Light

Episode #855 Quiz

Inside the NetUSB Hack
Date: 2022-01-25 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Log4j scanning persisted, while cyber-insurers tightened coverage, forcing multifactor authentication and sharply higher premiums. WordPress plugins remained a major risk: WP HTML Mail exposed unauthenticated REST endpoints enabling code injection and takeover, and AccessPress themes/plugins were backdoored in a supply-chain breach. Kaspersky also found MoonBounce, a persistent UEFI SPI-memory bootkit.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the NetUSB flaw discussed in the episode, what specific arithmetic mistake turns the router's intended allocation into a 16-byte buffer?

Question 1

In the NetUSB flaw discussed in the episode, what specific arithmetic mistake turns the router's intended allocation into a 16-byte buffer?

Adding 16 to a maximum 32-bit unsigned length value causes wraparound to 17 Subtracting 17 from a maximum 32-bit unsigned length value causes wraparound to 16 Adding 17 to a signed 16-bit length value causes wraparound to 16 Adding 17 to a maximum 32-bit unsigned length value causes wraparound to 16

Question 2: What was the key network exposure detail that made the NetUSB service especially dangerous beyond a normal LAN-only flaw?

Question 2

What was the key network exposure detail that made the NetUSB service especially dangerous beyond a normal LAN-only flaw?

It listened only on UDP port 20005, making firewalling impossible It was bound only to the LAN interface, limiting abuse to local users It was bound to 0.0.0.0, exposing port 20005 on both LAN and WAN It required VPN authentication before any client could reach the command parser

Question 3: Which command path did the Sentinel Labs researchers identify as the one that led into the vulnerable allocation logic?

Question 3

Which command path did the Sentinel Labs researchers identify as the one that led into the vulnerable allocation logic?

Hex command 805E, which dispatched to SoftwareBus_dispatch Normal EP Msg Out Hex command 805F, which dispatched to SoftwareBus_dispatch Normal EP Msg Out Hex command 805F, which dispatched to USBBus_dispatch Normal EP Msg In Hex command 8051, which dispatched to SoftwareBus_dispatch Normal EP Msg Out

Question 4: What mitigation did the episode say the school-district cyber-insurance pool required before full coverage limits would apply?

Question 4

What mitigation did the episode say the school-district cyber-insurance pool required before full coverage limits would apply?

A complete migration of all services to a private cloud provider Mandatory encryption of all endpoint disks before policy renewal Full multifactor authentication for all logins across all accounts A monthly external penetration test of all public-facing services

Question 5: How did MoonBounce differ from most other UEFI bootkits according to the episode?

Question 5

How did MoonBounce differ from most other UEFI bootkits according to the episode?

It required reinstalling Windows to remove, but not reflashing firmware It infected SPI memory on the motherboard rather than only the EFI System Partition It persisted only in the EFI System Partition and never touched firmware storage It was a userland implant delivered through browser JavaScript

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.