Light

Episode #848 Quiz

XSinator
Date: 2021-12-07 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Tavis Ormandy found a memory-corruption bug in Mozilla NSS signature verification, affecting most NSS uses before 3.73/3.68.1 ESR; DER-encoded DSA and RSA-PSS signatures in PDF and email clients could trigger heap overflow, crashing or enabling code execution. Researchers also showed XS-Leaks let hostile pages infer cross-origin user state through browser side channels.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, which kind of NSS usage was identified as the locus of the heap-based buffer overflow in the Mozilla NSS signature verification bug?

Question 1

According to the episode, which kind of NSS usage was identified as the locus of the heap-based buffer overflow in the Mozilla NSS signature verification bug?

OCSP responses or CRL distribution points DER-encoded DSA or RSA-PSS signatures PKCS#11 tokens or CMS envelopes TLS session tickets or ECDSA certificates

Question 2: What did Dr.Web find was the default password on the kids' smartwatches they analyzed?

Question 2

What did Dr.Web find was the default password on the kids' smartwatches they analyzed?

000000 111111 654321 123456

Question 3: Which six VPN services were added to Russia's banned list in the episode?

Question 3

Which six VPN services were added to Russia's banned list in the episode?

Hola VPN, ExpressVPN, Nord VPN, Speedify VPN, IPVanish VPN, VyprVPN Betternet, Cloudflare WARP, Hola VPN, Tachyon VPN, ExpressVPN, Private Tunnel ProtonVPN, Opera VPN, KeepSolid VPN Unlimited, Lantern, X-VPN, Private Tunnel Betternet, Lantern, X-VPN, Cloudflare WARP, Tachyon VPN, Private Tunnel

Question 4: In the GitLab example of an XS-Leak, what value of window.length indicated that the user was not logged in?

Question 4

In the GitLab example of an XS-Leak, what value of window.length indicated that the user was not logged in?

0 1 2 3

Question 5: How did the Glupteba botnet recover command-and-control information when its C&C server was interrupted, according to the episode?

Question 5

How did the Glupteba botnet recover command-and-control information when its C&C server was interrupted, according to the episode?

It fell back to three Telegram channels maintained by the operators It queried a public DNS zone for three hard-coded domain names It searched the public bitcoin blockchain for three controlled bitcoin addresses It contacted three rotating Tor hidden services embedded in the malware

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.