Light

Episode #837 Quiz

Cobalt Strike
Date: 2021-09-21 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

The episode covers a prolonged ransom DDoS campaign against VoIP.ms, where attackers first crippled DNS and then targeted direct IP access, forcing hosts-file workarounds and Cloudflare migration. It also details Microsoft and Chrome patching multiple zero-days, Android permission auto-reset backporting, and Cobalt Strike’s Beacon, a covert post-exploitation agent abused for remote control.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What specific service did VoIP.ms tell customers to edit locally in order to bypass DNS resolution during the attack?

Question 1

What specific service did VoIP.ms tell customers to edit locally in order to bypass DNS resolution during the attack?

Their resolver cache Their browser proxy settings Their routing table Their hosts file

Question 2: According to the episode, what was the main reason Steve said traditional web DDoS protections were not applicable to the VoIP.ms attack?

Question 2

According to the episode, what was the main reason Steve said traditional web DDoS protections were not applicable to the VoIP.ms attack?

They can only absorb attacks against cached content They were designed for browser-based web requests They require DNSSEC to function correctly They only protect against SMTP traffic floods

Question 3: What change did VoIP.ms make to mitigate the impact once attackers began targeting the domain name and then the direct IP address?

Question 3

What change did VoIP.ms make to mitigate the impact once attackers began targeting the domain name and then the direct IP address?

They moved their website and DNS servers to Cloudflare They re-registered the domain under a new registrar They migrated all call handling to Amazon Route 53 They disabled all customer portals until the attack ended

Question 4: Which two Chrome zero-day vulnerabilities did Google patch in the release discussed in the episode?

Question 4

Which two Chrome zero-day vulnerabilities did Google patch in the release discussed in the episode?

A buffer overflow in Skia and a race in the sandbox A type confusion in Blink and a CSRF flaw in extensions A heap corruption in WebRTC and a privilege bypass in DevTools An out-of-bounds write in V8 and a use-after-free in IndexedDB

Question 5: What did Proofpoint say about the proportion of identified Cobalt Strike campaigns attributed to known threat actors after 2019, compared with 2016 through 2018?

Question 5

What did Proofpoint say about the proportion of identified Cobalt Strike campaigns attributed to known threat actors after 2019, compared with 2016 through 2018?

About 66% after 2019, down from about 15% before About 15% after 2019, down from about 66% before About 50% after 2019, down from about 25% before About 15% before 2019, rising to about 66% after

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.