate the need for a text interface and replace it with a browser-based dashboard To make the program depend entirely on compression drivers for modern large-disk support To preserve DOS 3.3 compatibility so the program could still target 32MB partitions To remove obsolete kludges so SpinRite could support larger drives and simpler physical-sector handling

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.