Light

Episode #804 Quiz

NAT Slipstreaming 2.0
Date: 2021-02-02 | Length: 2 hrs | Episode page at twit.tv

About this episode

Google revoked trust in Camerfirma certificates after years of CA mis-issuance, disclosure failures, unconstrained sub-CAs, and invalid entropy or validity periods. The episode also covered a libgcrypt heap overflow in GPG 1.9.0, a ten-year SUDO heap overflow enabling local root, supply-chain malware in NoxPlayer updates, and iOS 14 iMessage sandboxing, rerandomized ASLR, and crash throttling.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the specific condition that let the original NAT Slipstreaming attack reach a NAT router’s Application Layer Gateway in the first place, before the 2.0 variant was developed?

Question 1

What was the specific condition that let the original NAT Slipstreaming attack reach a NAT router’s Application Layer Gateway in the first place, before the 2.0 variant was developed?

A victim had to visit a web page that ran browser JavaScript A victim had to install a rogue browser extension that modified outbound packets A victim had to open a specially crafted email attachment in a desktop client A victim had to authenticate to the router’s admin console over the WAN

Question 2: Which Apple iOS 14 change was described as moving most parsing of untrusted iMessage data into a new tightly sandboxed service?

Question 2

Which Apple iOS 14 change was described as moving most parsing of untrusted iMessage data into a new tightly sandboxed service?

The launch daemon exponential restart throttling The BlastDoor service written in Swift The dyld shared cache rerandomization mechanism The imagent process rewritten in Rust

Question 3: What was the key change in iOS 14 that neutralized the shared-cache ASLR-bypass technique used in zero-click iMessage attacks?

Question 3

What was the key change in iOS 14 that neutralized the shared-cache ASLR-bypass technique used in zero-click iMessage attacks?

The kernel disables all crash reporting for iMessage-related processes The shared cache is removed and libraries are loaded only on demand The shared cache is rerandomized when the targeted service restarts after a detected attack The shared cache is encrypted separately for each process at boot

Question 4: According to the episode, which vulnerability detail made the SUDO flaw especially dangerous even in default configurations?

Question 4

According to the episode, which vulnerability detail made the SUDO flaw especially dangerous even in default configurations?

Only users listed in the SUDOers file could trigger a root shell The flaw affected only non-default SUDO builds with custom patches Any unprivileged local user could gain root without authentication The flaw required physical access to the console and BIOS interaction

Question 5: What specific browser-side mitigation was deployed after the NAT Slipstreaming 2.0 disclosure to block the new attack path?

Question 5

What specific browser-side mitigation was deployed after the NAT Slipstreaming 2.0 disclosure to block the new attack path?

Blocking all outbound TCP traffic whenever JavaScript executes in the browser Blocking outbound HTTP, HTTPS, and FTP access to ports 69, 137, 161, 1719, 1720, 1723, and 6566 Blocking outbound HTTP and HTTPS access to ports 5060 and 5061 only Blocking inbound H.323 calls at the router by default on all consumer devices

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.