Light

Episode #826 Quiz

The Kaseya Saga
Date: 2021-07-06 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

PrintNightmare exploited Windows Print Spooler RPC authentication bypasses to install malicious print drivers, enabling local privilege escalation and remote code execution; Microsoft’s initial patch was incomplete, so disabling the spooler or applying out-of-band updates was advised. Separately, REvil leveraged Kaseya VSA zero-days and antimalware exclusions to push ransomware through MSP supply chains.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What did the Chinese researcher from NSFOCUS say Microsoft had done when they patched CVE-2021-1675 in the June Patch Tuesday fix?

Question 1

What did the Chinese researcher from NSFOCUS say Microsoft had done when they patched CVE-2021-1675 in the June Patch Tuesday fix?

They replaced the vulnerable API with a new authenticated printer installation interface. They fixed the remote code execution path but left only the local privilege path unresolved. They disabled the Print Spooler service entirely in the initial patch. They tested only the proof-of-concept from his report and left the underlying flaw unresolved.

Question 2: What control did Western Digital say was missing from the My Book Live refactor that introduced the unauthenticated factory reset flaw?

Question 2

What control did Western Digital say was missing from the My Book Live refactor that introduced the unauthenticated factory reset flaw?

A network ACL that blocked remote reset requests by default. The ADMIN_AUTH_LAN_ALL authentication type in component_config.php. A signed firmware manifest in the system_factory_restore.php routine. A hard-coded administrator password in the reset endpoint.

Question 3: According to the episode, what two changes made Kaseya VSA especially effective as a ransomware delivery channel once the server was compromised?

Question 3

According to the episode, what two changes made Kaseya VSA especially effective as a ransomware delivery channel once the server was compromised?

It used trusted agent updates and required antivirus exclusions on client endpoints. It relied on a public download site and randomized payload signing keys. It forced victims to open each payload manually and approve it interactively. It depended on local-only management tools and blocked internet access by design.

Question 4: What immediate operational response did the DIVD help coordinate once the Kaseya attack was underway?

Question 4

What immediate operational response did the DIVD help coordinate once the Kaseya attack was underway?

A firmware patch for all affected MSP client endpoints. A blocklist of all commercial VPN providers and Tor exit nodes. A list of publicly accessible VSA IPs and customer IDs for shutdown efforts. A decryption key release for affected REvil victims.

Question 5: What did REvil publicly offer for $70 million in bitcoin in its 'Happy Blog' post about the Kaseya attack?

Question 5

What did REvil publicly offer for $70 million in bitcoin in its 'Happy Blog' post about the Kaseya attack?

A public patch to remove the Kaseya authentication bypass vulnerability. A guarantee that no files had been exfiltrated before encryption. A universal decryptor for all victims with recovery in under an hour. A source code release for the VSA exploit chain and persistence mechanism.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.