Light

Episode #810 Quiz

ProxyLogon
Date: 2021-03-16 | Length: 2 hrs | Episode page at twit.tv

About this episode

Chrome 89 patched five flaws, including a Blink use-after-free zero-day, while improving memory use via PartitionAlloc and tab discarding. Google also published Spectre JavaScript PoCs, urging COOP, COEP, CORP, and Fetch Metadata headers plus X-Frame-Options and X-Content-Type-Options to isolate processes, block cross-origin access, and resist CSRF and fingerprinting attacks.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific combination was required to guarantee process-level isolation for highly sensitive applications in Chrome or Firefox?

Question 1

According to the episode, what specific combination was required to guarantee process-level isolation for highly sensitive applications in Chrome or Firefox?

Enable both COEP and X-Content-Type-Options headers Enable both CORP and X-Frame-Options headers Enable both COEP and COOP headers Enable both CORP and COOP headers

Question 2: What did the episode say the new Chrome zero-day was found in?

Question 2

What did the episode say the new Chrome zero-day was found in?

Chrome's WebRTC media stack Chrome's tab group management code Chrome's Blink rendering engine Chrome's V8 JavaScript engine

Question 3: How did the Ben-Gurion/University of Michigan/University of Adelaide researchers eliminate JavaScript from their browser-based side-channel attack?

Question 3

How did the Ben-Gurion/University of Michigan/University of Adelaide researchers eliminate JavaScript from their browser-based side-channel attack?

By using SVG filters and canvas timing By relying on WebAssembly and service workers By using hidden iframes and postMessage events By using CSS attribute selectors and HTML only

Question 4: Which feature of DNS server did Microsoft patch in March that the episode said was used for these remote code execution flaws?

Question 4

Which feature of DNS server did Microsoft patch in March that the episode said was used for these remote code execution flaws?

Recursive caching of external queries Zone transfer handling for secondary servers Dynamic Update processing of DNS packets DNSSEC signature validation for signed zones

Question 5: What did the episode say was still necessary after patching Exchange servers compromised by ProxyLogon?

Question 5

What did the episode say was still necessary after patching Exchange servers compromised by ProxyLogon?

Disabling all Exchange autodiscover endpoints Rebuilding the Active Directory forest from scratch Rotating all user passwords before rebooting the server Removing the web shells left behind by attackers

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.