Light

Episode #854 Quiz

Anatomy of a Log4j Exploit
Date: 2022-01-18 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Log4j’s JNDI lookup lets crafted log strings trigger LDAP retrieval of malicious Java classes, yielding code execution. Governments and researchers rapidly scanned for vulnerable assets, while new bug bounty efforts found and remediated exposed systems. Attackers weaponized the flaw with PowerShell loaders, C2 polling, encrypted modules, and cleanup routines.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What exact TCP port did the KCodes NetUSB kernel module listen on by default in the affected routers, making it reachable on the WAN interface as well as the LAN?

Question 1

What exact TCP port did the KCodes NetUSB kernel module listen on by default in the affected routers, making it reachable on the WAN interface as well as the LAN?

TCP port 22005 TCP port 19005 TCP port 20005 TCP port 20500

Question 2: Which two HTTP headers were introduced in Chrome’s Private Network Access implementation for preflight negotiation with private-network targets?

Question 2

Which two HTTP headers were introduced in Chrome’s Private Network Access implementation for preflight negotiation with private-network targets?

Access-Control-Request-Private-Network and Access-Control-Allow-Private-Network Access-Control-Request-Intranet and Access-Control-Allow-Intranet Access-Request-Private-Network and Access-Response-Private-Network Access-Control-Request-Local-Network and Access-Control-Allow-Local-Network

Question 3: What condition had to be enabled in IIS for the wormable HTTP trailer flaw to become reachable on Windows servers?

Question 3

What condition had to be enabled in IIS for the wormable HTTP trailer flaw to become reachable on Windows servers?

EnableTrailerSupport set to one EnableHeaderRewrite set to one EnableChunkedSupport set to one EnableHTTP2Support set to one

Question 4: What transport and file path did the Iranian Log4j exploit kit use to retrieve its main PowerShell payload after the initial JNDI callback?

Question 4

What transport and file path did the Iranian Log4j exploit kit use to retrieve its main PowerShell payload after the initial JNDI callback?

A Dropbox URL ending in /public/payload.txt An Amazon S3 URL ending in /doclibrarysales/test.txt An Azure Blob URL ending in /malware/payload.txt A GitHub raw URL ending in /log4j/payload.ps1

Question 5: Which two WordPress plugins shared the same arbitrary site-options update flaw and were cited as affecting tens of thousands of sites?

Question 5

Which two WordPress plugins shared the same arbitrary site-options update flaw and were cited as affecting tens of thousands of sites?

Side Cart WooCommerce and Waitlist WooCommerce Login/Signup Popup and Side Cart WooCommerce WooCommerce Checkout and Cart Notices WooCommerce Login/Signup Popup and Waitlist WooCommerce

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.