Light

Episode #833 Quiz

Microsoft's Reasoned Neglect
Date: 2021-08-24 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Firefox will default-block mixed-content HTTP downloads from HTTPS pages, with user override. T-Mobile’s breach exposed IMSI, IMEI, PINs, SSNs, and IDs for tens of millions; the key mitigation is permanent credit-bureau locks. ProxyShell enabled Exchange RCE, web shells, and ransomware. Razer’s installer flaw granted SYSTEM.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the Firefox section, what specific configuration change was described as enabling Firefox's upcoming default behavior before version 92?

Question 1

In the Firefox section, what specific configuration change was described as enabling Firefox's upcoming default behavior before version 92?

Enable mixed.content.downloads in the browser privacy settings Set dom.block_download_insecure to true in about:config Disable HTTP navigation warnings in the browser advanced settings Set security.mixed_content.block_downloads to true in about:config

Question 2: Which combination of customer data did T-Mobile confirm was exposed for 13.1 million current postpaid accounts?

Question 2

Which combination of customer data did T-Mobile confirm was exposed for 13.1 million current postpaid accounts?

Phone numbers, SIM activation codes, and billing ZIP codes First and last names, account PINs, phone numbers, and email addresses First and last names, date of birth, Social Security number, and driver's license or ID information Customer names, device IMEIs, and credit card numbers

Question 3: What did the Orange Tsai ProxyShell chain allow before authentication, according to Steve's description?

Question 3

What did the Orange Tsai ProxyShell chain allow before authentication, according to Steve's description?

Token replay against the PowerShell service after mutual authentication Remote code execution on an affected Exchange Server without an account Password reset access to a mailbox after valid login Arbitrary file upload only after administrator approval

Question 4: What was the critical design mistake in the Razer installer flow that enabled local privilege escalation?

Question 4

What was the critical design mistake in the Razer installer flow that enabled local privilege escalation?

The installer misvalidated a USB descriptor and crashed into kernel mode The installer exposed a network service on localhost with default credentials The installer downloaded unsigned drivers that Windows executed automatically A privileged installer spawned a folder dialog that retained system rights

Question 5: What did Mandiant say the Kalay device registration process required in order to join the network?

Question 5

What did Mandiant say the Kalay device registration process required in order to join the network?

A pair of shared secrets negotiated through the mobile app A signed firmware image and a provisioning PIN from CISA A manufacturer-issued client certificate and a rotating OTP token Only the device's 20-byte uniquely assigned identifier, or UID

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.