Light

Episode #836 Quiz

The Meris Botnet
Date: 2021-09-14 | Length: 2 hrs | Episode page at twit.tv

About this episode

Meris is a large botnet of compromised MikroTik routers, likely exploiting an unknown vulnerability or brute force, and using HTTP/1.1 pipelining, HTTPS, and open ports 2000 and 5678 to generate record 21.8 million requests-per-second Layer 7 DDoS attacks. Because requests are valid, blocking is difficult, requiring per-IP rate tracking.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific browser and domain-scoping limitation allowed Spook.js to bypass Chrome's Site Isolation protections?

Question 1

According to the episode, what specific browser and domain-scoping limitation allowed Spook.js to bypass Chrome's Site Isolation protections?

It isolated only at the URL path level, letting different pages share a process It isolated only at the second-level domain, letting subdomains share a process It isolated only at the IP-address level, letting virtual hosts share a process It isolated only at the top-level domain, letting sibling domains share a process

Question 2: What change did Google make in response to the Spectre-based Spook.js research, and what was the immediate effect of that change?

Question 2

What change did Google make in response to the Spectre-based Spook.js research, and what was the immediate effect of that change?

It added Strict Extension Isolation, increasing the number of processes It moved all extensions into a single hardened process, reducing the number of processes It disabled JavaScript timers, reducing the number of extensions It disabled Site Isolation entirely, reducing the number of processes

Question 3: Which combination of characteristics did Qrator Labs identify as particularly significant in the Meris botnet's attack traffic?

Question 3

Which combination of characteristics did Qrator Labs identify as particularly significant in the Meris botnet's attack traffic?

TCP SYN trickling, packet-rate flooding, and open port 443 UDP flooding, bits-per-second attacks, and open port 53 HTTP pipelining, requests-per-second attacks, and open port 5678 DNS reflection, connection-state exhaustion, and open port 80

Question 4: What did the episode say was the most likely device family underlying the Meris botnet, and what evidence supported that conclusion?

Question 4

What did the episode say was the most likely device family underlying the Meris botnet, and what evidence supported that conclusion?

Netgear routers, shown by identical factory-default credentials Linksys routers, shown by a single vulnerable firmware release MikroTik routers, shown by a broad spread of RouterOS versions Cisco switches, shown by an old SNMP management interface

Question 5: What did the episode say was the scale and triggering method of the largest attack seen from the Meris botnet?

Question 5

What did the episode say was the scale and triggering method of the largest attack seen from the Meris botnet?

21.8 million HTTP requests per second in a zero-based graph 21.8 gigabits per second in a zero-based graph 21.8 million TCP SYN packets per second in a zero-based graph 17 million HTTP requests per second in a zero-based graph

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.