Light

Episode #845 Quiz

Blacksmith
Date: 2021-11-16 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Palo Alto GlobalProtect VPN firewalls on PAN-OS before 8.1.17 allowed unauthenticated remote control and code execution, affecting about 10,000 appliances. Microsoft’s Patch Tuesday fixed 55 flaws, but broke Kerberos delegation. 0patch released a 23-byte micropatch for a Windows privilege-escalation race. Blacksmith bypasses DDR4 TRR, enabling Rowhammer bit flips.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific PAN-OS version boundary was given for the Palo Alto Networks GlobalProtect firewall vulnerability affecting unauthenticated remote control and remote code execution?

Question 1

According to the episode, what specific PAN-OS version boundary was given for the Palo Alto Networks GlobalProtect firewall vulnerability affecting unauthenticated remote control and remote code execution?

Only PAN-OS 8.1.17 and later on virtual firewalls All PAN-OS 8.1 versions prior to 8.1.17 All PAN-OS 10.0 versions prior to 10.0.4 All PAN-OS 9.0 versions prior to 9.0.12

Question 2: What did the Randori disclosure say their exploit was able to do after gaining control of the affected Palo Alto firewall?

Question 2

What did the Randori disclosure say their exploit was able to do after gaining control of the affected Palo Alto firewall?

Gain a shell, access configuration data, and extract credentials Install a persistent kernel driver, tamper with firmware, and hide from scans Bypass multi-factor authentication, decrypt captured traffic, and pivot into cloud tenants Disable all VPN tunnels, erase logs, and reboot the appliance

Question 3: What was the practical scope of the 0patch micropatch discussed for the Windows user profile service issue?

Question 3

What was the practical scope of the 0patch micropatch discussed for the Windows user profile service issue?

It was a 23-byte patch for only older unsupported Windows releases It was a 23-byte patch for Windows 11 systems with the December build installed It was a 23-kilobyte patch for all Windows versions regardless of update level It was a 23-byte patch for 32- and 64-bit Windows 10 systems with October or November updates

Question 4: What was Blacksmith’s core technical approach for defeating DDR4 Rowhammer mitigations?

Question 4

What was Blacksmith’s core technical approach for defeating DDR4 Rowhammer mitigations?

Non-uniform, frequency-based access patterns that bypass TRR Uniform single-sided patterns that rely on cache eviction timing Voltage glitching DIMMs to disable on-chip refresh logic directly Kernel-assisted page table manipulation to avoid memory refresh altogether

Question 5: Which exploitability demonstrations did the Blacksmith paper say were successful on the flipped bits it produced?

Question 5

Which exploitability demonstrations did the Blacksmith paper say were successful on the flipped bits it produced?

A browser sandbox escape, a TLS certificate forgery, and a firmware overwrite A DNS cache poison, a VM escape, and a printer spooler compromise A Kerberos delegation bypass, an Exchange mailbox takeover, and an SSH agent hijack A page-table pivot, RSA-2048 key recovery, and sudoers privilege escalation

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.