Light

Episode #820 Quiz

The Dark Escrow
Date: 2021-05-25 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Firefox’s Fission enables full site isolation by assigning each domain its own OS process, reducing cross-site compromise but increasing memory use. Conti ransomware’s phishing, lateral movement, credential theft, and delayed encryption enable data exfiltration extortion. The episode also highlights rapid vulnerability scanning, insecure exposed routers, and emerging ransomware escrow services.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In Firefox Fission, what operational change does Steve recommend enabling for better site isolation?

Question 1

In Firefox Fission, what operational change does Steve recommend enabling for better site isolation?

Set fission.autostart to true in about:config Set site.isolation.default to true in about:config Enable process.per.domain in about:profiles Turn on browser.sandbox.enabled in about:config

Question 2: What combination of initial access and post-exploitation behavior did Steve describe for the Conti/Wizard Spider group?

Question 2

What combination of initial access and post-exploitation behavior did Steve describe for the Conti/Wizard Spider group?

They exploit exposed RDP, deploy Emotet and Cobalt Strike, then encrypt immediately They brute-force VPNs, deploy Ryuk and QakBot, then exfiltrate after encryption They use watering holes, deploy Agent Tesla and LockBit, then ransom only after public disclosure They phish for access, deploy TrickBot and BazarLoader, then wait for a quiet time before encrypting

Question 3: Why did the High Court of Ireland injunction against the Conti gang include a demand that the attackers identify themselves?

Question 3

Why did the High Court of Ireland injunction against the Conti gang include a demand that the attackers identify themselves?

It was intended to force the press to disclose the attackers’ identities after publication It was designed to prevent media and others in Ireland from publishing leaked stolen data It was issued to compel the Conti gang to return the decryptor they had posted It was meant to aid later enforcement if the gang could be traced by law enforcement

Question 4: What did the Palo Alto Cortex Xpanse research find about the speed of attacker scanning after vulnerability disclosure?

Question 4

What did the Palo Alto Cortex Xpanse research find about the speed of attacker scanning after vulnerability disclosure?

Attackers generally waited until vendors issued postmortems before scanning Attackers needed several hours to build scans, even for Exchange Attackers could begin scanning within about 15 minutes, and Exchange scans appeared within five minutes of patches Attackers usually began scanning within days of disclosure, except for Exchange

Question 5: What future ransomware-market mechanism did Steve predict would emerge after the DarkSide fallout?

Question 5

What future ransomware-market mechanism did Steve predict would emerge after the DarkSide fallout?

A reputation bureau that blocks all ransomware negotiations A neutral intermediary that holds ransom payments in escrow for affiliates A government-backed wallet that automatically returns seized bitcoin A centralized clearinghouse that publishes victim names before payment

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.