Light

Episode #805 Quiz

SCADA Scandal
Date: 2021-02-09 | Length: 2 hrs | Episode page at twit.tv

About this episode

Chrome’s Great Suspender was removed after a suspected malicious ownership transfer and remote code execution in extension updates. Google patched an exploited V8 heap overflow; North Korean actors used fake research personas, malware-laced Visual Studio projects, and Chrome sync for command-and-control. WordPress NextGEN Gallery CSRF bugs enabled RCE.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: Why did Google remove The Great Suspender from the Chrome Web Store and push it off installed browsers?

Question 1

Why did Google remove The Great Suspender from the Chrome Web Store and push it off installed browsers?

Google removed it because its GitHub repository was no longer public and could not be independently reviewed. Google determined that the extension contained malware and could be updated maliciously by its new maintainer. Google removed it because Chrome no longer allows any extension to suspend tabs or release memory. Google found that the extension had stopped suspending tabs and was no longer useful for memory savings.

Question 2: What was the exploit mechanism behind the Chrome zero-day that Google patched on February 4th?

Question 2

What was the exploit mechanism behind the Chrome zero-day that Google patched on February 4th?

A use-after-free in Chrome's networking stack. A race condition in Chrome's extension permission model. A sandbox escape in Chrome's PDF rendering component. A heap buffer overflow in Chrome's V8 JavaScript engine.

Question 3: How was the malicious Chrome extension abusing Chrome sync to bypass local defenses?

Question 3

How was the malicious Chrome extension abusing Chrome sync to bypass local defenses?

It forwarded traffic through a Tor hidden service hidden inside the browser cache. It used synced browser state as an encrypted command-and-control and exfiltration channel. It hijacked Google account passwords to log into a remote admin portal directly. It disabled HTTPS inspection by rewriting the browser's certificate store.

Question 4: What did Microsoft say happened with the Windows Defender ATP detection on the freshly patched Chrome release?

Question 4

What did Microsoft say happened with the Windows Defender ATP detection on the freshly patched Chrome release?

It was caused by malware that had been inserted into Chrome's installer by a third party. It was a false positive caused by what Microsoft called an automation error. It was triggered only on consumer Defender installations, not on ATP. It was a deliberate block because the Chrome update had not been signed by Google.

Question 5: What was the key design problem with the Oldsmar water plant incident?

Question 5

What was the key design problem with the Oldsmar water plant incident?

The attacker changed chlorine dosing through an authenticated local-only console. The plant's firewall failed to block inbound Modbus traffic from the Internet. The plant lacked any automated alarms to detect changes in chemical concentration. Remote access existed to a control interface that could drive sodium hydroxide to toxic levels.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.