Light

Episode #827 Quiz

REvil's Clever Crypto
Date: 2021-07-13 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Microsoft’s PrintNightmare patches left Point and Print vulnerable by design unless registry keys NoWarningNoElevationOnInstall and UpdatePromptSettings are removed or zeroed, because authenticated users can invoke RpcAddPrinterDriverEx and related APIs to load remote DLL printer drivers with SYSTEM privileges. REvil/Sodinokibi ransomware encrypts files with unique Salsa20 keys derived via Curve25519 ECDH.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific registry condition did Microsoft later describe as making Point and Print "vulnerable by design"?

Question 1

According to the episode, what specific registry condition did Microsoft later describe as making Point and Print "vulnerable by design"?

Setting NoWarningNoElevationOnInstall to one Setting UpdatePromptSettings to one Leaving the PointAndPrint key absent Enabling unsigned printer drivers globally

Question 2: What did the CERT note say an attacker could do by abusing RpcAddPrinterDriverEx?

Question 2

What did the CERT note say an attacker could do by abusing RpcAddPrinterDriverEx?

Force a reboot of the print spooler service Decrypt previously encrypted print jobs Bypass driver signing checks for all devices Execute arbitrary code with system privileges

Question 3: What capability was missing from the Kaseya VSA intrusion path that made the resulting ransomware campaign less damaging than it could have been?

Question 3

What capability was missing from the Kaseya VSA intrusion path that made the resulting ransomware campaign less damaging than it could have been?

Initial access to the VSA servers A working per-client decryptor Use of the Sodinokibi encryptor Network penetration and backup wiping

Question 4: In Sodinokibi’s cryptographic design, what is the purpose of the per-file public key stored in each encrypted file header?

Question 4

In Sodinokibi’s cryptographic design, what is the purpose of the per-file public key stored in each encrypted file header?

To decrypt the system-specific private key directly To store the ransom note for that directory To derive the file’s unique Salsa20 key via ECDH To identify the campaign that infected the victim

Question 5: What was the key purpose of the operator key pair in Sodinokibi’s design?

Question 5

What was the key purpose of the operator key pair in Sodinokibi’s design?

To let REvil decrypt any affiliate’s encrypted systems To generate the Salsa20 key for each file locally To prevent malware from using network shares during encryption To let the affiliate decrypt any REvil campaign without permission

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.