Light

Episode #843 Quiz

Trojan Source
Date: 2021-11-02 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Trojan Source exploits Unicode bidirectional controls and isolates to make source code visually differ from compiler interpretation, hiding logic changes from reviewers. It affects C, C++, C#, JavaScript, Java, Rust, Go, and Python. Defenses include banning or terminating bidi controls in source, plus compiler, editor, repository, and build-pipeline checks.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the Firefox add-on incident discussed in the episode, what specific operational problem did the two add-ons create for affected users?

Question 1

In the Firefox add-on incident discussed in the episode, what specific operational problem did the two add-ons create for affected users?

They disabled certificate validation for HTTPS connections and exposed browsing sessions They prevented Firefox from downloading updates and refreshing block lists They injected scripts into every loaded webpage and redirected traffic to ad networks They crashed Firefox whenever a proxy was configured and made the browser unusable

Question 2: What mitigation did Mozilla add starting with Firefox 91.1 to reduce the impact of proxy-API abuse on important requests?

Question 2

What mitigation did Mozilla add starting with Firefox 91.1 to reduce the impact of proxy-API abuse on important requests?

It permanently disabled the proxy API for all extensions It fell back to direct connections when a proxied important request failed It forced all add-ons to route traffic through Mozilla-controlled relays It required every add-on to use signed proxy rules from a central allowlist

Question 3: According to the episode, what was the key reason the Trojans Source attack can fool code reviewers?

Question 3

According to the episode, what was the key reason the Trojans Source attack can fool code reviewers?

Whitespace normalization causes comments to disappear during compilation Line ending conversion changes token boundaries between editors and compilers Compiler optimizations can reorder statements unless source files are signed Unicode bidirectional control characters can make the displayed order differ from the logical order

Question 4: Which language set was explicitly called out in the episode as having working Trojan Source examples in the paper?

Question 4

Which language set was explicitly called out in the episode as having working Trojan Source examples in the paper?

C, C++, C#, JavaScript, Java, Rust, Go, and Python C++, C#, Objective-C, JavaScript, Lua, Rust, Go, and Python C, Perl, Ruby, PHP, Swift, Kotlin, Go, and Python C, Clojure, Erlang, Rust, TypeScript, Java, Go, and Python

Question 5: What did the researchers report finding in public repositories when they scanned for signs of Trojan Source-style abuse before disclosure?

Question 5

What did the researchers report finding in public repositories when they scanned for signs of Trojan Source-style abuse before disclosure?

A concealed invocation of system('cat /etc/passwd') inside a Ruby script A backdoored firmware image disguised as a text asset in GitHub A malicious SQL statement buried in a Python docstring comment A hidden OpenSSL private key embedded in a Java build file

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.