Light

Episode #806 Quiz

C.O.M.B.
Date: 2021-02-16 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Oldsmar’s water SCADA used shared Windows 7/TeamViewer remote access on exposed Internet systems, enabling unauthorized sodium hydroxide changes; mitigations include firewalls, VPNs, MFA, patching, and one-way monitoring. Microsoft patched critical Windows RCEs in TCP/IP, Fax, DNS, codecs, and more. SHAREit, WordPress plugins, web shells, and leaked credentials amplified attack surface.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the Massachusetts Department of Environmental Protection advisory discussed in the episode, which remote-access practice did it recommend for monitoring SCADA systems without allowing control changes?

Question 1

According to the Massachusetts Department of Environmental Protection advisory discussed in the episode, which remote-access practice did it recommend for monitoring SCADA systems without allowing control changes?

Use VPN tunnels for all operator access Use direct Internet access through a firewall exception Use one-way unidirectional monitoring devices Use TeamViewer with shared credentials

Question 2: What did the Oldsmar incident report say about when plant personnel acted relative to the SCADA software's own alarm?

Question 2

What did the Oldsmar incident report say about when plant personnel acted relative to the SCADA software's own alarm?

The alarm prevented any chemical dosing from changing Personnel corrected the dosing change after the software alarmed The software alarmed, but personnel ignored it until later Personnel corrected the dosing change before the software alarmed

Question 3: Which Windows TCP/IP flaw did Steve identify as involving an attack via deliberately malformed IP packets carrying a certain old protocol feature?

Question 3

Which Windows TCP/IP flaw did Steve identify as involving an attack via deliberately malformed IP packets carrying a certain old protocol feature?

ICMP redirect handling TCP window scaling handling IPv4 source routing handling IPv6 neighbor discovery handling

Question 4: What was the key exploitation path described for the Responsive Menu WordPress plugin vulnerabilities?

Question 4

What was the key exploitation path described for the Responsive Menu WordPress plugin vulnerabilities?

An admin-only setting exposed the database backup routine A CSRF token leak exposed SSH credentials for site migration A low-privilege user could upload malicious ZIP files containing PHP code A visitor could trigger code execution by loading a crafted image file

Question 5: When discussing the COMB leak, what was Steve's practical advice about old online accounts and their passwords?

Question 5

When discussing the COMB leak, what was Steve's practical advice about old online accounts and their passwords?

Reuse the same password manager entry across dormant sites Rely on email address changes instead of changing passwords Keep old accounts active so breach databases can be audited later Delete unused accounts and replace weak passwords with gibberish

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.